Stubborn Software Removal

Hello- I tried this BullGuard AV and didn't like it. Went back to avast!.
I used Revo to get rid of it and clean up the Registry.
The problem I have is that there are 2 BullGuard entry's still listed in 'services.msc' and I can't get rid of them. The only thing I found in the Registry was a BullGuard spam filter, and I manually deleted the key.
The BullGuard updater is also raising hell with Event Viewer, also.
Could someone please help me out here?
Thanks!
tim

 

Try the Bullguard uninstall tool available at http://www.bullguard.com/support/product-guides/bullguard-internet-security-guides/uninstall.aspx

Near the bottom of the page you'll see

HTH

 

Thanks, tried that and still have these services showin'. I'll attach a screen shot for ya to see.

 

By the way, cmd> sf delete 'service' doesn't work either. Says there is nothing there. Here is one of the executable paths, but I can't find it in System32:

C:\WINDOWS\System32\SvcHost.exe -k BullGuard_Backup :confused

 

The services are showing as being disabled. To verify this and completely remove them, download Autoruns and unzip the files to somewhere convenient (preferably make a directory for it as autoruns comes in handy).
Double click autoruns.exe and allow it to completely run. When it's finished, you should be able to find the services and any other leftovers under the services tab and the drivers tab.
(If you do the following, make a system restore point first)
To disable them, you can uncheck them or to completely remove them you can right click and delete them.
If you're not 100% confident in doing the above, then once Autoruns has completed, go to the menu and select 'File' > 'Save' and save the Autoruns.arn log file to your desktop. Zip the log and attach to your next post.

 

Another way from the command prompt is to use the sc command, which does not require a download to "fix". But, autoruns is a lot easier.
example:

sc delete "name of service"

 

As I mentioned previously, that doesn't work.

 

Nothing shows up regarding the BullGuard in Autoruns 'services' or 'drivers' tabs.

I did a search in the Registry and found some instances of BullGuard, but I am not allowed to delete the Keys:

HKLM> System> ControlSet005> Enum> Root> LEGACY_BSBACKUP> 0000 folder.

The DeviceDesc Data Value is called BullGuard backup service and rt. click>
Delete won't allow me to get rid of it. This is just one example. The other
instances of BullGuard are 'main service' and 'spam filter'. Same thing- can't
Delete.
Take a look at attached screenshot of Registry, please.

Thanks for the help!

 

For the HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_* keys, just right click on the key and select 'Permissions...'
Select the 'Everyone' group and put a check mark in 'Full Control' > Allow, press Apply > OK.
You should now be able to right click and delete the key.

If there are any other issues, then attach an Autoruns log as described in post #5.

 

Happy New Year my friend , you can to use this tool too :wave

http://www.majorgeeks.com/Unlocker_d4660.html

 

Thanks for all the help. I'll try these suggestions and if there is an issue, I'll report back.
:wave

 

OK, '_nullptr', that seemed to work. The only issue now is that there is this service called 'bsbackup' showing in services.msc. I have a feeling it is associated with the BullGuard, but I am not sure. In the Registry, the sub folder underneath it is labelled 'security', with no mention of BullGuard. Is it safe to delete this as well?... please see attachment.
Thanks!

 

It's BullGuard entry , you have to look at

http://regrunreanimator.com/research/antivirus/bullguard/bsbackup-dll.htm

 

OK, 'falconattack', thanks. I deleted 'BsBackup' key from Registry. That BullGuard outfit has a strange program. That http://regrunreanimator.com is a good site to be aware of. I'm going to save that.
Thanks and Happy New Year!
tim