Deleted Registry Lines Reappear/Respawn--How to Permanently Get Rid of Them?

For permanent removal of Norton you need a reformat. You can never get rid of all of
it even with the Norton removal Tool.

http://service1.symantec.com/SUPPORT...05033108162039

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

"Susan" <UCE@null.invalid> wrote in message
news:a7j3n41d041fqpiv6sns5dq5i3dv2be82l@4ax.com...

> Vista 64-bit...
>
> I'm having trouble removing Norton 360 and Norton Ghost from the Vista
> 64-bit Registry. The normal removal left hundreds of Registry
> remnants for both these programs.
>
> I'm using RegScanner which will create a "Delete" name.reg file which
> when run will remove all selected lines in that file from the
> Registry.
>
> However, after repeating the process I've discovered dozens of line
> remnants that were removed have reappeared. I'm wondering if there is
> a trick where I can make their removal permanent?
>
> For instance, if I booted from the Vista book disk and go to the
> command prompt (what once was called DOS but who knows what it is
> now)...could I run this same .reg file and get a permanent effect?
> Should I place this file in the same directory where RegEdit is
> located and run it from that directory? Or does it need to be where
> the Registry files are located? I forget and I've forgotten where
> those two Registry files are located actually too--what and where are
> they please?
>
> Is there another way to prevent these Registry lines from reappearing?
>
> Thank you.

On Sat, 17 Jan 2009 08:20:10 -0500, "Rick Rogers" <rick@mvps.org>
wrote:

>Hi Susan,
>
>Try running the program elevated (right click/run as administrator), it
>likely lacks sufficient permissions to remove entries in key branches.

Thanks for the idea Rick. Although I have periodically tried this
with various programs I specifically gave it a try with RegScanner and
the results didn't change any--a certain number continue to either not
be deleted or regenerate.

Do you think there might be some lines that could be identified and
instead of trying to delete them I could modify them in some fashion
using RegEdit and then delete them?

Also, is it possible that these Registry lines that regenerate come
from some other unidentified and unidentifiable source in the Registry
or even in some System folder?

There has to be a better solution to this then 'reformat'. It might
also be possible that I've got the Registry clean enough as it is to
install Kaspersky Ingternet Security 2009 and not have any
difficulties with it?

Currently I'm still using Webroot Security successfully. I have a
number of issues with them but I may continue to use the still
functional for my purposes suite until something is resolved.

Thanks.

"Susan" <UCE@null.invalid> wrote in message news:aho4n49ha8o69cmvtaaqm76c93kvf7110a@4ax.com...

> On Sat, 17 Jan 2009 08:20:10 -0500, "Rick Rogers" <rick@mvps.org>
> wrote:
>

>>Hi Susan,
>>
>>Try running the program elevated (right click/run as administrator), it
>>likely lacks sufficient permissions to remove entries in key branches.

>
> Thanks for the idea Rick. Although I have periodically tried this
> with various programs I specifically gave it a try with RegScanner and
> the results didn't change any--a certain number continue to either not
> be deleted or regenerate.
>
> Do you think there might be some lines that could be identified and
> instead of trying to delete them I could modify them in some fashion
> using RegEdit and then delete them?
>
> Also, is it possible that these Registry lines that regenerate come
> from some other unidentified and unidentifiable source in the Registry
> or even in some System folder?
>
> There has to be a better solution to this then 'reformat'. It might
> also be possible that I've got the Registry clean enough as it is to
> install Kaspersky Ingternet Security 2009 and not have any
> difficulties with it?
>
> Currently I'm still using Webroot Security successfully. I have a
> number of issues with them but I may continue to use the still
> functional for my purposes suite until something is resolved.
>
> Thanks.

If these registry entries are being re-written then there must be a program or process writing them.
It may be useful to examine everything that is loaded when Vista boots.
Autoruns from Sysinternals will show you what is being loaded.
Download it from here:
http://technet.microsoft.com/en-us/s.../bb963902.aspx

It doesn't need installing, just unzip and run the autoruns.exe file from the folder.
Right-click and run as admin.
Agree to the license and it will scan your computer listing everything, including loads of Microsoft entries.
Click on Options and select ' Hide Microsoft Entries '.
Click on the green arrows icon to refresh the list.
Now look down the list and see if you can recognise any Norton/Symantec entries.
Clear the box to disable or right-click to delete any entries.

Good luck.

On Sat, 17 Jan 2009 23:43:10 -0000, "Dave-UK" <here@home.com> wrote:

>If these registry entries are being re-written then there must be a program or process writing them.
>It may be useful to examine everything that is loaded when Vista boots.
>Autoruns from Sysinternals will show you what is being loaded.
>Download it from here:
>http://technet.microsoft.com/en-us/s.../bb963902.aspx
>
>It doesn't need installing, just unzip and run the autoruns.exe file from the folder.
>Right-click and run as admin.
>Agree to the license and it will scan your computer listing everything, including loads of Microsoft entries.
>Click on Options and select ' Hide Microsoft Entries '.
>Click on the green arrows icon to refresh the list.
>Now look down the list and see if you can recognise any Norton/Symantec entries.
>Clear the box to disable or right-click to delete any entries.
>
>Good luck.

Autoruns worked great Dave-UK. But 'Everything' found only one
reference to 'Norton' concerning Sidebar gadgets. I think I should
turn my attention to Registry remnants that maybe are not really being
re-written but just locked. You said in someone else's post I was in
recently:

"Registry Keys are listed in the left pane of Regedit, and Names and
their values are listed in the right pane. So 'Windows Live Mail' is
a Key but 'SpoolerDlgPos' is a Name, ( with a certain value.) I don't
think you can set permissions on Names, only on Keys. And changing
the permissions of the ' Widows Live Mail ' key will probably screw
something up."

I'm going to look next at some of these keys using the 'Norton 360'
search which only has 18 that do not go away. If a key contains names
and/or values associated with more then 'Norton 360' like other
program names I'm thinking I might not want to delete it and that that
is/was a good reason to have 'locked' it? I recall now I think seeing
such a situation in my searching. Could the offending 'Norton 360' be
removed from the Names side (right side) leaving the Key otherwise
intact? And if I did modify a Key this way I think I think afterwards
I should 'Lock' it again?

Just in case you too are wondering... I've been doing an incremental
backup and creating restore points prior to deleting Keys. And in
case it was lost somewhere I am using RegScanner to find these
instances and attempting to delete them using the Create Delete .Reg
File option under File. I'll start off with the files that look
straight forward and report back for everyone's interest.

On Sat, 17 Jan 2009 23:13:50 -0800, Susan <UCE@null.invalid> wrote:

>I'm going to look next at some of these keys using the 'Norton 360'
>search which only has 18 that do not go away. If a key contains names
>and/or values associated with more then 'Norton 360' like other
>program names I'm thinking I might not want to delete it and that that
>is/was a good reason to have 'locked' it? I recall now I think seeing
>such a situation in my searching. Could the offending 'Norton 360' be
>removed from the Names side (right side) leaving the Key otherwise
>intact? And if I did modify a Key this way I think I think afterwards
>I should 'Lock' it again?

But wait... What Permission should I use? There are categories:
Creator/Owner, System, Administrator, and User. I don't think I am
the creator/owner but that category has Full Control checked but
grayed-out. I'm not the System. I am the Admin but Full Control is
already checked and grayed. I don't think checking Full Control under
User makes sense if I'm the admin. Can someone give me a lesson on
this please?

If I am the admin giving myself permission when I run Regedit and I
right click on a Key that shows the admin has full control with a
grayed-out check mark in the box does that mean that that Key is
'Unlocked' and its contents modified? I hope so. But I thought I was
doing this all along when I attempted to delete some right pane
contents of a Key since I ran RegScanner with admin permission.

After leaving RegScanner I would next run the 'delete.reg' files
though. I didn't/couldn't run these files as admin though. Maybe I
have to do them manually in Regedit! Something to try tomorrow!

On Sat, 17 Jan 2009 23:13:50 -0800, Susan <UCE@null.invalid> wrote:

>Autoruns worked great Dave-UK. But 'Everything' found only one
>reference to 'Norton' concerning Sidebar gadgets.

Forgot one other thing I noticed in the Autoruns findings. Several of
the categories had many "File Not Found: System 32..." findings. Can
all of these be removed or do I need learn which ones can and which
ones can't or none of them can? Are these files that are missing from
the System 32 directory that should be present? If they aren't needed
should I do something else more proper to make them disappear? I'm
not aware of any system or program problems at the moment.

Thanks.

"Susan" <UCE@null.invalid> wrote in message news:tvo5n4ht9alpsin01r4pukf0dplpqakmp3@4ax.com...

> On Sat, 17 Jan 2009 23:13:50 -0800, Susan <UCE@null.invalid> wrote:
>

>>Autoruns worked great Dave-UK. But 'Everything' found only one
>>reference to 'Norton' concerning Sidebar gadgets.

>
> Forgot one other thing I noticed in the Autoruns findings. Several of
> the categories had many "File Not Found: System 32..." findings. Can
> all of these be removed or do I need learn which ones can and which
> ones can't or none of them can? Are these files that are missing from
> the System 32 directory that should be present? If they aren't needed
> should I do something else more proper to make them disappear? I'm
> not aware of any system or program problems at the moment.
>
> Thanks.

The 'File not found ' entries can be deleted as they reference a file no longer present.
If you have no system or program problems then leave the other 'locked' registry entries alone.
Don't change any permissions.

On Sat, 17 Jan 2009 08:59:59 -0500, "Peter Foldes"
<okf122@hotmail.com> wrote:

>For permanent removal of Norton you need a reformat. You can never get rid of all of
>it even with the Norton removal Tool.
>
>http://service1.symantec.com/SUPPORT...05033108162039

Hi Peter,

Technically you will likely win this argument if I actually want to
remove every trace of Symantec products once installed without
reformatting the hdd. However I will stop short of doing that and
leave remnants. There are two other areas of Registry editing I need
to learn more about which I will post about later today.