AVG key in registry

[GTP]

Client tried to remove AVG incorrectly, so I re-installed it and used Geek Uninstaller to remove it.
But it left this registry key behind in the Win 7 registry called AVG with a subfolder of Antivirus.

It's in msconfig as AVGUI.exe as well and if I try to disable it from starting it just re-enables.

I've tried from Admin account:
Changing Permissions in the registry for that key. "permission denied. error deleting key"

All below run as Admin from Admin account.

Autoruns. "Error deleting key, permission denied

Process Hunter. "Error deleting key, access denied."

Sysinternals "RunAsSystem" "error deleting key"

Sysinternals "Registrar Registry Manager Home" "error deleting key"

AVG Removal Tool. No traces of AVG found.

AV Removal Tool in WRT just opens the AVG Removal tool.

RegSeeker finds it but won't allow me to delete it.


I need to get rid of it because it opens the AVG UI on the desktop on every restart.
I can't do anything with the UI. To close it have to end task on it.

Any help appreciated.

 

[Moltuae]

Have you tried changing the key's owner (Permissions -> Advanced)?

 

[GTP]

Yes, still won't let me delete it.

 

[Moltuae]

Hmmm. Strange. So you (the admin) are the owner AND you've set your permissions to full control?

Since you're running regedit 'as administrator' you could also try making the built-in administrator account the owner and giving it full control.

 

[AlexCa]

What if you re-install and don't use Geek Uninstaller to uninstall? In the part where Geek scans and removes leftovers, It might be removing some registry key that would trigger the rest of the uninstall after a system restart.

 

[GTP]

Yeah, I already thought of that as well. Still can't delete the damn thing.
I managed to find and delete some more AVG entries with one of the registry editors in Gandalf's PE, but this one persists.

 

[Diggs]

Win10 Pro? Pro tends to mess with user admin permissions.

Delete the program files/folders and then let a registry cleaner (wince!) clean up. (???)

 

[GTP]

Win10 Pro? Pro tends to mess with user admin permissions.

Delete the program files/folders and then let a registry cleaner (wince!) clean up. (???)

Iv'e tried several "registry cleaners" (see above) some found more than others but none can remove the AVG/Antivirus/AVGUI folders.
I thought I had stopped the AVGUI from starting on restarts but it's back again.
I'm going to convince the client to N&P

Win10 Pro?

Windows 7 Home.

 

[HCHTech]

Maybe Tweaking's permission repair run? It's a Hail Mary but....

 

[HFultzjr]

How about:
Re-install/overwrite it.
Remove with Revo Uninstaller Portable (use in most aggressive mode)
Run this:
https://www.bleepingcomputer.com/download/avg-remover/
Don't forget to backup when doing aggressive things such as this.

Also may want to check this out:
https://support.avg.com/answers?id=906b0000000Dq32AAC

 

[backwoodsman]

What happens if you just delete AVGUI.exe?

 

[Archon Prime]

hidden folder for app data, etc. stuff lingers in there. should be able to remove it in safe boot. then remove the registry values. all it's doing is triggering that damn exe. Should be able toss it after that. I HATE AVG....it's disgusting and bulky, just like Avast.

 

[Diggs]

If it's because you can't delete the folders then throw it on a Linux machine, delete what ever you want and then clean up with a registry cleaner in Windows. It's a bit caveman but usually works well enough.

 

[glennd]

AVG has self protection which is a service from memory. I'm guessing that's still active.

 

[GTP]

Run this:
https://www.bleepingcomputer.com/download/avg-remover/

I've run their crappy tool now about 4 times. It completes with "There are no AVG products/files found"

What happens if you just delete AVGUI.exe?

Oh that would be wonderful! But this is what I have been trying to do.

hidden folder for app data, etc. stuff lingers in there. should be able to remove it in safe boot.

carefully removed anything AVG related in AppData folders, Program Data and Common folders.
Tried Safe mode, still no good.

If it's because you can't delete the folders then throw it on a Linux machine, delete what ever you want and then clean up with a registry cleaner in Windows. It's a bit caveman but usually works well enough.

I have deleted everything I could find that was AVG related.
It is the registry keys that I cannot delete. Even importing the registry into a registry editor wont allow me to delete them!
Just tried PSExec from Sysinternals and still they persist.
I'm over it! Convinced the client to N& P

I'm about 5 minutes? away from that N &P.
Answering you'all while I wait for Fabs Autobackup to finish.


Thanks everyone.

 

[Porthos]

FRST script

 

[GTP]

FRST script

Thanks @Porthos but you're too late!

just doing the 187 "recommended" updates and the 47 "optional" updates...

It's gone now... the birds are singing again...

 

[Porthos]

just doing the 187 "recommended" updates and the 47 "optional" updates...

Gotta love Windows effing 7.

 

[GTP]

The client gets what the client wants....or it gets the hose again!

 

[nerd2u]

As long as the client doesn't want avg again!

Sent from my SM-G870W using Tapatalk