Clean-up tool for Comodo Internet Security

[Guest]

[languy99]

in my opinion instead of having a script just use revo uninstaller set to moderate, that will remove anything that is left over from comodo, be it registry keys or files. I have used it to remove comodo over a dozen times to test it and it has always removed everything and comodo has always reinstalled just fine.

[Alan Borer]

I disagree.

I used RevoUninstaller to launch the Comodo built in removal, and to supplement with a few extra remnants that it found.  After this I used the CFP 3 File+Registry Cleaner.bat

I noticed "inaccessible" amongst all the many errors that flashed across the command window,
and immediately recognised that something that was told to go had chosen to stay.

Only I saw that, nothing else saw it or warned me, instead I was told
"All remains of Comodo Internet Security should now be gone!"

I cancelled various echo off commands and configured a CMD shell with a tremendous display memory and eventually found that after running the script many times it was still getting inaccessible errors when deleting various
"HKEY_LOCAL_MACHINE\SYSTEM\* ControlSet * \Services\Inspect".

I then launched RegEdit and took ownership of those keys, then I ran the script and they gave no more trouble.

The existing script uses REG.EXE to delete keys, and ignores any permissions issues
Regseeker will search for targets and delete and pretend success, ignoring permissions issues.
I do not know if RevoUninstaller failed to detect the ...\Inspect key, or if it too assumes that keys will go when they are told to.

This is why I am slightly tweaking an existing script - every deletion will be tested and if it failed the target will be logged, after which it will be very easy to manually seize authoririty over what was stuck.

Regards
Alan

[Alan Borer]

I would realy appreciate advice upon repairing the registry with the commands

Code:

NET STOP WINMGMT /Y
cd "%windir%\system32\wbem\"
RD /S /Q "Repository"
NET START WINMGMT /Y

The existing scripts do this.  Why ?  What has caused damage that merits repair ?
Is damage caused by the script deleting things ?
Does the initial removal built into Comodo do damage ?

I am very reluctant to perform this.

Three months ago I used the removal script and afterwards the Application event log showed Wimngmt errors for each of 4 off ".NET Framework" *.MOF files.

I rebooted several times with no further errors and hoped that Windows had succeeded in recovering.
I installed the latest C.I.S. and a few days later I noticed that 50 new *.MOF files had appeared in the repository, and dberr.txt error messages were accumulating at 30 minute intervals.  The new *.MOF files were created at the same time as the Winmgmt errors.

I was told I had a corrupt registry and it needed repairing, and I was told how to repair it. But I still have problems.

I am going to restore an image of C:\ before it was damaged, and repeat WITH MUCH GREATER CARE the removal of the old Comodo.  Now that I am enhancing the clean-up script I see it includes the repository repair commands, and think this could be what broke Windows.

I now realise that when I repeatedly ran the script a dozen times trying to identify what was inaccessible, that each time I was rebuilding the repository.
It is far too much of a coincidence that after rebuilding 12 times it is now broken ! ! !

The rebuild does take some time, so some of the dozen script launches were so close together that the rebuild may have been aborted either before it started or in mid-process.

If I do rebuild the repository I will ensure it is only done the once and allowed plenty of time to complete,
but before I do a rebuild I would like to know why I need to, and what benefit I will get, and what risks I run if I refrain

Regards
Alan

[Ronny]

This command is used to clean out left over registrations for the Security Center entries like Firewall and AV.

It could be that CIS is uninstalled but that the registration for Security Center is still active... this command cleans out and rebuilds the repository that keeps that information.

[Alan Borer]

Thank you

May I safely assume I do not need to rebuild the repository unless :-
I receive system event log errors referring to the Security Centre ; or
I fail to achieve a new install of Comodo because it thinks the old one is still installed ?

Regards
Alan

[Ronny]

Thank you

May I safely assume I do not need to rebuild the repository unless :-
I receive system event log errors referring to the Security Centre ; or
I fail to achieve a new install of Comodo because it thinks the old one is still installed ?

Regards
Alan

Hi Alan,

If your current Security Center does not show any "comodo" stuff installed and/or inactive etc then you can skip this part of the process.

[Alan Borer]

Thank you

After starting the Security Centre service I could see the centre reporting A.V. by Comodo and Firewall by Comodo, so hopefully when I un-install the old version of Comodo I will immediately see these reports blanked out.
I have now disabled the Windows Security Centre service so that Comodo may continue to protect me without interference.

I noticed that the Security Centre failed to indicate who provided Defense+ or HIPS.
Microsoft seem to be unaware of such things.
I guess Comodo are playing in the Professional league of security protection,
whilst Microsoft are merely apprentice players in the amateur league ! ! !

Again, many thanks, I feel I am now "good to go"

Regards
Alan

[Tags:]