Assigned Uninstalling Zemana leaves Drivers behind?

This thread is being handled by a member of the staff.
Status
Not open for further replies.
Svoll

Svoll

Level 13
Verified
Top Poster
Well-known
Nov 17, 2016
627
I just tried uninstalling ZAL myself and its took me quite a while to narrow down where most of the left files are. Had to use 3 apps to help me somewhat remove most of them (autoruns, RevoUninstaller, and Everything). There are quite a few traces left in the registry.

In addition to what others can't remove, Everything found folders left in the syswow64 folder.

VRkE9GQ.png


Even deleting the keycrypt64, Event log still shows it tied with Wininit

LY2o9gE.png
 
  • Like
Reactions: oldschool, bjm_, frogboy and 2 others
WinXPert

WinXPert

Level 25
Verified
Honorary Member
Top Poster
Malware Hunter
Well-known
Jan 9, 2013
1,457
Manual deletion
  • Use everything, search for ZAM and Zemana and delete all folder/files found
  • Manually delete ZAM and Zemana on registry entries
 
  • Like
Reactions: Berny, frogboy and Sunshine-boy
TairikuOkami

TairikuOkami

Level 37
Verified
Top Poster
Content Creator
Well-known
May 13, 2017
2,638
Code: 
sc config ZAM start= disabled
sc config ZAM_Guard start= disabled
net stop ZAM /y
net stop ZAM_Guard /y
sc delete ZAM
sc delete ZAM_Guard
reg delete "HKCU\Software\Zemana" /f
reg delete "HKLM\Software\Zemana" /f
reg delete "HKLM\Software\ZmnGlobalSDK" /f
takeown /f "%WINDIR%\System32\drivers\zam64.sys" /a
icacls "%WINDIR%\System32\drivers\zam64.sys" /grant:r Administrators:F /c
del "%WINDIR%\System32\drivers\zam64.sys" /s /f /q
takeown /f "%WINDIR%\System32\drivers\zamguard64.sys" /a
icacls "%WINDIR%\System32\drivers\zamguard64.sys" /grant:r Administrators:F /c
del "%WINDIR%\System32\drivers\zamguard64.sys" /s /f /q
takeown /f "%ProgramFiles(x86)%\Zemana AntiMalware" /a /r /d y
icacls "%ProgramFiles(x86)%\Zemana AntiMalware" /inheritance:r /grant:r Administrators:(OI)(CI)F /t /c
rd "%ProgramFiles(x86)%\Zemana AntiMalware" /s /q
rd "%LocalAppData%\Zemana" /s /q
rd "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Zemana" /s /q
 
Last edited:
  • Like
Reactions: carl123, oldschool, boombastik and 12 others
KevinYu0504

KevinYu0504

Level 5
Verified
Well-known
Mar 10, 2017
228
TairikuOkami said:
Code: 
sc config ZAM start= disabled
sc config ZAM_Guard start= disabled
net stop ZAM /y
net stop ZAM_Guard /y
sc delete ZAM
sc delete ZAM_Guard
reg delete "HKCU\Software\Zemana" /f
reg delete "HKLM\Software\Zemana" /f
reg delete "HKLM\Software\ZmnGlobalSDK" /f
takeown /f "%WINDIR%\System32\drivers\zam64.sys" /a
icacls "%WINDIR%\System32\drivers\zam64.sys" /grant:r Administrators:F /c
del "%WINDIR%\System32\drivers\zam64.sys" /s /f /q
takeown /f "%WINDIR%\System32\drivers\zamguard64.sys" /a
icacls "%WINDIR%\System32\drivers\zamguard64.sys" /grant:r Administrators:F /c
del "%WINDIR%\System32\drivers\zamguard64.sys" /s /f /q
takeown /f "%ProgramFiles(x86)%\Zemana AntiMalware" /a /r /d y
icacls "%ProgramFiles(x86)%\Zemana AntiMalware" /inheritance:r /grant:r Administrators:(OI)(CI)F /t /c
rd "%ProgramFiles(x86)%\Zemana AntiMalware" /s /q
rd "%LocalAppData%\Zemana" /s /q
rd "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Zemana" /s /q
Click to expand...

Thanks for your provide the code ,
it's pretty useful !
 
  • Like
Reactions: oldschool, boombastik and bjm_
JB007

JB007

Level 26
Verified
Top Poster
Well-known
May 19, 2016
1,580
TairikuOkami said:
Code: 
sc config ZAM start= disabled
sc config ZAM_Guard start= disabled
net stop ZAM /y
net stop ZAM_Guard /y
sc delete ZAM
sc delete ZAM_Guard
reg delete "HKCU\Software\Zemana" /f
reg delete "HKLM\Software\Zemana" /f
reg delete "HKLM\Software\ZmnGlobalSDK" /f
takeown /f "%WINDIR%\System32\drivers\zam64.sys" /a
icacls "%WINDIR%\System32\drivers\zam64.sys" /grant:r Administrators:F /c
del "%WINDIR%\System32\drivers\zam64.sys" /s /f /q
takeown /f "%WINDIR%\System32\drivers\zamguard64.sys" /a
icacls "%WINDIR%\System32\drivers\zamguard64.sys" /grant:r Administrators:F /c
del "%WINDIR%\System32\drivers\zamguard64.sys" /s /f /q
takeown /f "%ProgramFiles(x86)%\Zemana AntiMalware" /a /r /d y
icacls "%ProgramFiles(x86)%\Zemana AntiMalware" /inheritance:r /grant:r Administrators:(OI)(CI)F /t /c
rd "%ProgramFiles(x86)%\Zemana AntiMalware" /s /q
rd "%LocalAppData%\Zemana" /s /q
rd "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Zemana" /s /q
Click to expand...
Hello @TairikuOkami ,
I just see on my Home PC that I have the same problem that @Evjl's Rain here Q&A - Zemana dropped files with persistent files ZAM.krnl.trace & ZAM_Guard.krnl.trace in C:\windows folder :(
Is your code always good 1 year later ?
 
  • Like
Reactions: oldschool and upnorth
TairikuOkami

TairikuOkami

Level 37
Verified
Top Poster
Content Creator
Well-known
May 13, 2017
2,638
JB007 said:
Is your code always good 1 year later ?
Click to expand...
Yes, I have just checked it and added those 2 files. They are persistent, when the drivers are running, once removed, files can be safely removed.
Code: 
sc config ZAM start= disabled
sc config ZAM_Guard start= disabled
net stop ZAM /y
net stop ZAM_Guard /y
sc delete ZAM
sc delete ZAM_Guard
reg delete "HKCU\Software\Zemana" /f
reg delete "HKLM\Software\Zemana" /f
reg delete "HKLM\Software\ZmnGlobalSDK" /f
takeown /f "%WINDIR%\System32\drivers\zam64.sys" /a
icacls "%WINDIR%\System32\drivers\zam64.sys" /grant:r Administrators:F /c
del "%WINDIR%\System32\drivers\zam64.sys" /s /f /q
takeown /f "%WINDIR%\System32\drivers\zamguard64.sys" /a
icacls "%WINDIR%\System32\drivers\zamguard64.sys" /grant:r Administrators:F /c
del "%WINDIR%\System32\drivers\zamguard64.sys" /s /f /q
takeown /f "%ProgramFiles(x86)%\Zemana AntiMalware" /a /r /d y
icacls "%ProgramFiles(x86)%\Zemana AntiMalware" /inheritance:r /grant:r Administrators:(OI)(CI)F /t /c
rd "%ProgramFiles(x86)%\Zemana AntiMalware" /s /q
rd "%LocalAppData%\Zemana" /s /q
rd "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Zemana" /s /q
del "%WINDIR%\ZAM.krnl.trace" /s /f /q
del "%WINDIR%\ZAM_Guard.krnl.trace" /s /f /q
 
  • Like
Reactions: mkaz, carl123, oldschool and 5 others
KevinYu0504

KevinYu0504

Level 5
Verified
Well-known
Mar 10, 2017
228
TairikuOkami said:
Yes, I have just checked it and added those 2 files. They are persistent, when the drivers are running, once removed, files can be safely removed.
Code: 
sc config ZAM start= disabled
sc config ZAM_Guard start= disabled
net stop ZAM /y
net stop ZAM_Guard /y
sc delete ZAM
sc delete ZAM_Guard
reg delete "HKCU\Software\Zemana" /f
reg delete "HKLM\Software\Zemana" /f
reg delete "HKLM\Software\ZmnGlobalSDK" /f
takeown /f "%WINDIR%\System32\drivers\zam64.sys" /a
icacls "%WINDIR%\System32\drivers\zam64.sys" /grant:r Administrators:F /c
del "%WINDIR%\System32\drivers\zam64.sys" /s /f /q
takeown /f "%WINDIR%\System32\drivers\zamguard64.sys" /a
icacls "%WINDIR%\System32\drivers\zamguard64.sys" /grant:r Administrators:F /c
del "%WINDIR%\System32\drivers\zamguard64.sys" /s /f /q
takeown /f "%ProgramFiles(x86)%\Zemana AntiMalware" /a /r /d y
icacls "%ProgramFiles(x86)%\Zemana AntiMalware" /inheritance:r /grant:r Administrators:(OI)(CI)F /t /c
rd "%ProgramFiles(x86)%\Zemana AntiMalware" /s /q
rd "%LocalAppData%\Zemana" /s /q
rd "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Zemana" /s /q
del "%WINDIR%\ZAM.krnl.trace" /s /f /q
del "%WINDIR%\ZAM_Guard.krnl.trace" /s /f /q
Click to expand...

Thanks ;)
 
  • Like
Reactions: JB007 and upnorth
I

illumination

Many 3rd party applications leave left overs like this in the system, even zam portable as stated already leaves registry keys ect.

Those 3rd party removal tools do not remove everything from an application, they never have, and i have always found left overs after trying them, it is why i do not use them but search manually the system via file explorer/local C/search local disk and by regedit/edit/find while toggling F3 to jump from one found to the next.

After doing this, i take a manual tour of system 32 ect just to make sure.

Good example of why i keep preaching of running light, and avoiding 3rd party as much as possible.
 
Last edited by a moderator:
  • Like
Reactions: mkaz, harlan4096, JB007 and 6 others
H

HarborFront

Level 72
Verified
Top Poster
Content Creator
Oct 9, 2016
6,140
illumination said:
Many 3rd party applications leave left overs like this in the system, zam even portable as stated already leaves registry keys ect.

Those 3rd party removal tools do not remove everything from an application, they never have, and i have always found left overs after trying them, it is why i do not use them but search manually the system via file explorer/local C/search local disk and by regedit/edit/find while toggling F3 to jump from one found to the next.

After doing this, i take a manual tour of system 32 ect just to make sure.

Good example of why i keep preaching of running light, and avoiding 3rd party as much as possible.
Click to expand...
There are some stubborn registry entries even Windows regedit cannot remove
 
  • Like
Reactions: harlan4096, illumination, JB007 and 2 others
JB007

JB007

Level 26
Verified
Top Poster
Well-known
May 19, 2016
1,580
TairikuOkami said:
Yes, I have just checked it and added those 2 files. They are persistent, when the drivers are running, once removed, files can be safely removed.
Code: 
sc config ZAM start= disabled
sc config ZAM_Guard start= disabled
net stop ZAM /y
net stop ZAM_Guard /y
sc delete ZAM
sc delete ZAM_Guard
reg delete "HKCU\Software\Zemana" /f
reg delete "HKLM\Software\Zemana" /f
reg delete "HKLM\Software\ZmnGlobalSDK" /f
takeown /f "%WINDIR%\System32\drivers\zam64.sys" /a
icacls "%WINDIR%\System32\drivers\zam64.sys" /grant:r Administrators:F /c
del "%WINDIR%\System32\drivers\zam64.sys" /s /f /q
takeown /f "%WINDIR%\System32\drivers\zamguard64.sys" /a
icacls "%WINDIR%\System32\drivers\zamguard64.sys" /grant:r Administrators:F /c
del "%WINDIR%\System32\drivers\zamguard64.sys" /s /f /q
takeown /f "%ProgramFiles(x86)%\Zemana AntiMalware" /a /r /d y
icacls "%ProgramFiles(x86)%\Zemana AntiMalware" /inheritance:r /grant:r Administrators:(OI)(CI)F /t /c
rd "%ProgramFiles(x86)%\Zemana AntiMalware" /s /q
rd "%LocalAppData%\Zemana" /s /q
rd "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Zemana" /s /q
del "%WINDIR%\ZAM.krnl.trace" /s /f /q
del "%WINDIR%\ZAM_Guard.krnl.trace" /s /f /q
Click to expand...
Thanks+++ @TairikuOkami (y)
 
H

HarborFront

Level 72
Verified
Top Poster
Content Creator
Oct 9, 2016
6,140
Last edited:
H

HarborFront

Level 72
Verified
Top Poster
Content Creator
Oct 9, 2016
6,140
illumination said:
If you come across these, it is generally because you have missed something, somewhere else, or you need to restart the system and then you can remove them.
Click to expand...
You go and try Dr Web's products and you'll see that many entries cannot be removed the conventional way like

1) using the default uninstaller or uninstall from Windows
2) using uninstallers like Revo in Advanced mode etc
3) using registry cleaners in Deep/Advanced mode
4) Windows regedit

You'll need special registry removal software like the Registry DeleteEx64 (or similar) I mentioned. Even then such software are good for removing a handful of stubborn registries. If there are many stubborn entries, like Dr Web's products, then either you forget about them or reformat your PC. I reformatted my tablet and never use Dr Web's products again
 
I

illumination

HarborFront said:
You go and try Dr Web's products and you'll see that many entries cannot be removed the conventional way like

1) using the default uninstaller or uninstall from Windows
2) using uninstallers like Revo in Advanced mode etc
3) using registry cleaners in Deep/Advanced mode
4) Windows regedit

You'll need special registry removal software like the Registry DeleteEx64 (or similar) I mentioned. Even then such software are good for removing a handful of stubborn registries. If there are many stubborn entries, like Dr Web's products, then either you forget about them or reformat your PC. I reformatted my tablet and never use Dr Web's products again
Click to expand...
I have not run into ones i can not remove, but was agreeing some can be stubborn. If i did run into some i could not remove like that, i would not use some 3rd party application to rip/gut things out of the registry, i would simply wipe the system and start fresh.
 
  • Like
Reactions: oldschool and harlan4096
A

Azure

Level 28
Verified
Top Poster
Content Creator
Oct 23, 2014
1,714
illumination said:
Many 3rd party applications leave left overs like this in the system, even zam portable as stated already leaves registry keys ect.

Those 3rd party removal tools do not remove everything from an application, they never have, and i have always found left overs after trying them, it is why i do not use them but search manually the system via file explorer/local C/search local disk and by regedit/edit/find while toggling F3 to jump from one found to the next.

After doing this, i take a manual tour of system 32 ect just to make sure.

Good example of why i keep preaching of running light, and avoiding 3rd party as much as possible.
Click to expand...
Even uninstallers with trace functionality?
 
Status
Not open for further replies.

Similar threads

Shadowra
    • Like
    • +Reputation
    • Thanks
App Review Old Norton vs New Norton - Engine Comparatif
Replies
50
Views
2,430
Video Reviews - Security and Privacy
Smoke
Smoke
BigWrench
    • Thanks
    • Like
Unlimited Giveaway Driver Booster Pro 11 Free License (subscription until end of the year)
Replies
0
Views
11,215
Giveaways, Promotions and Contests
BigWrench
BigWrench
lokamoka820
    • Like
    • Wow
Security News Windows Update Can Be Hijacked to Undo Security Patches
Replies
1
Views
2,422
Security News
SpiderWeb
SpiderWeb

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

Quick Navigation

Forum Rules Warning System Welcome Guide Two-factor Authentication

User Menu

Login

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top