$%&!! AVG Uninstall Survey!

[mraikes]

EDIT: TL : DR SOLVED! Thanks to Nline. Process monitor revealed Norton 360 as the root cause. Uninstalled Norton and problem went away.


I've been beating my head against this for a ridiculous amount of time now, and need a fresh perspective.

I have a customer's Toshiba laptop, Win 7 Home premium, where shortly after logging into any user's account, IE automatically opens and displays an "AVG Free Uninstall Survey" from AVG.com. Currently Norton is installed. so I don't know when it last had AVG on it.

It doesn't pop up immediately, but usually 5-7 minutes after logging in. My Google-foo indicates it's a known problem, but the few solutions that seem to work for others either don't apply or don't work in this case.

If I log into safe mode, it doesn't pop up.

If I disable all services and start items and boot into normal mode it pops up.
If I boot into normal mode under "diagnostic startup", it pops up.
It doesn't matter what user (there are three), it pops up.
I created a brand new user, it pops up.

I've run AVG's own removal tool.
I've reset IE's settings.
I've looked for the "avguninstallurl" entry referred to in some AVG forum threads. But it doesn't exist.
I've changed the default browser from IE to Chrome.
I've scoured the registry and deleted every avg entry.
I've searched the C: drive and deleted every folder & file related to avg.
I've looked at autoruns and scheduled tasks until my eyes ached.
I've looked through services for delayed start items that might be related - nothing jumps out.
I've reinstalled & uninstalled AVG hoping it might clean up after itself.
I've reinstalled AVG and tried to remove it with REVO hoping it would catch the fragments, but it doesn't show up in Revo as an installed program.

Something somewhere is triggering this thing. But what?

 

[Romaniac]

I'm guessing their removal tool didn't do much?

Have you tried resetting IE to default settings? (worth a short)
What about reverting to an older version of IE and then going back?

Do they have any other browsers installed? If not, what if you do and set that new one as 'default'. I wonder what would happen.


I know you said you searched the registry, but can you do a "Find..." and look for the web address for the page that pops up?

 

[mr m]

Try their removal tool.

http://www.avg.com/us-en/utilities

 

[mraikes]

I'm guessing their removal tool didn't do much?

Have you tried resetting IE to default settings? (worth a short)
What about reverting to an older version of IE and then going back?

Do they have any other browsers installed? If not, what if you do and set that new one as 'default'. I wonder what would happen.


I know you said you searched the registry, but can you do a "Find..." and look for the web address for the page that pops up?

Try their removal tool.

http://www.avg.com/us-en/utilities

Sorry, forgot to include running AVG's removal tool and resetting IE in my list of stuff. No change.

Searched the registry for the exact URL - nothing found.

I've changed the default browser to Chrome - no change - Just pops up in Chrome instead of IE.

 

[mr m]

Check out these two links.

http://forums.avg.com/us-en/avg-forums?sec=thread&act=show&id=148049
http://forums.avg.com/us-en/avg-forums?sec=thread&act=show&id=197277

 

[mraikes]

Check out these two links.

http://forums.avg.com/us-en/avg-forums?sec=thread&act=show&id=148049
http://forums.avg.com/us-en/avg-forums?sec=thread&act=show&id=197277

Already checked both of those out while Googling.

Regarding the first link, the "avguninstallurl" entry doesn't exist.

And the second link refers to "StartupDelayer" which just by it's name sounds like a likely candidate. But it's not installed. On a whim, I installed it (in case it would reveal something that may have been previously configured), but it comes up clean - no delayed start items (as far as it can tell).

 

[katz]

Did you try running ccleaner's registry cleaner function? I've not googled the issue, maybe that doesn't work either...

 

[nlinecomputers]

Time to drag out Process Explorer and find what ever is invoking that webpage.

 

[mraikes]

Time to drag out Process Explorer and find what ever is invoking that webpage.

Holy crap, I should have asked you about this 21 hours ago. THAT's the fresh perspective I needed. But rather than Process Explorer, I used Process Monitor (which I understand a little better).

So I rebooted, logged in, launched PM and waited. At about 6 minutes it captured the "Process Start" from cmd.exe that initiated the command line launch of IE with the AVG survey URL.

Immediately preceding that process start was a "Process Create" initiated from Norton 360 that is creating the command line launch of the AVG survey!

So I uninstalled Norton. Rebooted, logged in, and so far it's been about 25 minutes and no survey (previous record was around 7 minutes). Of course I'm going to leave it running for a while longer, but it looks like that did the trick.

As much as I'm quick to blame Norton for other things I never even suspected it for a problem like this. I can't imagine why/how it preserved and launched that AVG Survey.

Out with Norton. In with Kaspersky.

I'd rep you again but I have to spread it around first. Someone else reading this please Rep Nline on my behalf.

 

[cypress]

I did it for you. Lol. Great solution.

 

[mr m]

Nice fix and thanks for letting us know.

I never thought Norton could launch that survey.

 

[nlinecomputers]

Holy crap, I should have asked you about this 21 hours ago. THAT's the fresh perspective I needed. But rather than Process Explorer, I used Process Monitor (which I understand a little better).

So I rebooted, logged in, launched PM and waited. At about 6 minutes it captured the "Process Start" from cmd.exe that initiated the command line launch of IE with the AVG survey URL.

Immediately preceding that process start was a "Process Create" initiated from Norton 360 that is creating the command line launch of the AVG survey!

So I uninstalled Norton. Rebooted, logged in, and so far it's been about 25 minutes and no survey (previous record was around 7 minutes). Of course I'm going to leave it running for a while longer, but it looks like that did the trick.

As much as I'm quick to blame Norton for other things I never even suspected it for a problem like this. I can't imagine why/how it preserved and launched that AVG Survey.

Out with Norton. In with Kaspersky.

I'd rep you again but I have to spread it around first. Someone else reading this please Rep Nline on my behalf.

Glad you figured it out but that is a serious WTF? cause there.

 

[Romaniac]

Glad you figured it out but that is a serious WTF? cause there.

This ^^^

 

[mraikes]

Glad you figured it out but that is a serious WTF? cause there.

In thinking about this since yesterday, I'm wondering if Norton 360 has some kind of built in proxy/cache settings that were corrupted and "presenting" a random saved url (in this case the AVG page).

I haven't actually researched Norton 360, so I may not even be close to the cause, but it's the only thing my overactive imagination can come up with so far.

 

[NortonSupport]

Holy crap, I should have asked you about this 21 hours ago. THAT's the fresh perspective I needed. But rather than Process Explorer, I used Process Monitor (which I understand a little better).

So I rebooted, logged in, launched PM and waited. At about 6 minutes it captured the "Process Start" from cmd.exe that initiated the command line launch of IE with the AVG survey URL.

Immediately preceding that process start was a "Process Create" initiated from Norton 360 that is creating the command line launch of the AVG survey!

So I uninstalled Norton. Rebooted, logged in, and so far it's been about 25 minutes and no survey (previous record was around 7 minutes). Of course I'm going to leave it running for a while longer, but it looks like that did the trick.

As much as I'm quick to blame Norton for other things I never even suspected it for a problem like this. I can't imagine why/how it preserved and launched that AVG Survey.

Out with Norton. In with Kaspersky.

I'd rep you again but I have to spread it around first. Someone else reading this please Rep Nline on my behalf.

Hello,

Sorry for the trouble. That is odd!

I do not think there is any chance your Norton product could launch a third-party companies survey.

Let me pass ito the team and see why this has happened.

Thanks!

Vineeth
Norton Support

 

[mraikes]

Hello,

Sorry for the trouble. That is odd!

I do not think there is any chance your Norton product could launch a third-party companies survey.

Let me pass ito the team and see why this has happened.

Thanks!

Vineeth
Norton Support

No need to apologize and I've moved on. Just something to be remembered in the future in case I encounter such a situation again.

The survey itself may have been a red-herring. The bigger picture is that Norton was automatically launching a webpage via the command line after every reboot (maybe just a coincidence that it was the URL of the AVG uninstall survey).

 

[NortonSupport]

No need to apologize and I've moved on. Just something to be remembered in the future in case I encounter such a situation again.

The survey itself may have been a red-herring. The bigger picture is that Norton was automatically launching a webpage via the command line after every reboot (maybe just a coincidence that it was the URL of the AVG uninstall survey).

Thank you!

If you ever plan to use a Norton product in future, please let me know. I am happy to help you!

Vineeth
Norton Support