Full Removal of Comodo Firewall Pro 3 with SafeSurf Toolbar (If Regular Uninstall Method Fails)

Updated Version Of This Can Be Found Here

Novice users: see the bottom of this post for information on how to do this in an easy and fast way!

I encountered significant difficulty in removing a previous version of CFP so that I could upgrade to the most recent edition, v3.0.14.276. In reviewing some recent posts about incomplete or aborted installation routines, I thought I would post a set of comprehensive instructions for completely removing CFP.

In particular, these instructions should help upgrading users who receive the message, “COMODO Firewall Pro is already installed. Do you want to un-install it now?" and after checking either the “Yes” or “No” button, nothing happens.

These instructions are specific to Windows XP Pro SP2 x32. However, they may be adapted to your particular Windows installation, including Vista. I make no guarantees that these instructions will work in your specific situation. On my partitioned system, F:\ is used for Program Files. Most users will have C:\ as the default location for Program Files.

Caution: These instructions involve modifying the Windows Registry, either manually or by using a specialized registry management tool. If you are unsure of your ability to do this, there’s an attached batch file that’ll automatically delete everything mentioned below.[/i][/u].

If you have experienced problems removing CFP in the past, uninstalling in Safe Mode may work. However, these instructions are not intended for use in a Safe Mode environment, though they may work. I have not tested them in Safe Mode.

[i][b]Before starting, make sure that you understand how to use Windows Regedit and its search function. A good tutorial for this is located at: http://www.theeldergeek.com/windows_xp_registry.htm[/b][/i]

Alternatively, you may want to install a well-known registry tool that includes a configurable search function and other utilities to remove references to installed software as well as any associated registry keys. I use RegSupreme Pro and jv16 PowerTools. Use whichever registry tool(s) you feel comfortable with. While Windows Regedit offers basic functionality, it may not locate all relevant keys and values, which could preclude a successful upgrade to the latest version of CFP. A good registry management tool is a worthwhile investment.

Optionally, I also recommend having a dedicated uninstaller utility, such as Your Uninstaller! 2006. Again, use whichever third-party uninstallation program you prefer. Otherwise, use the Control Panel’s “Add/Remove Programs” applet.

If anyone has additional steps they feel should be added to this list of instructions, please let me know and I will amend this post accordingly. If there is enough interest by other members, perhaps this could be made “sticky” until some of the kinks have been worked out of future versions of CFP.

  1. Mandatory: create a System Restore point and label it appropriately. Optionally, perform a full backup of your system (you should be doing this, anyway).

  2. Temporarily disable your Internet connection and shut down ALL unnecessary processes using Task Manager (a utility called EndItAll can make this task easier).

  3. Open your third-party uninstallation tool (or Control Panel > Add/Remove Programs) and run it as you would normally uninstall any application.

  4. If given the option, do not reboot when the uninstallation routine completes. Instead, first clean out all temporary files, using the Windows Disk Cleanup utility. Optionally, you may manually inspect other folders in which temporary files are typically found and delete them.

  5. Run your registry cleaner. Be sure to make up a backup of the keys that are removed, just in case.

  6. Reboot.

  7. After rebooting, once again shut down ALL unnecessary processes using Task Manager and EndItAll.

  8. Remove the following folders and files, if they still exist. *Caution: if you are using other Comodo products, some of the folder and files listed below should not be removed. Check the forum for guidance, as I am using only CFP):

    a. *C:\Documents and Settings\All Users\Application Data\comodo
    DO NOT delete the folder above if you are running other Comodo products, such as CMF.
    b. C:\Documents and Settings\All Users\Desktop\COMODO Firewall Pro
    c. C:\Documents and Settings%user name%\Application Data\Comodo
    d. C:\Program Files[Comodo Firewall Pro folder]
    (If you have partitioned your drive, the Comodo program folder be may in another location.)
    e. C:\boot.ini.comodofirewall (this file may not exist).
    WARNING: Do not mistakenly remove the original “boot.ini”.
    f. *C:\WINDOWS\system32\drivers\cmdGuard.sys
    g. *C:\WINDOWS\system32\drivers\cmdhlp.sys
    h. *C:\WINDOWS\system32\drivers\inspect.sys
    i. *C:\WINDOWS\system32\guard32.dll

     * [denotes a folder or files that may be necessary for other Comodo programs running on your system.]
    
  9. Open Device Manager (Start > [right click] My Computer > Properties > System Properties > Hardware [tab] > Device Manager > View > Show Hidden Devices > Non-Plug and Play Drivers > [Remove all Comodo entries]. Entries may include some or all of the following:

    a. Comodo Application Engine
    b. Comodo Firewall Pro Driver Helper
    c. Comodo Network Engine.

    Note: if you have already removed the drivers listed in Step 8 above, some or all of the Comodo entries listed above may or may not be present. If so, clicking “Properties” on Comodo Application Engine may show that “This hardware device is no longer connected to the computer.” The other two will likely report that they are “working properly.” To remove these entries, you may be prompted to reboot; however, do not waste time with multiple reboots trying to remove these entries as it is likely that a set of remnant registry keys is allowing the entries to remain. Proceed to Steps 10 and 11 to resolve this.

  10. Open Regedit or your third-party registry tool and remove the following keys.
    USE CAUTION if you have other Comodo products installed. This is NOT an all-inclusive list; there may be other entries on your system not shown here (this list was modified on 12/21/07):

a.  HKEY_CURRENT_USER\Software\ComodoGroup\CFP
b.  HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup\CDI\1 *
     *(If you have other Comodo products installed, delete only the values
       for CFP)
c.  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services
     \cmdAgent
d.  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services
     \cmdGuard
e.  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cmdHlp
f.   HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Inspect
g.  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services
     \cmdAgent
h.  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services
     \cmdGuard
i.   HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\cmdHlp
j.   HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Inspect
k.  KEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services
     \cmdAgent
l.   HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services
     \cmdGuard

m. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\cmdHlp
n. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Inspect
o. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdAgent
p. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdGuard
q. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdHlp
r. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
\Inspect
s. HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo\Firewall Pro
t. HKEY_USERS\S-1-5-21-1202660629-746137067-2145843811-1003\Software\ComodoGroup\CFP
u. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CMDAGENT *
v. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CMDGUARD *
w. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CMDHLP *
x. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_INSPECT *
y. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_CMDAGENT *
z. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_CMDGUARD *
aa. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_CMDHLP *
bb. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_INSPECT *
cc. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CMDAGENT *
dd. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CMDGUARD *
ee. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CMDHLP *
ff. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_INSPECT *
gg. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDAGENT *
hh. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDGUARD *
ii. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDHLP *
jj. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_INSPECT *
kk. HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\CFP_Setup_3.0.14.276_XP_Vista_x32
ll. HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\CFP_Setup_3.0.14.276_XP_Vista_x64
mm. HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\CFPLog
nn. HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\CPFFileSubmission
oo. HKEY_LOCAL_MACHINE\SYSTEM\Software\Comodo\Firewall Pro

*Note: It may not be possible to remove these "LEGACY" keys.  If you cannot delete them, leave them in the registry.  However, I have subsequently found that you MAY be able to remove these keys in [u]Safe Mode[/u] by using a third-party registry tool.  To permanently remove them may also require modifying the Permissions for each key.  See: https://forums.comodo.com/help_for_v3/comprehensive_instructions_for_completely_removing_comodo_firewall_pro_info-t17220.0.html;msg119226#msg119226

If you are using a third-party registry tool, it may offer a feature that manages references to installed software. Search for these entries that contain “comodo” and remove them, again exercising particular caution if you have other Comodo products installed.

  1. Open Regedit and highlight “My Computer”. Then click Edit > Find and run searches for the terms “comodo”, “cmd*” and “inspect” (without the quotes). For the “cmd*” wild card search string, be careful not to delete any registry entries that reference “cmd” that is associated with command. Ensure the entry is associated only with Comodo. If you are using a third-party registry tool, use its search function according to the instructions. Again, make a backup of any keys that are removed, just in case.

  2. Reboot.

  3. Temporarily disable your Internet connection again, and open Windows Security Center. Check to see that there is no reference to Comodo Firewall Pro. If so, proceed to Step 14. Otherwise. if the Windows Firewall has been re-enabled, disable it. Proceed to Step 15.

  4. If there is still a reference to Comodo Firewall in Windows Security Center, run the “Wbem.exe” tool to reset the Security Center notification list. This tool is available from the Comodo forum (search). If you cannot find this tool for some reason, follow these steps (courtesy of forum member “pandlouk”):

a.  At the command line of Windows XP  [Start > Run] enter the command "CMD" (without the quotes) and press Enter.
b.  At the new Command Prompt window, type 
     "NET STOP WINMGMT /Y" (without the quotes; there [u]must[/u] be a space between WINMGMT and /Y) and press Enter. Then type "exit" end press Enter again.
c.  Go to the folder C:\WINDOWS\system32\wbem and delete the folder "Repository".
d.  Reboot. The Repository folder will be recreated automatically by the Security Center and will now display the correct information.
  1. Shut down ALL unnecessary processes using EndItAll and Task Manager.

  2. Install the latest version of CFP and configure as desired. Reboot if prompted.

  3. Upon reboot, export your new default CFP configuration before making any changes to the firewall settings.

My contention is that no software should be this difficult to remove and/or install.
In the meantime, I hope these instructions will help reduce the time and difficulty in migrating between different versions of CFP. I am confident that, eventually, the Comodo programmers and developers will offer a more streamlined method of upgrading to future versions of this otherwise excellent firewall system.


For novice users or people that want to save time

This batch file should work on Windows XP and Windows Vista (all languages) using the final version of CFP 3 (until the current release, 3.0.25.378) with SafeSurf Toolbar installed.
Vista users will have to run the batch file as an administrator. For Windows XP-users, make sure you’re logged in on an administrator account.
The legacy keys have to be removed manually, since they’re protected by the system by default. Read step 10 in USSS’ guide if you need help doing that.

The zip-file is attached to the post, so just click it and download will begin.
If you for some reason wouldn’t see this link, you can download it thru RapidShare:
http://rapidshare.com/files/126630164/CFP_3_File_Registry_Cleaner.zip.html

Now unzip it using Windows built-in unzipper or a software like WinRAR or 7-zip, and then run it.

THIS IS NOT MEANT AS A STAND-ALONE UNINSTALLER, IT’S MADE TO DELETE LEFT-OVER FILES AND REGISTRY ENTRIES!

Created by Ragwing. PM if you have any questions or feedback. Big thanks to USSS for providing the paths and registry entries!
Last update: 2 July 2008
Total downloads (not counting RapidShare downloads): 771

[attachment deleted by admin]

Hi USSS, this is a very good post and I’l shall make it a sticky, but I believe it needs a few changes, if I may.

I think the guide should assume drive C:\ as the default, so don’t confuse people with different drives.

Be careful with the paths. For instance 8.a

C:\Documents and Settings\All Users\Application Data\comodo

That location has subdirectories that are used by other Comodo Apps, such as CMF.

A lot of people are not going to have access to utilities such as RegSupreme or jv16, so it might be advisable to make it more generic.

Just my thoughts, otherwise excellent.

Sticky

Toggie, I made the changes you suggested. I’m sure there will be a few others down the road. Thank you for your feedback.

For users without access to a third-party registry tool, I decided to go through the registry and identify as many keys associated with CFP as I could. Once again, I urge everyone to make a backup of their registry before using these instructions.

Stephen Gray
Houston, Texas

For Vista the path is different. May be you can make it part of the upcoming sticky. Here it is:
:\Users%username%\AppData\Roaming\Comodo\Firewall Pro .

just download and use your uninstaller 2008 in pro mode …

its trialware …

:■■■■

Even using Your Uninstaller, the LEGACY_ keys remained behind. :frowning:

Even in safe mode, with a third party registry editor (TuneUp Registry Editor) I wasn’t able to delete them either. Well, at first it looked as if I was deleting them: the editor didn’t popup an error message, and the entry was “gone” from the screen when I pressed “delete.” But when I searched again to make sure I didn’t miss any, I saw that all of them were still intact.

Last ditch effort: while logged as Admin, I right-clicked on the folder keys, and changed Permission on each one of them to allow “Full Control” to Everyone. I rebooted just in case. Logged again as Admin, and this time I managed to delete the Legacy_* keys for good.

There were also a few other entries that appeared while searching for “Comodo,” but since they were intimidating (for me) hexadecimal tables, I let them be.

None of this helped me to eliminate the problems I have with CFP, but I’m posting it just in case anyone else has trouble deleting those keys.

E.

Thanks for the tip on permanently removing the LEGACY keys. On a subsequent reinstallation, I also found that I was unable to remove them with Your Uninstaller, despite having been able to previously.

Modifying the permissions on each key appears to be the solution. I’ll modify my original post to reflect this.

USSS or Ragwing:

Could you provide that CFP3 File+Registry cleaner.bat in a download format other than .rar, for those of us without WinRAR?

Thx

I’ll upload a .zip one too.
Instead, I replaced the .rar with a .zip, since both Windows XP built-in and softwares like WinRAR and 7-zip can handle it.

Hi
I uninstalled comodo Version 3 about 4 days ago.

As i no longer have a ‘full stealth’ , by Shields up site and PCFlank.
Also I was not getting no firewall events in logs etc

I have just downloaded the batch file for cleaning reg and old files by USSS or Ragwing:

Will i have to reinstall comodo to use the batch file or will it be okay to use even so comodo was uninstalled earlier.

Cheers

No, you won’t. It’s meant to delete items that remain on your computer after an uninstall.

Cheers,
Ragwing

Thanks Ragwing

Cheers

Thanks Ragwing

i see this as over the top absurd to send an end-user through this ring of fire to uninstall this app. i’ll ask what i did not see anyone else asking in this thread. why does not the comodo uninstaller accomplish this task? it seems to me that coders talented enough to create this app, should be able to implement competent uninstall routines to remove it effectively. is there something i am missing (there oftern is)?

in any case, though i came to this thread to get an idea of things i should be on the lookout for when installing/using comodo, i believe i will not install it until the removal procedure is drastically more efficient. thanks to the OP for providing those predisposed to utilizing it such a comprehensive uninstall routine.

a real developer driven uninstall in the pipes for later builds?

Mike

So… there is a catch after all.

All though free, as a user, especially a layperson, you rely heavenly on this kind of support, when ever some mod feels obliged to help. Or am I wrong even on the day before Christmas?

Clearly, the uninstaller module for CFP needs to be overhauled, perhaps from scratch.

No argument there.

Is it absurd to go through this much trouble? In a way, yes. But keep in mind that CFP is still a “work in progress.”

For a “typical” CFP installation, it will take about 30-45 minutes to complete my instructions, start to finish. If you use Ragwing’s batch file, it should reduce your uninstallation time considerably. The full set of instructions and the batch file are provided so that current users have a choice, particularly if one approach does not completely remove CFP from their systems.

When you have a tight-knit community such as ours pitching in and helping others, you can get a sense of what it must be like to help in the development of ‘open source’ software. And while CFP is certainly not open-source, it IS free and it does the job a lot better than software selling for USD40 or more.

The benefits ARE there if you are willing to contribute, even if in a small way.

I want to add that most software leavs files and registry entries after uninstallation, so CFP isn’t the only one. But yes, it could be fixed really easy.

Cheers,
Ragwing

I did not mean it unfriendly or unpolite but I just needed things to do on my PC and sofar apart from surfing the web I the firewall disallowed all my attempts to make a Coldfusion DSN from my Coldfusion Administrator tool on my PC to connect to a mysql and mssql databases.

So I am alone with Windows Firewall once again. I sure hope the interface becomes more orientated towards the enduser who is not a programmer or hacker.

I would not mind paying for a more intuitative GUI.

Oh, no offense taken. Most of the folks here have a pretty thick skin, LOL.

The frustration with CFP is real, of course, but the Comodo development and programming teams are doing their best, in my opinion, to improve all facets of the product. They’re just not able to do it all at once. And that holds true for any application that delves as deeply into the operating system as CFP does.

Use the tools provided here, and let us know if you eventually are able to successfully reinstall CFP.

This is very good USSS!

You should be a Moderator!!

Josh.