Panda Versus The Demon Egg

Today was one of those days that I just have to congratulate myself for really reaching a new low in terms of looking that gift horse of Life in the mouth. I made some deviled eggs while listening to that Rhino "Have a Nice Decade '70's Pop Music" box set (the one with the actual square of shag carpet on the box), while uninstalling some crappy antivirus program from my friend's PC.

It was kind of like Less Than Zero in terms of a bottoming-out of the soul, but without the coke and wall street stuff, which is definitely more tragic although less cinematic.

Here's a shot of the deviled eggs:



So the wicked software I battled all day is called Panda Platinum Internet Security 2005. I'm sure it great at something, but it's practically uninstallable. My friend actually paid for a license, tried to upgrade from 2005 to 2006 and got stuck in some kind of Kafka-mode where 2006 couldn't install until 2005 uninstalled, and 2005 wasn't able to fully uninstall but did manage to blow away the network drivers. Also, all the menus turned into Spanish.

I spent about 5 hours working on getting this off her machine, but I finally did it and I feel like it's worth throwing some of the info I ended up culling from various tech support lists up here to save you the thrill of reading a bunch of self-important self-appointed geek experts tear each other apart for "inappropriate shouting via the use of bold letters" and so on...

So, how to remove Panda 2005

I'd start with this: http://www.geekstogo.com/forum/I-cant-uninstall-panda--t79166.html which walks through someone who tried to uninstall Panda the normal way:

• START->CONTROL PANELS->ADD/REMOVE PROGRAMS->PANDA

and realized, like I did, that this technique basically did nothing.

Your goal with the uninstall is to delete the C:/PROGRAM FILES/PANDA SOFTWARE folder and all the hidden system files and references to Panda.

The regular uninstall seems to fail because there are some files that are called into use early on when the computer starts up and once they're running you can't delete them. If you try to simply drag the Panda Software to the recyle bin, you'll get an error saying one of these 5 files is in use, so the whole folder can't be deleted:

• ICL_CFG.DLL
• PAVLSP.DLL
• PAVOLE.DLL
• PAVTRC.DLL
• STOREMAN.DLL

You can actually remove them, but you need some freeware program called move on boot that lets you target files for deletion upon reboot. I downloaded it, installed it, used it and then uninstalled it, and it didn't do anything evil (adware/spyware/etc).

So, with Move On Boot, you target those 5 files for deletion and then restart. Afterwards you should be able to delete the whole Panda Software folder.

Now you have to manually hunt down and remove every reference to anything "panda" or "pav" (panda antivirus). This means in the services, the registry and the file system. I wasn't very methodical about this, but here are some things that were useful to know:

START->RUN->services.msc
This shows you all the services that are running. You should disable any Panda services.

START->RUN->msconfig
another way of managing services. Also lets you see what starts up upon boot, so you can disable stuff there as well if needed.

START->RUN->regedit
lets you edit the registry. This is pretty powerful and you can basically fuck yourself pretty easily if you get too wacky, but I started off cautiously and then went postal and it turned out ok.

This article (How do I uninstall Panda Titanium?) was really useful for the registry cleaning stuff. It's not 100% complete (for example, some of the files it listed weren't on the machine I was working on and it missed some that were... probably due to a slightly different version of Panda), but basically if you go with the spirit of the law instead of the letter you should be good.

I'd try to find every file they mention, and then just keep searching the registry for "panda" and "pav" (do this when booted in normal mode as some seemed to only appear in Normal Mode as opposed to Safe Mode), you should be able to clear out everything.

Next, search the file system for those terms as well. Panda droppings are all over the computer and you really need to remove every single reference.

After I finally removed all the services, registry entires, folders and files that were related to Panda, my network connection was hosed. I had to run windows command-line tool called netsh to reset my now completely fucked up network drivers, which is discussed on microsoft's support site here.

Basically I ran (via the command prompt):

• netsh int ip reset c:\resetlog.txt
• netsh winsock reset (which will prompt you to restart, which you should do)
  

So, as lame as this blog entry was, having to figure all this stuff out was even lamer, so maybe this will help someone.