Cannot uninstall Comodo Internet Security

Bug Reports
1

Hello. I hope you will be able to help me.
I tried uninstalling from Windows software add/remove section without success.
I dowloaded and launched the unsintaller as described in that post : " Official Comodo Uninstaller v3.2.0.82 Released"
I tried it twice but it failed.
Log:
17:58:41 C:\Jenkins\workspace\CisCleanupTool2_vs19\CisCleanupTool2\CisCleanupTool2\RegTools.cpp:46 >> Can’t open key (SOFTWARE\COMODO\CIS\Esm), error 2
17:58:41 C:\Jenkins\workspace\CisCleanupTool2_vs19\CisCleanupTool2\CisCleanupTool2\CleanupOnline\CisCleanupTool2.cpp:76 >> ITSM Administrator password for Removal tool is not set, skip password verification, exiting…

17:59:54 C:\Jenkins\workspace\CisCleanupTool2_vs19\CisCleanupTool2\CisCleanupTool2\RegTools.cpp:46 >> Can’t open key (SOFTWARE\COMODO\CIS\Esm), error 2
17:59:54 C:\Jenkins\workspace\CisCleanupTool2_vs19\CisCleanupTool2\CisCleanupTool2\CleanupOnline\CisCleanupTool2.cpp:76 >> ITSM Administrator password for Removal tool is not set, skip password verification, exiting…

The cmdinstall log:
[8872] Log started: 23/11/05 20:19:28
[8872] Command line: “C:\Users\XXX\AppData\Local\Temp\7ZipSfx.002\cmdinstall.exe” -log -setupname “cispro_installer.exe” -sfx “D:\XXX\Téléchargements” -theme lycia -type alone -mode cispro -partner 18137
Command: ; args(0):
Command: ; args(1): ,
Command: ; args(1): <18137>,
Command: ; args(1): <cispro_installer.exe>,
Command: ; args(1): ,
Command: ; args(1): ,
Command: ; args(1): <D:\XXX\Téléchargements>,
[8872] App version: 12.2.4.8032
[8872] CIS ID: {DE000BEE-4192-42B4-939A-42828A1AB7CC}
[8872] User: XXX
[8872] User is admin: 0
[8872] User is system: 0
[8872] Parent process: 3788 = \Device\HarddiskVolume5\XXX\Téléchargements\cispro_installer.exe
[8872] Memory: Total 8100 mb, Free 4010 mb
[8872] Disks: C (92231 mb) D (163159 mb) E (659844 mb)
[8872] Session 0 (Services), user (), state 4 (active: no)
[8872] Session 0 (Console), user (XXX), state 0 (active: yes)
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:115 >> IsWow64Process said process is running under WOW64
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:124 >> Also test GetNativeSystemInfo: its said Processor Architecture is PROCESSOR_ARCHITECTURE_AMD64
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:141 >> User is Admin: NO
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:142 >> Windows Version test: x64
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:143 >> Windows Version test: SERVER - NO
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:144 >> Windows Version test: XP - NO
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:145 >> Windows Version test: XP or VISTA - NO
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:146 >> Windows Version test: XP or higher - YES
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:147 >> Windows Version test: XP SP2 or higher - YES
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:148 >> Windows Version test: VISTA or higher - YES
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:149 >> Windows Version test: 7 or higher - YES
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:150 >> Windows Version test: 8 or higher - YES
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:151 >> Windows Version test: 8.1 or higher - YES
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\appcheck.cpp:152 >> Windows Version test: 10 or higher - YES
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\applicense.cpp:61 >> Data blob loading result: 1
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\tools\regtools.cpp:464 >> Cannot read binary value from ‘LicenseKey’: 2
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\tools\regtools.cpp:319 >> Cannot read dword value from ‘TKey required’: 2
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\tools\regtools.cpp:464 >> Cannot read binary value from ‘SubscriptionID’: 2
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\tools\regtools.cpp:319 >> Cannot read dword value from ‘KnownCamUser’: 2
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\tools\regtools.cpp:464 >> Cannot read binary value from ‘ABC login’: 2
[8872] 20:19:28 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\applicense.cpp:122 >> License loaded
[8872] 20:19:29 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\tools\tools.cpp:1822 >> File ‘C:\Users\XXX\AppData\Local\Temp\7ZipSfx.002\cmdhtml.dll’ signer is ‘Comodo Security Solutions, Inc.’
[8872] 20:19:29 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\tools\tools.cpp:1822 >> File ‘C:\Users\XXX\AppData\Local\Temp\7ZipSfx.002\themes\ilycia.set’ signer is ‘Comodo Security Solutions, Inc.’
[8872] 20:19:29 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\tools\tools.cpp:1822 >> File ‘C:\Users\XXX\AppData\Local\Temp\7ZipSfx.002\7za.dll’ signer is ‘Comodo Security Solutions, Inc’
[8872] 20:19:29 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\tools\tools.cpp:1822 >> File ‘C:\Users\XXX\AppData\Local\Temp\7ZipSfx.002\cmdinstall.exe’ signer is ‘Comodo Security Solutions, Inc’
[8872] 20:19:29 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\tools\tools.cpp:1822 >> File ‘C:\Users\XXX\AppData\Local\Temp\7ZipSfx.002\cmdres.dll’ signer is ‘Comodo Security Solutions, Inc.’
[8872] 20:19:29 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\applanguage.cpp:156 >> 27 languages loaded
[8872] 20:19:29 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\base\applanguage.cpp:97 >> Applying language 1036
[8872] 20:19:29 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\tools\regtools.cpp:30 >> Cannot create key ‘SOFTWARE\COMODO\CIS\Installer\Instance’: 5
[8872] 20:19:29 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\apps\application.cpp:358 >> Searching property ‘ProductCode’ for msi package ‘C:\Users\XXX\AppData\Local\Temp\7ZipSfx.002\cis\download\installs\xml_binaries\cis\cis_setup_x64.msi’
[8872] 20:19:29 d:\jenkins\workspace\cis_um_gitlab\installer_cmdinstall\apps\cisapplication.cpp:381 >> CIS ID loaded from path (C:\Users\XXX\AppData\Local\Temp\7ZipSfx.002\cis\download\installs\xml_binaries\cis\cis_setup_x64.msi): {6D506E2A-AB2C-4D1E-A226-AB27BC469B62}

I don’t detect other logs in Temp folder.

PS: I also tried to run as adminstrator the uninstaller in Windows Safe Mode, same message in the log.

2

I find that version of the Uninstaller doesn’t work that well. You can download the previous version as linked in this post: https://forums.comodo.com/t/official-comodo-uninstaller-v3-2-0-82-released/314767/83

Beyond this, Comodo does leave some remnants behind. Both 8012 and Beta Leave Startup and Event Viewer entries which can be removed via registry:

Startup and EventViewer entries can be deleted from registry:Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The current CIS Beta leaves behind drivers:
Removing cmdguard.sys and cmdhlp.sys drivers is done by running CMD as Administrator. Entering the below to get the driver list:Dism /online /Get-Drivers /Format:

Table

Make a note of the Comodo Entries oemXX.inf number and then enter the below for each entry to delete them, replacing the XX with the corresponding oem number.

pnputil /delete-driver oemXX.inf /uninstall /force

and then reboot.

3

Hi EricCryptid,

Sorry for the inconvenience.
Could you please tell us what are the files and drivers are left even after using ciscleanuptool version ?
Any screenshot would be helpful.
FYI: We couldn’t see any files left after using this ciscleanuptool version.

Thanks
C.O.M.O.D.O RT

4

Even after running Uninstaller tool you linked, the Start-up Entry, Events Log Folder and two drivers remain.

Startup Entry
Startup Entry1412×527 92.1 KB

Eventlog
Eventlog863×468 99.3 KB

image
image1124×265 54.5 KB

Uninstaller complete
Uninstaller complete826×161 28.2 KB

5

Hi EricCryptid,

Thank you so much for providing the requested information.
We will test this and report to the team.

Thanks
C.O.M.O.D.O RT

1 Like
6

Hi EricCryptid,

Thank you for bringing this to our notice.
We tested and reported it to the team.

Thanks
C.O.M.O.D.O RT

1 Like
7

@EricCryptid , thank you so much. That worked for me.
I guess that stopping cmdguard.sys in Safe Mode before running the unsinstaller was the key.

And indeed, there were leftovers, I removed, in the register.

I had not the beta installed. I didn’t test that part.

Thanks

Dimonnet

1 Like