Can't delete Avira registry key

On 05/09/2018 14:01, Andy Burns wrote:
Fokke Nauta wrote:

psexec.exe can't run: access denied.

Did it say "Couldn't install PSEXESVC service"?

Indeed

If so then you need to "run as administrator"

I did. It started Regedit. But still wasn't able to delete the Avira key.

Fokke

Fokke Nauta wrote:

Andy Burns wrote:

you need to "run as administrator"

I did. It started Regedit. But still wasn't able to delete the Avira key.

Did you try execTI.exe ?

On 05/09/2018 14:22, Andy Burns wrote:
Fokke Nauta wrote:

Andy Burns wrote:

you need to "run as administrator"

I did. It started Regedit. But still wasn't able to delete the Avira key.

Did you try execTI.exe ?


Didn't know this one. Just downloaded it.
Start execTI and then choose regedit.exe, I guess?
Or do I need to run it as admin?

Fokke

Fokke Nauta wrote:

Tried RegOwnit. Was able to free the key but still can't delete is.
There is an error when deleting the key, it says, or something like
that.

Having a WOW6432Node registry key means you are running a 64-bit version
of Windows 10. The OS redirects registry calls from 32-bit applications
to the WOW6432Node registry sub-hive to keep them separate from 64-bit
applications' registry.

When a 32-bit app uses the registry API to access the keys under:
HKEY\Local_Machine\Software\company\product subkey
Windows redirects the call to
HKEY\Local_Machine\Software\company\product

When you used Revo Uninstaller, you need to use the 64-bit version of
it. The free version was available only as a 32-bit version for a long
time, so its cleanup was only partial. I believe they did finally come
out with a 64-bit version of the freeware. Make sure you are using a
new version of Revo Uninstaller.

When using Revo, it first runs the uninstaller for the program. When
the program runs, it creates a log file of what changes it makes (not
what changes were made by the program or OS after the installation).
The uninstaller is actually the installer using that log to remove the
change. Revo then does some further cleanup but, as I recall, it has 3
modes: basic, intermediate, and aggressive. Basic still leaves a lot of
stuff behind probably using only its hard-coded database of
installations along with linkages in the registry between keys to do the
basic cleanup. Intermediate has you deciding what to delete.
Aggressive can result in deleting stuff that has nothing to do with the
program you are trying to remove.

When using RegOwnIt, did you select to BOTH take ownership to your
currently logged in Windows account (which MUST be in the Administrators
security group) AND to change permissions to Full? Are you logged in
under a admin-level Windows account when you go into the registry to
edit it?

That you cannot delete the registry key even after taking ownership of
it along with all its subkeys - and also then changed permissions on
that key and all its child objects (by propagating the permission
changes to the key's children) - then something is protecting that key
or there remains a subkey to which you don't have ownership and full
permissions that prevent you from deleting its parent. That makes me
wonder if you really did uninstall Avira. Seems something is still
lingering. Anti-virus apps tend to protect their registry keys (unlike
Defender where you can still pull the rug out from under it by editing
its registry keys). Have you tried editing the registry after booting
into Windows' safe mode (to eliminate any startup programs and
non-critical services from interferring with the edit)?

Did you ever use Avira's own cleanup tool?
https://www.avira.com/en/support-dow...trycleaner/1//

I don't know if that will work after performing an uninstallation,
especially after using Revo.

https://answers.avira.com/de/questio...stry-keys-9795

That mentions you must reboot Windows after doing the cleanup. The
uninstall should've had you perform a reboot to get rid of Avira's
drivers still in memory and to replace/delete inuse (locked) files.
Since a reboot is needed, I don't know if Revo is smart enough to
continue its cleanup after using it to start the uninstall, do a reboot,
and then continue using Revo after the reboot. Have you ever rebooted
after the Avira uninstall or after using their cleanup tool (and then do
the registry edits)? Not a [hybrid] hibernate power cycle but a full
shutdown and a cold boot that loads a fresh copy of the OS.

That article also mentions setting permissions for both the SYSTEM and
your own account (which must be an admin-level account). I don't know
why SYSTEM's permissions would need changing if your admin-level account
has full permissions.

After using RegOwnIt, did you check ownership on the Avira registry key
and that it has full permissions? If so, does it have subkeys? If so,
do you have ownership and full control of those? Will it let you
disconnect (disable) inheriting permissions from its parent key? Have
you tried running RegOwnIt after booting into Windows' safe mode?

Was Avira's anti-virus the only Avira product installed? Besides their
AV, they have a firewall, VPN, software updater, Optimizer, Speedup Pro,
[Dark Web] Identity Scanner, and maybe more.

Sorry, cannot troubleshoot a "something like that" error message.

I see you finally divulged in your reply to Paul that you are NOT
physically at the computer you are trying to clean. You are using
TeamViewer to remotely manipulate the other person's computer. That
could be getting in your way. I thought you were actually at the
computer while editing the registry. Since the registry key is
superfluous and the only reason why you are trying to delete it is
because you want to do some non-essential cleanup, just leave it there.
Wait until you get around to actually being physically at the computer
to edit the registry. regedit.exe can remotely edit the registry but
that's using network to access another host on your network, not by
emulating a presence via Teamviewer.

On 05/09/2018 16:56, VanguardLH wrote:
Fokke Nauta wrote:

Tried RegOwnit. Was able to free the key but still can't delete is.
There is an error when deleting the key, it says, or something like
that.

Having a WOW6432Node registry key means you are running a 64-bit version
of Windows 10. The OS redirects registry calls from 32-bit applications
to the WOW6432Node registry sub-hive to keep them separate from 64-bit
applications' registry.

When a 32-bit app uses the registry API to access the keys under:
HKEY\Local_Machine\Software\company\product subkey
Windows redirects the call to
HKEY\Local_Machine\Software\company\product

?

When you used Revo Uninstaller, you need to use the 64-bit version of
it. The free version was available only as a 32-bit version for a long
time, so its cleanup was only partial. I believe they did finally come
out with a 64-bit version of the freeware. Make sure you are using a
new version of Revo Uninstaller.

I have installed RevoUninProSetup 3.2.1
The most recent Pro installer. Licensed. I thought it is good stuff.

When using Revo, it first runs the uninstaller for the program. When
the program runs, it creates a log file of what changes it makes (not
what changes were made by the program or OS after the installation).
The uninstaller is actually the installer using that log to remove the
change. Revo then does some further cleanup but, as I recall, it has 3
modes: basic, intermediate, and aggressive. Basic still leaves a lot of
stuff behind probably using only its hard-coded database of
installations along with linkages in the registry between keys to do the
basic cleanup. Intermediate has you deciding what to delete.
Aggressive can result in deleting stuff that has nothing to do with the
program you are trying to remove.

I used the aggressive one. It fount the registry keys and I had it
delete all of them. After rebooting, it again did find all registery
keys. You guess it, I deleted all of them. But they remain.

When using RegOwnIt, did you select to BOTH take ownership to your
currently logged in Windows account (which MUST be in the Administrators
security group) AND to change permissions to Full?

Yes! Nice utility!

Are you logged in
under a admin-level Windows account when you go into the registry to
edit it?

Yes!

That you cannot delete the registry key even after taking ownership of
it along with all its subkeys - and also then changed permissions on
that key and all its child objects (by propagating the permission
changes to the key's children) - then something is protecting that key
or there remains a subkey to which you don't have ownership and full
permissions that prevent you from deleting its parent. That makes me
wonder if you really did uninstall Avira.

Yes, I did. It's no longer there. Only that registry key.

Seems something is still
lingering. Anti-virus apps tend to protect their registry keys (unlike
Defender where you can still pull the rug out from under it by editing
its registry keys). Have you tried editing the registry after booting
into Windows' safe mode (to eliminate any startup programs and
non-critical services from interferring with the edit)?

Did you ever use Avira's own cleanup tool?
https://www.avira.com/en/support-dow...trycleaner/1//

Yes, but it wants to work after booring in safe mode. I can't do that
with Teamviewer.
That will be the next step, but I'll have to be there.

I don't know if that will work after performing an uninstallation,
especially after using Revo.

https://answers.avira.com/de/questio...stry-keys-9795

That mentions you must reboot Windows after doing the cleanup.

Ofcourse I did

The
uninstall should've had you perform a reboot to get rid of Avira's
drivers still in memory and to replace/delete inuse (locked) files.
Since a reboot is needed, I don't know if Revo is smart enough to
continue its cleanup after using it to start the uninstall, do a reboot,
and then continue using Revo after the reboot. Have you ever rebooted
after the Avira uninstall or after using their cleanup tool (and then do
the registry edits)? Not a [hybrid] hibernate power cycle but a full
shutdown and a cold boot that loads a fresh copy of the OS.

Just a restart. Wasn't it enough?

That article also mentions setting permissions for both the SYSTEM and
your own account (which must be an admin-level account). I don't know
why SYSTEM's permissions would need changing if your admin-level account
has full permissions.

After using RegOwnIt, did you check ownership on the Avira registry key
and that it has full permissions?

Tried to change the ownership - without success :-(

If so, does it have subkeys?

Yes.

If so,
do you have ownership and full control of those?

Didn't bother. Tried to get full ownership of the master key. Believed
that all subkeys would follow.

Will it let you
disconnect (disable) inheriting permissions from its parent key? Have
you tried running RegOwnIt after booting into Windows' safe mode?

Can't use safemode yet as I'm working with Teamviewer.

Was Avira's anti-virus the only Avira product installed?

Yes, happily.

Besides their
AV, they have a firewall, VPN, software updater, Optimizer, Speedup Pro,
[Dark Web] Identity Scanner, and maybe more.

They're all ****.

Sorry, cannot troubleshoot a "something like that" error message.

I see you finally divulged in your reply to Paul that you are NOT
physically at the computer you are trying to clean.

Correct

You are using
TeamViewer to remotely manipulate the other person's computer. That
could be getting in your way. I thought you were actually at the
computer while editing the registry.

No, unfortunately not.

Since the registry key is
superfluous and the only reason why you are trying to delete it is
because you want to do some non-essential cleanup, just leave it there.
Wait until you get around to actually being physically at the computer
to edit the registry. regedit.exe can remotely edit the registry but
that's using network to access another host on your network, not by
emulating a presence via Teamviewer.


You're right, I really need to be there.
And then try again, with more knowledge ...

Fokke