Remove a service

[DL]

I have used both regedit & regedt32 in an attempt to remove a service
(Symantec) however the keys are recreated on restart. The restart is a std
restart, no msgs given.
I'm perplexed
Thanks, David

 

[Steve Parry [MVP]]

DL fumbled, fiddled and fingered:

I have used both regedit & regedt32 in an attempt to remove a service
(Symantec) however the keys are recreated on restart. The restart is
a std restart, no msgs given.
I'm perplexed
Thanks, David

If you look in the zip in the link below

http://www.vbrad.com/source/dl_srvany.zip

there's a tool called

srvinstw.exe

run that at it allows you to add and remove services.

 

[Mark V]

I have used both regedit & regedt32 in an attempt to remove a
service (Symantec) however the keys are recreated on restart.
The restart is a std restart, no msgs given.
I'm perplexed
Thanks, David

I believe Symantec has documents on its web site for manual removal
and cleanup. Sounds like something is still starting/running.

 

[DL]

The tool removes them, they are however restarted on boot.
I can create a new profile, set it to ask for profile on loggon, disable
services on the new profile. On reboot there is no request for the profile
and services are restarted in origonal profile. The new profile is not
shown.

 

[DL]

Trouble is none of the tools on Symantec site permanently remove NIS,
leastways they remove, however they are all recreated (the reg entries) on
reboot.
There are no Symantec files running in 'processes'
All Symantec Files/Folders have been deleted, including temp
The sys has been AV / trojan scanned and is clean.
Symantec suggest I reformat!

 

[Steve Parry [MVP]]

DL fumbled, fiddled and fingered:

The tool removes them, they are however restarted on boot.
I can create a new profile, set it to ask for profile on loggon,
disable services on the new profile. On reboot there is no request
for the profile and services are restarted in origonal profile. The
new profile is not shown.

Try ....


Right click My Computer

select Manage

<Computer Management opens>

highlight Device Manager

click on View from the menu bar

select Show hidden devices

now scan in Device Manager for any errant Symantec stuff

especially in the Non Plug and Play drivers section which is now
visible.

also

http://www.gwynfryn.co.uk/downloads/msconfig.zip

Unzip the files and place them in your system path

and run msconfig to see if there are any entries showing that would be
applicable.

 

[Mark V]

Trouble is none of the tools on Symantec site permanently remove
NIS, leastways they remove, however they are all recreated (the
reg entries) on reboot.
There are no Symantec files running in 'processes'

Possibly a Driver?

All Symantec Files/Folders have been deleted, including temp

Files in and under %systemroot%? DLLs, SYS?

The sys has been AV / trojan scanned and is clean.
Symantec suggest I reformat!

Typical. I can't help as I've not used Symantec products in years.
Try Steve's Device Manager idea. Also:
open a CMD prompt and
SET DEVMGR_SHOW_NONPRESENT_DEVICES=1
devmgmt.msc
then also use the "Show hidden..." option.
Be careful. Don't change/remove anything not obviously pertinent.
Full registry backup in advance would be wise.

 

[DL]

I forgot about msconfig, I disabled the Symantec services, rebooted. They
still show in hidden devices.
Also shown in services consol as automatic. Msconfig still shows them as
disabled.
If I remove/uninstall from hidden devices, they are reinstalled on start-up.
I don't seem to be able to either permanently delete or disable them
As far as I can tell there are no Symantec dll's in any system folder.

 

[DL]

As far as I can tell there are no symantec dll's / sys files on my system.
There are plenty of references in the registry to the none existant files.
If I delete the keys, manually or using symantec reg uninstall. The keys are
all reinstalled on reboot..
I could perhaps ignore this problem, but I am unable to install AV software
(conflict with symantec keys) whilst the keys /services remain. - nor can I
reinstall symantec -

 

[Mark V]

As far as I can tell there are no symantec dll's / sys files on
my system. There are plenty of references in the registry to the
none existant files. If I delete the keys, manually or using
symantec reg uninstall. The keys are all reinstalled on reboot..
I could perhaps ignore this problem, but I am unable to install
AV software (conflict with symantec keys) whilst the keys
/services remain. - nor can I reinstall symantec -

You are working with the CurrentControlSet, right?

 

[Rick]

MSCONFIG doesn't begin to show you all the possible startup
locations for device drivers and other software (the utility wasn't
designed for Windows 2000). Manually go through this list
instead: http://www.diamondcs.com.au/index.php?page=autostarts
and you should eventually find what's causing these registry entries
to reappear.

 

[Steve Parry [MVP]]

DL fumbled, fiddled and fingered:

I forgot about msconfig, I disabled the Symantec services, rebooted.
They still show in hidden devices.
Also shown in services consol as automatic. Msconfig still shows them
as disabled.
If I remove/uninstall from hidden devices, they are reinstalled on
start-up. I don't seem to be able to either permanently delete or
disable them
As far as I can tell there are no Symantec dll's in any system folder.

I wonder if file protection is kicking in ?

http://www.winguides.com/registry/display.php/790/

Perhaps you could read the info on that page to try disabling the
feature

 

[DL]

Correct

You are working with the CurrentControlSet, right?

 

[Mark V]

Correct

Well, I'm stumped. No Event Log errors and no Devices/Drivers and
nothing in any startup location (did you try Sysinternals
Autoruns?)... Hope someone will be along with some fresh ideas
for you.

 

[DL]

Hkey_Local_Machine\System\CurrentControlSet\Services
is the only one that lists any Symantec keys, where relevant the keys all
point to files (dll/sys) that do not exist on my sys. If these keys are
deleted, they all reappear at reboot.

 

[DL]

Well I fumbled some more, but I'm afraid I could'nt locate the values 8B
and 6C at the offset in the hex editor

 

[DL]

Also tried editing string value (path) in a couple of keys, on reboot string
values are reset to origonal

 

[DL]

Further I have since realised that it is only the Symantec keys that are
reinstated, having manually deleted them, on sys reboot. Other none Symantec
keys that I deleted, stayed deleted on reboot.
Bizarre!

 

[Mark V]

Further I have since realised that it is only the Symantec keys
that are reinstated, having manually deleted them, on sys
reboot. Other none Symantec keys that I deleted, stayed deleted
on reboot. Bizarre!

Get REGMON (Sysinternals) and set it to Log Boot.

 

[DL]

Tried that before, despite setting regmon to log on boot, no logfile is
created, at default location or anywhere else. there is free space, have
remove and reinstalled regmon.