registry permissions and Norton AV

[raygg]

I just had to put an older dell inspiron 6150 laptop running XP Pro back into daily service while my newer laptop was awaiting a part. The subscription to Norton antivirus on the Dell was expired and I have a current multi-PC license for Webroot spysweeper with av which I chose to install. The dell cpu was very slow and unresponsive and I determined it was Norton av constantly running in the background and eating resources significantly. I tried using the control panel uninstall program approach but the Norton av would not uninstall, partially I think because so many cpu cycles were being occupied by the Norton av software.

I have a lot of experience cleaning the registry as an Oracle DBA, so I started deleting every instance of 'norton' in the registry. I never saw a software product that was so embedded in the registry.

But I encountered many registry entries that refused to be deleted even tho I was using a logon with admin rights. I even tried going to the advanced option and verifying the logon id had admin rights but still those entries in the registry would not budge.

Question: What kind of action do you have to take to delete such registry entries?

I solved the immediate problem when I discovered by websurfing that there is a Norton uninstall tool specific to each Norton product by year and downloadable for free. This worked well and now the Dell is Norton free.

General comment - the dell runs better with the webroot software than the cpu dragging norton av.

 

[linney]

Some Registry entries are for want of a better explanation "super protected" and off limits to the normal range of users. Some software like Norton probably have self protection routines built in too I would imagine. Perhaps preventing these programs from running at Startup via the MsConfig tool would help.

You might be able to access those type of Keys by loading a Registry Hive in another system while the current system is not loaded, perhaps with something like BartPE or similar.

Mind you it might be a problem getting the amended system to boot or run afterward as a result of tampering.

As an Administrator highlight one of the two following Keys, it will only be available for these Keys.

HKEY_LOCAL_MACHINE
HKEY_USERS

These two articles in the RegEdit Help are a good explanation of the process.

To load a hive into the registry
To unload a hive from the registry

How to edit the registry offline using BartPE boot CD

http://windowsxp.mvps.org/peboot.htm