SpywareGuard Un-Install Help Please

[Alan Smedley]

I am running Windows XP PRO. I am having a problem with un-installing SpywareGuard 2.2. The reason I need to un-install is not a problem with SpywareGuard but with my Eudora E-Mail program and the only way I have found to stop its error is to go back to a Restore Point a week or so ago before I had SpywareGuard installed. The problem is that SpywareGuard still starts up after I restore even though I have un-installed it with Add Remove Programs from Control Panel.

Any advice would be appreciated. Thanks

[LowWaterMark]

We've seen that if SpywareGuard is running when uninstalling, and also under some other conditions, it may not be fully removed. Take a look at this thread to see how to disable SG from both inside and outside the SpywareGuard interface:

http://www.wilderssecurity.com/showthread.php?t=21527

There is a link to a registry file there (which you can download) that will remove the auto-startup hook used by SpywareGuard. Basically, you execute the REG file then reboot your system. SpywareGuard should then be disabled. At this point, you ought to be able to remove any remaining files from its directory. I'm assuming you no longer have an Add/Remove program option for it since you said you already executed that, so deleting the remaining files after disabling and rebooting ought to get you cleaned up.

[Alan Smedley]

I have followed the suggestions to disable and remove SpywareGuard without sucess. The registry file you gave still left the a heck of a lot of entries for SpywareGuard in the Registry at that key. I am not actually sure that the way you have the registry key written is correct. I have always used the full registry key I want to remove and added a minus after the first left square bracket before the HKEY_ ([-HKEY_) I have yet to try modifying your registry key to see if it will work that way. But without the full details on the key I am trying to remove I cannot really test it.

Also the two running processes were not present in Task Manager but I was still unable to delete the contents of the SpywareGuard directory.

Your message did give me clue though. So I ended up going into Safe Mode and saerching all the registry for any instance of sypwarguard using "Resplendent Registrar" After running through it a couple of time to check that I had removed all instances relating to SpywareGuard I also deleted the contents of the SpywareGuard directory. While in safe Mode I also removed/uninstalled Spybot

After a restart of the computer SpywareGuard did not restart so I have it removed now.

More interestingly the problem I was chasing with Eudora (my E-Mail Client) also went away. So can anyone tell me why SpywareGuard was stopping Eudora working correctly.

The problem I was having is that on starting Eudora I was getting a message that a file in the TEMP directory called "descmap.tmp" could not be coppied to one of the directories at the location across the network where my E-Mail all of my E-Mail iis stored.

To test if it was a networking error I had reset Eudora to use use a local directory but this gave the same error.

I was reverting all the time to a Restore point to test this as once it locked me out of Eudora nothing I did would let me use it.

As I feel I have been using the current version of Spybot with sucess for some time I am going to reinstall it and test before I reinstall SpywareGuard.

Please advide if there is a way I can have SpywareGuard allow this activity by Eudora or if you think the problem I am having is actually with Spybot and the TeaTimer and not SpywareGuard.

Alan Smedley

[Alan Smedley]

Further testing shows that something is still stopping me from actually deleting the entry for SpywareGuard from the startup on this same PC.

This after a restart. Also the problem with Eudora is still happening.

I am also unable to execute Ad-Aware and it was going OK previously. All I can see on the screen with Ad-Aware is that the reference file is out of date when infact it is the newest version and the program will not start the Ad-Aware window properly.

As far as I am aware there is no other program loaded that is protecting the startup of the computer. TeaTime is off as Spywarebot is uninstalled. I normally have teatimer disabled anyway.

Any advice please help.

[LowWaterMark]

Originally Posted by Alan Smedley

I have followed the suggestions to disable and remove SpywareGuard without sucess. The registry file you gave still left the a heck of a lot of entries for SpywareGuard in the Registry at that key. I am not actually sure that the way you have the registry key written is correct. I have always used the full registry key I want to remove and added a minus after the first left square bracket before the HKEY_ ([-HKEY_) I have yet to try modifying your registry key to see if it will work that way. But without the full details on the key I am trying to remove I cannot really test it.

That registry file was not meant to be a SpywareGuard uninstaller, or a registry cleaner meant to remove all of SpywareGuard's registry entries. It has a single purpose, that being to disable the hook into Explorer for the DLL which otherwise would be locked while Explorer is running. That has always been the file that remains following a difficult removal of SpywareGuard, because it is not SG itself that keeps that file locked it's Explorer. I thought that was the problem you were having, but then...

Originally Posted by Alan Smedley

I was reverting all the time to a Restore point to test this as once it locked me out of Eudora nothing I did would let me use it.

One thing that confuses me is just what parts of SG were still present, and whether your uninstall was done prior to then running System Restore, which of course would put SpywareGuard back on your system if the restore point you reverted to was back to a point when SG was still installed. If that's the case, then yes SG would keep coming back even though it was uninstalled. System Restore could restore it.

But, in any case, that part is now unimportant because it sounds like you have indeed uninstalled it successfully. So, now it's a matter of the original Eudora issue... We'll have to see if Javacool has any ideas on this as we've never had reports on that type of lock-up or incompatibility.

[LowWaterMark]

Originally Posted by Alan Smedley

Further testing shows that something is still stopping me from actually deleting the entry for SpywareGuard from the startup on this same PC.

Okay, exactly what entry are you talking about. What specific file(s) or link(s) remains, and is this only showing up after using system restore to roll the system back?

[Alan Smedley]

The entry that remains is the one in Current User Menu for the ShortCut in C:\Documents and Settings\Alan\Start Menu\Programs\Startup\ to SpywareGuard.lnk which starts D:\Programs\SpywareGuard\sgmain.exe

The restore point I am going back to was before I had installed SpywareGuard

I have had a look and I am unable to physically delete this file or any of the other shortcuts to SpywareGuard in the C:\Documents and Settings tree.

I am starting to wonder if it could be some new fangled virus!!!!!!!! Very frustrating as I cannot see any of my E-Mails with Eudora not running.

[LowWaterMark]

Originally Posted by Alan Smedley

The entry that remains is the one in Current User Menu for the ShortCut in C:\Documents and Settings\Alan\Start Menu\Programs\Startup\ to SpywareGuard.lnk which starts D:\Programs\SpywareGuard\sgmain.exe

Oh man, I've never heard of something as straight forward as a startup folder link being un-deletable.

I mean the only times you can't delete a file (usually) is when it is open (ie. in-use), or when you don't have privilege, such as if you are running from a non-admin account, and the file in question is protected. This is very possible with XP Pro. (Have you tried logging into another admin level user account and trying from there?)

Oh, also did sgmain.exe come back again, too, or is it just that the startup folder link points there, but that program file is actually gone.

[Alan Smedley]

I have at last tracked down the problem. I had to work through the Task Manager, killing off processes one at a time, reinstigating the ones that were not a problem. So a slow process. I don't know why by but the renaming of Eudora Eudora files was being stopped by something in the AntiVirus program AntiVir.

Once I turned its running processes off the problems went away. So I have uninstalled it and removed all of its files from the System.

I have yet to reload SpywareGuard to see its usefulness to me.

Thanks for your help.

[LowWaterMark]

Thanks for following up and letting us know what was behind this. It might be of use to someone else one day.

Full instructions for uninstalling Javacool Software's SpywareGuard:

In order to successfully uninstall SpywareGuard, it needs to be
shutdown first. See this topic for an explanation of how to fully
disable and exit SpywareGuard prior to uninstalling it:

http://www.wilderssecurity.com/showthread.php?t=21071

If you have access to the red 'SG' icon in the system tray next to
the clock, then you should be able to follow the steps above. If not,
then you will have to disable SpywareGuard using the registry file
that is provided here:

http://www.wilderssecurity.com/showpost.php?p=220396

It explains about a REG file that you can download from the forum
which when run disables SpywareGuard following the next reboot. If
you run that file and reboot you PC, you can then kill the two
processes related to SpywareGuard (sgmain & sgbhp) using the task
manager (ctrl alt del) and then you can uninstall SpywareGuard.

Like most programs, SpywareGuard has an uninstall link in the Control
Panel's 'Add/Remove Programs...' listing. You run that once you've
been able to disable SpywareGuard and it should uninstall it.

However, sometimes the link is missing from Add/Remove Programs, so
you have to go to the SpywareGuard folder and run the uninstaller
manually (you can do this using either Windows Explorer, or the Start
menu's > Run... option). You browse to the SG folder, which is
usually here:

C:\Program Files\SpywareGuard

In that location you should have this file: unins000.exe

Just double-click that and it should uninstall. (Please note there
should be a similar file in there, unins000.dat, that is not the
program, so don't double-click that. It is a data file that tells
the uninstaller how to do its job. If that is missing then the
uninstall becomes more difficult.)

Please note that this is regarding Javacool's SpywareGuard, which is an anti-spyware tool available from the Javacool Software website:

http://www.javacoolsoftware.com/spywareguard.html

There have been several rogue products that have used names similar to this product, but, none of those are related to Javacool's product.