Well done to Dr. Web!!!

Discussion in 'other anti-virus software' started by ChrisP, Jun 7, 2008.

Thread Status:
Not open for further replies.
  1. ChrisP

    ChrisP Suspended Member

    Joined:
    Jun 6, 2003
    Posts:
    447
    Location:
    UK
    After reading that Dr Web was the only AV to remove a particular nastie, I uninstalled My F-Secure and installed it. Trouble is it hung my system. After starting in safe mode, I tried to uninstall it from the control panel, only to fing the uninstall feature did not work - it only gave options to repair or install!

    I was forced to just delete the programme directory, re start in normal mode, install it again then uninstall it in non safe mode - which did give the uninstall option.

    Having uninstalled it, removed the remaining directory and run a reg cleaner, I tried to install Kaspersky. It wont install because it tells me Dr. Web is installed!
    Well done Dr, Web. Your grafiti on my registry and youd terrible uninstall facility has screwed my PC.

    Dont touch it with a barge pole.
     
  2. Big Apple

    Big Apple Frequent Poster

    Joined:
    Aug 22, 2006
    Posts:
    724
    Sorry to read about your problem, but believe me..........it's not Dr. Web causing all this. Dr. Web is one of the easiest to install and uninstall. One of the problems is using a registry cleaner, most of them remove more than they should and using a good registry cleaner takes a lot of knkowledge.
    I've installed Kaspersky many times after removing Dr. Web and never had any problem.
     
  3. Baz_kasp

    Baz_kasp Registered Member

    Joined:
    May 1, 2008
    Posts:
    593
    Location:
    London
    Hi,


    You will probably need to look for the following registry entries and remove them for KAV install to complete (some may not be present):

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Dr.Web for Windows 95-XP

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DRWEB

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BBE2F69C-4338-11D7-8F0C-00A0244F4E2D}

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06D85BCC-221B-4C02-92D6-F6C10378F7A3}

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00A54723-D95A-495A-8684-9BD2601605D5}


    If drweb has a removal tool I suggest you run that prior to installing KAV to avoid potential problems. I might add that in my experience drweb uninstalls very nicely, sorry to hear you had trouble with it.
     
  4. BlueZannetti

    BlueZannetti Administrator

    Joined:
    Oct 19, 2003
    Posts:
    6,590
    Actually Dr Web, along with a host of other products, is fine. That host of other fine products will also exhibit this behavior on occasion, typically due to a local anomaly. I am not aware of any AV or security product out there that has no reported install/uninstall/operating issues.

    Blue
     
  5. Big Apple

    Big Apple Frequent Poster

    Joined:
    Aug 22, 2006
    Posts:
    724
    Tricky list of reg info. Ok to remove the ones with 'dr.web', but you have to know for sure about the other lines and you don't sound 100% positive, so....I find this a bad option and as mentioned before......it shouldn't be needed to dig that far.
     
  6. Baz_kasp

    Baz_kasp Registered Member

    Joined:
    May 1, 2008
    Posts:
    593
    Location:
    London
    Kaspersky will not allow you to install if those entries are present.... if you don't want to go down that route then system restore to before install of drweb and you should be good to go....or just make a registry backup before deleting them if still anxious.
     
  7. Big Apple

    Big Apple Frequent Poster

    Joined:
    Aug 22, 2006
    Posts:
    724
    I don't doubt, that these entries need to be removed, but if someone has to do this without the proper knowledge, I wouldn't recommend this, without backing up your registry or using a restore point!
     
  8. C.S.J

    C.S.J Massive Poster

    Joined:
    Oct 16, 2006
    Posts:
    5,029
    Location:
    this forum is biased!
    Hey there!

    i highly doubt drweb to have messed up on this, its one of the fastest and easiest to remove.

    so, check your own setup and your own actions, before pointing the finger :rolleyes:

    however, i shall try to help you. ;)

    apply the following in order, moving on to next step if not present:


    remove spidernt from your Drweb (Program Files folder - if still present)
    remove spiderml from your Drweb (Program Files folder - if still present)open RegSVR32.exe and type "/U drwsxtn.dll" (without the quotes)
    reboot your machine
    delete the entire Drweb folder in Program Files (if still present)
    open regedit within your 'windows' folder
    Search for "drweb" (without quotes) and delete the entries.
    Search for "idavlab" (without quotes) and delete the entries.
    Search for "drweb32w.exe" (without quotes) and delete the entries.
    reboot

    hope it works for you, i believe it should do if you are having uninstallation problems, its a suggestion orginally posted by Borka.

    best of luck to you.


    --
    chris
     
  9. PiCo

    PiCo Registered Member

    Joined:
    Apr 9, 2008
    Posts:
    352
    Location:
    Athens, Greece
    I faced the exact same issue on my previous OS which I had crippled with 3-4 different registry cleaners.
    I also had 4 different AVs installed throughout the year!

    When I did a format and freshly installed the OS, Dr.Web installed in about 2 minutes including the quick scan.

    The only thing I am using now is CCleaner and despite the fact it is considered safe, I always check on the registry items it tries to delete.
     
  10. SystemJunkie

    SystemJunkie Resident Conspiracy Theorist

    Joined:
    Mar 3, 2006
    Posts:
    1,500
    Location:
    Germany
    hahaha, no wonder... I only say - . :D :D :D
    BTW it is a bad argument to uninstall f-secure only because of ntldrbot.
    There are mio. other unknown rootkits (probably many ntldrbot variants too) that drweb likely won´t detect.

    Don´t believe the hype and learn to understand the mechanism of security industry.
    Choose your favorite scanner that suits best to you,
    if you get personally targeted by secret agencies or internet mafia no AV scanner will have a chance,
    (they simply dive raw in your system, preferably port 0 or port 80 covert channel e.g. google :D:D)
     
    Last edited: Jun 7, 2008
  11. ChrisP

    ChrisP Suspended Member

    Joined:
    Jun 6, 2003
    Posts:
    447
    Location:
    UK
    I have been forced to reinstall the whole OS again. Nothing would allow KAV to be installed again.

    The app that Dr. Web hung on was Giganews Accelerator. never had any issues with it before.

    I have KAV 8 up and running now.

    Lucky for me I use Acronis, else I would have had to spend a day installing everything.
     
  12. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    Last time i checked, KAV was checking this registry section for other programs:

    32bit Windows
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

    64bit Windows
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall

    Just erase the entry of the problematic program (the one you couldn't uninstall properly). I know i cheated KAV6 this way so i could use KAV and some other AV at the same time.
     
  13. lodore

    lodore Registered Member

    Joined:
    Jun 22, 2006
    Posts:
    9,006
    anyway if you wanted to just see if you had the rootkit on your machine why not run drweb cure it from my sig?
    it doesnt need to be installed.

    erm btw why didnt you use the repair option reboot it it asked you to and then after that see if it had an uninstall option? if not use
    btw this is where imaging software is useful so you can test software then restore image to go back to standard config.
     
    Last edited: Jun 8, 2008
  14. cdr

    cdr Registered Member

    Joined:
    Jan 26, 2006
    Posts:
    143
    Location:
    Chapel Hill, NC USA
    ;) I have to agree with Big Apple above: I have, in testing other AVs, uninstalled and re-installed Dr. Web at least a dozen times, and it always was the simplest of procedures--very clearly indicated "uninstall" option and completely removed itself in less than one minute. It is always disconcerting to see when someone has difficulty with it! Hopefully, the OP's issue with it is now resolved.:D
     
  15. Banshee

    Banshee Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    543
    >
    I am not sure I would have uninstalled F-Secure to install something like drweb.


    Good you managed to get rid of it anyway.:thumb:
     
    Last edited by a moderator: Jun 8, 2008
  16. Saraceno

    Saraceno Registered Member

    Joined:
    Mar 24, 2008
    Posts:
    2,404
    I have had troubles installing DrWeb on an XP and Vista system, while I haven't had a problem on my own system.

    It's one of things where there is some conflict and something isn't compatible. It won't stop me installing it again. Really looking forward to the new version.

    But I wouldn't be worrying about one virus/rootkit. Most people have only probably had a couple of viruses out of the one million on offer. But if you're prone to getting a higher number, then by all means, you can be concerned.

    But the process you've gone through, with re-installing and stuffing around, that's probably the process you would have gone through if you had the rootkit. ;)
     
Loading...
Similar Threads
  1. parham
    Replies:
    5
    Views:
    784
Thread Status:
Not open for further replies.