Completely Remove ProcessGuard Free

Discussion in 'ProcessGuard' started by TheJoker, Jan 30, 2005.

Thread Status:
Not open for further replies.
  1. TheJoker

    TheJoker Guest

    After removing ProcessGuard Free, while doing some housecleaning I noticed that the directory for ProcessGuard Free had been left behind on an uninstall. I checked a bit further, and I found some keys that also appear to have been left behind, but I can't seem to remove them, even in safe mode. The keys are HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DCSUSERPROT
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DCSUSERPROT and HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_DCSUSERPROT

    Liking to leave things neat and tidy after uninstalling something, any idea how to remove these? Is something else that was left behind preventing them from being uninstalled?
    --
     
  2. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Hi TheJoker,

    If you want to remove "LEGACY" keys (which are normally locked), you can run regedit.exe via PowerPrompt (PowerPrompt will allow you to run programs as System) and delete them as you would any normal key.

    Nick
     
  3. TheJoker

    TheJoker Guest

    With your reference to "Legacy" keys, I did a Google search and apparently its even easier than that, all I seem to need to do is right-click on the key, change the permissions, and then delete it. These keys would seem to be from Process Guard Free. Its the only software from Diamond CS I've ever run, these key's are not on my other system (I didn'thave them on there), and all 3 have a subkey of DeviceDesc that has a value of "DiamondCS Usermode Aspect". Time to do a quick registry back first though :)

    Thanks.
    TheJoker
     
  4. Bowserman

    Bowserman Infrequent Poster

    Joined:
    Apr 15, 2003
    Posts:
    510
    Location:
    South Australia
    Yes, that is all that you need to do to get rid of the keys. As Dave said at DSLReports however, it doesn't hurt to leave them there :).

    Regards,
    Jade.
     
  5. BourgePD

    BourgePD Registered Member

    Joined:
    Sep 5, 2004
    Posts:
    75
    Well, I don't know about your box, but mine at this very moment has 250,922 entries, 103 which were invalid and I just removed. Having invalid registry keys in no way enhances system efficiency.
     
  6. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Hi TheJoker,

    I would not worry about legacy keys unless they cause errors. I did have a persistent "ASPI" event log error on boot that was finally eliminated by deleting some related legacy keys. But, in general, if something isn't broken, I don't try to fix it. BTW, I have similar DCSUserProt legacy keys which have caused no problems.

    Nick
     
  7. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
  8. DavidR

    DavidR Registered Member

    Joined:
    Sep 28, 2005
    Posts:
    6
    Location:
    United Kingdom
    I have uninstalled Process Guard free some time ago and have been totally unable to delete the registry keys listed below. I have logged on as, a) User with administrator privileges, b) The Administrator and in both cases it won't let me delete them. I have tried the usual trick of changing the Permissions but this also fails.

    OS is windows XP Pro SP2 fully updated.

    Because the registry keys are in place I'm unable to delete the windows\system32\drivers\procguard.sys.

    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\procguard
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\procguard
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\procguard

    I don't have the other Legacy keys already mentioned.

    Any further suggestions would be gratefully received.
     
  9. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    Anything in ControlSet001-3 can be ignored since it is a backup of CurrentControlSet (and will eventually go if the corresponding entry in CurrentControlSet is removed). To remove legacy driver keys from CurrentControlSet, the following method is safer than using RegEdit directly:
    • As an administrator user, right-click on My Computer, select Properties/Hardware and click on the Device Manager button;
    • Select View/Show Hidden Devices - this will reveal a new category "Non-Plug and Play Drivers";
    • Expand this to see the legacy drivers - any belonging to uninstalled software can be removed by right-clicking and selecting Uninstall.
     
  10. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi David, You will need to remove them in Safe mode as it looks like your procguard.sys is still active.

    To reach safe mode reboot and press F8 several times just before windows starts to load but after the initial boot screen.

    HTH Pilli
     
  11. DavidR

    DavidR Registered Member

    Joined:
    Sep 28, 2005
    Posts:
    6
    Location:
    United Kingdom
    @ Pilli
    I will give that a try but I have my doubts as I tried to delete the procguard.sys using two methods of removing at the next boot and it couldn't do that and windows shouldn't have been up. So being in safe mode doesn't seem to be a lessor level than deleting at boot, but we'll see.

    @Paranoid
    Thanks I will also check this out and see how it goes and try safe mode if no joy.

    Thanks all, I will report the results on completion.
     
  12. DavidR

    DavidR Registered Member

    Joined:
    Sep 28, 2005
    Posts:
    6
    Location:
    United Kingdom
    Update.

    The uninstall of the procguard.sys driver was succesful from my user account (admin privileges).

    Reboot to complete the above, into safe mode, logged on as the administrator, CurrentControlSet entry was no longer there (probably as a result of the uninstall of the driver), deletion of the procguard keys in ControlSet001 and 003 went without a problem.

    Thanks for the help guys.
     
Thread Status:
Not open for further replies.