Completely Remove ProcessGuard Free

After removing ProcessGuard Free, while doing some housecleaning I noticed that the directory for ProcessGuard Free had been left behind on an uninstall. I checked a bit further, and I found some keys that also appear to have been left behind, but I can't seem to remove them, even in safe mode. The keys are HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DCSUSERPROT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DCSUSERPROT and HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_DCSUSERPROT

Liking to leave things neat and tidy after uninstalling something, any idea how to remove these? Is something else that was left behind preventing them from being uninstalled?
--

 

Hi TheJoker,

If you want to remove "LEGACY" keys (which are normally locked), you can run regedit.exe via PowerPrompt (PowerPrompt will allow you to run programs as System) and delete them as you would any normal key.

Nick

 

With your reference to "Legacy" keys, I did a Google search and apparently its even easier than that, all I seem to need to do is right-click on the key, change the permissions, and then delete it. These keys would seem to be from Process Guard Free. Its the only software from Diamond CS I've ever run, these key's are not on my other system (I didn'thave them on there), and all 3 have a subkey of DeviceDesc that has a value of "DiamondCS Usermode Aspect". Time to do a quick registry back first though

Thanks.
TheJoker

 

Yes, that is all that you need to do to get rid of the keys. As Dave said at DSLReports however, it doesn't hurt to leave them there .

Regards,
Jade.

 

Well, I don't know about your box, but mine at this very moment has 250,922 entries, 103 which were invalid and I just removed. Having invalid registry keys in no way enhances system efficiency.

 

Hi TheJoker,

I would not worry about legacy keys unless they cause errors. I did have a persistent "ASPI" event log error on boot that was finally eliminated by deleting some related legacy keys. But, in general, if something isn't broken, I don't try to fix it. BTW, I have similar DCSUserProt legacy keys which have caused no problems.

Nick

 

Yep these are normally easy to get rid of by changing the key's permissions but I would appreciate any help with this one: https://www.wilderssecurity.com/showthread.php?t=64086 as I have reached the end of the line with my limited capabilities.

Thanks. Pilli

 

I have uninstalled Process Guard free some time ago and have been totally unable to delete the registry keys listed below. I have logged on as, a) User with administrator privileges, b) The Administrator and in both cases it won't let me delete them. I have tried the usual trick of changing the Permissions but this also fails.

OS is windows XP Pro SP2 fully updated.

Because the registry keys are in place I'm unable to delete the windows\system32\drivers\procguard.sys.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\procguard
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\procguard
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\procguard

I don't have the other Legacy keys already mentioned.

Any further suggestions would be gratefully received.

 

Anything in ControlSet001-3 can be ignored since it is a backup of CurrentControlSet (and will eventually go if the corresponding entry in CurrentControlSet is removed). To remove legacy driver keys from CurrentControlSet, the following method is safer than using RegEdit directly:

• As an administrator user, right-click on My Computer, select Properties/Hardware and click on the Device Manager button;
• Select View/Show Hidden Devices - this will reveal a new category "Non-Plug and Play Drivers";
• Expand this to see the legacy drivers - any belonging to uninstalled software can be removed by right-clicking and selecting Uninstall.

 

Hi David, You will need to remove them in Safe mode as it looks like your procguard.sys is still active.

To reach safe mode reboot and press F8 several times just before windows starts to load but after the initial boot screen.

HTH Pilli

 

@ Pilli
I will give that a try but I have my doubts as I tried to delete the procguard.sys using two methods of removing at the next boot and it couldn't do that and windows shouldn't have been up. So being in safe mode doesn't seem to be a lessor level than deleting at boot, but we'll see.

@Paranoid
Thanks I will also check this out and see how it goes and try safe mode if no joy.

Thanks all, I will report the results on completion.

 

Update.

The uninstall of the procguard.sys driver was succesful from my user account (admin privileges).

Reboot to complete the above, into safe mode, logged on as the administrator, CurrentControlSet entry was no longer there (probably as a result of the uninstall of the driver), deletion of the procguard keys in ControlSet001 and 003 went without a problem.

Thanks for the help guys.