This website uses cookies to ensure you get the best experience on our website.
Please note that by continuing to use this site you consent to the terms of our Privacy and Data Protection Policy.
Accept

Uninstallation Test 2022

Date February 2022
Language English
Last Revision March 10th 2022

Release date 2022-04-11
Revision date 2022-03-10
Test Period February 2022
Online with cloud connectivity checkbox-checked
Update allowed checkbox-checked
False Alarm Test included checkbox-checked
Platform/OS Microsoft Windows
Commissioned by PC Magazin Germany

Introduction

This test, which was commissioned by PC Magazin (Germany), looks at a rarely considered but nonetheless important aspect of computer programs: how easy is it to completely remove them from your computer? Whilst we do not encourage users to uninstall third-party antivirus programs, this could be necessary in a number of scenarios. You might want to change to a different product when your current subscription expires. Also, AV-Comparatives recommends users to try out antivirus programs using a free trial version, to check if they are suitable. Clearly, if you install a security program and then later decide that it is not for you, you want to be able to uninstall it easily and cleanly. Moreover, a standard practice if a program is malfunctioning is to uninstall and reinstall it. So, regardless of which security product you intend to use afterwards, it is important to be able to remove as much as possible of the current antivirus first.

As antivirus programs are deeply integrated into the Windows OS, uninstalling them cleanly can be quite a challenge. Furthermore, an incomplete uninstallation can potentially cause problems ranging from minor to major. You might find that you get irritating error messages, e.g. if Windows tries to start a program that is no longer installed. Additionally, there is the possibility that the “uninstalled” antivirus might waste significant disk space – up to hundreds of megabytes – by leaving numerous files behind. You might also encounter a more serious problem. For example, some antivirus programs check for the presence of competing antivirus products and refuse to install if any trace of one is found. In such cases, clean uninstallation is mission critical.

In this test, we assess how easily and completely a user can uninstall antivirus programs. We look at the uninstallation from two perspectives: first, we evaluate the usability of the uninstallation process; second, we monitor the system to determine all the leftovers (remnants of the program and its settings) remaining on disk after the uninstallation.

The test considers two different ways of uninstalling an antivirus program. The default and recommended way to do so is by navigating to Windows Settings > Apps (or Control Panel > Programs and Features), selecting the program from the list of installed apps, and clicking the Uninstall/Change/Modify option. If this standard method does not completely remove the antivirus program, many vendors offer an alternative way to remove the corrupted program. In this case, the user can run an alternative uninstaller provided by the vendor. This is a separate program, available on the respective vendor’s website, which is dedicated to removing the security product in question. It is intended to be used only if there are problems with using the standard uninstaller.

There are also other possible methods of uninstalling antivirus programs and removing their leftovers. These include third-party uninstallers (not specifically tailored to any one program) and system cleaners, and manual deletion of leftover files, registry entries, etc. We have not considered these in this test and advise readers to be very cautious about trying these methods, especially the latter. Unless you know what you are doing, you might delete the wrong thing, and end up with an unstable or even unusable PC. We also note that system-cleaning programs may promise more than they provide.

Please note that in our test, we have not considered the uninstallation of Microsoft Defender Antivirus, which is built into the Windows OS. When a third-party antivirus program is installed and registered in Windows Security, Microsoft Defender Antivirus is automatically disabled, and thus does not need to be uninstalled. Nevertheless, Defender-related files still take about 400 MB of disk space even if Defender Antivirus is deactivated.

Tested Products

We evaluated 16 security programs for Windows. For each product, the latest version available at the time of testing (February 2022) was used.

Vendor Product Version
Avast Free Antivirus 21.11
AVG Free Antivirus 21.11
Avira Prime 1.1
Bitdefender Internet Security 26.0
ESET Internet Security 15.0
G Data Total Security 25.5
K7 Total Security 16.0
Kaspersky Internet Security 21.3
Malwarebytes Premium 4.5
McAfee Total Protection 16.0
NortonLifeLock Norton 360 Deluxe 22.21
Panda Free Antivirus 21.01
TotalAV Antivirus Pro 5.16
Total Defense Essentials Anti-Virus 13.0
Trend Micro Internet Security 17.7
VIPRE Advanced Security 11.0

Alternative Uninstallers

These are the separate, dedicated uninstallation tools. The latest version of each uninstaller was downloaded from the vendor’s website prior to the test on February 1st, 2022. The “Last updated” date represents the signing date of the file. Neither Avira nor TotalAV provide alternative uninstallers on their respective websites. The alternative uninstaller provided for paid-for Panda products does not work with Panda Free Antivirus.

Vendor Additional applications Additional applications Last Update Website
Avast Uninstall Utility 21.11 15.12.2021 Link
AVG Clear 21.11 15.12.2021 Link
Bitdefender Uninstall Tool 2022 08.09.2021 Link
ESET Uninstaller 10.19 21.01.2021 Link
G Data part of the setup program 1.0 22.07.2021 Link
K7 Internal Removal Tool 1.0 01.12.2021 Link
Kaspersky Removal Tool 1.0 24.09.2021 Link
Malwarebytes Support Tool 1.8 27.09.2021 Link
McAfee Consumer Product Removal 10.4 30.12.2021 Link
NortonLifeLock Remove and Reinstall 4.5 11.11.2021 Link
Total Defense Cleaner 12.0 22.08.2021 Link
Trend Micro Uninstall Tool 4.1 10.11.2021 Link
VIPRE Removal Tool 12.0 15.09.2021 Link

Additional Applications

We noticed that a few security programs install some features (e.g. VPN or password manager) as separate applications, which show up as independent entries in the programs list and require manual uninstallation; these are what is meant by additional applications. You can find an overview of the relevant products in the table below.

Vendor Additional applications
Avast Secure Browser
AVG Secure Browser
Bitdefender Agent
Kaspersky Password Manager, VPN Secure Connection
McAfee WebAdvisor
Panda Opera Browser
Trend Micro Troubleshooting Tool

The Avast/AVG Secure Browser is installed by default, but the setup wizard lets you opt out. In the case of the Bitdefender Agent, this appears to be an essential component of the AV. Using the default uninstaller, it cannot be removed unless the AV product is removed first. Kaspersky Password Manager and VPN Secure Connection are both limited versions of freemium products that can be obtained separately. McAfee WebAdvisor is essentially a browser add-in, which (unusually) appears in the program list in Windows Settings. For this reason, we have regarded it as an additional application. With Panda, the Opera browser is installed by default, but again you can also opt out. As far as we are aware, it is just the standard version of the Opera browser, without any special security enhancements. The Trend Micro Troubleshooting tool can be uninstalled separately, without affecting the AV itself.

Trend Micro’s default uninstaller is the only one to remove the respective additional application (Trend Micro Troubleshooting Tool). In all the other cases, the user must separately uninstall the additional application after removing the respective AV product. However, the alternative uninstallers of Bitdefender, Kaspersky, and McAfee remove the respective additional applications along with the antivirus. Hence, no manual uninstallation is necessary afterwards.

We note that some of the products include functionality like VPN or system optimization, but within the one installed application. Hence, the fact that these programs are not mentioned here does not necessarily mean that their respective parent applications are lacking these features.

Test Procedure

In this test, we reviewed the uninstallation process of several antivirus programs for Windows. Before getting into the test methodology and results, we would like to define and clarify some terms that are frequently used throughout this document. We refer to default uninstallation as the process of uninstalling the program via the corresponding entry in the program list under Windows Settings > Apps. By alternative uninstallation we mean the usage of an additional, separate uninstaller that is provided and recommended by the vendor on their website in order to uninstall the program. By leftovers, we mean any system modifications made by the antivirus program which are not removed or reset by the uninstallation. These changes may be made during the installation, initial setup, or even the uninstallation processes of the antivirus program. We consider the following items to be leftovers: registry entries, files, folders, processes, services, scheduled tasks, browser extensions, and additional applications.

Lab Setup

Every security program to be tested is installed on its own computer. All computers are connected to the Internet and updated before the test. The test was performed under a fully patched Microsoft Windows 10 64-bit system. We tracked changes made by the antivirus program during its installation, first setup (i.e. initial scan and signature update), and uninstallation.

Test Methodology

Usability

We describe both the default and alternative uninstallation methods for each antivirus program using the terms defined and described in “Summary Results (Usability)”. For each of the situations described by these terms (e.g. whether a system reboot was recommended), we state whether it was applicable to the uninstallation of the respective products. Furthermore, we determine both the number of user actions and the estimated time in minutes needed to complete the uninstallation.

Leftovers

We identify the number of leftovers and the total size they claim on disk in megabytes (MB) for both the default and alternative uninstallations. If no alternative uninstaller is available, the evaluation is skipped. The processes, services, and scheduled tasks remaining on the system are determined manually by checking the corresponding list of Windows processes, services, and the Task Scheduler.

To get a better overview of and to compare the different uninstallation behaviours of the security programs, we distinguish between two scenarios for which we individually identify the leftovers:

  1. Uninstall the AV program and all additional applications, using the default uninstaller
  2. Uninstall the AV program and all additional applications, using the alternative uninstaller

Please note that the figures in “Summary Results (Leftovers)” are approximate. This is due to unavoidable system changes made exclusively by the Windows OS, and which are not related to or caused by the antivirus program per se. To the greatest extent possible, we ensured the test was run on a clean and idle system, meaning that recurring services and tasks, such as automatic updates for Windows and other software, which cannot be disabled were completed prior to the start of the test.

Test Results

Summary Results (Usability)

In the following, we would like to give a brief description of the terms used in the review of the uninstallation and the results table.

Online manual/help: a manual/help with uninstalling the product is available on the vendor’s website. This supports the user in uninstalling the program if it is not straightforward or there is a problem during the uninstallation.

Uninstallation protection: a self-defence mechanism that is activated by default and prevents the product from being uninstalled by an unauthorised user or malware. Typically, this requires the user to enter a password or license key, or solve a simple puzzle. We think that this feature is important and thus should be implemented in the antivirus products.

System reboot prompt: is the user advised to reboot the system after the uninstallation is completed? We strongly recommend that the uninstaller prompts the user to restart the system when the removal process has finished. A system restart ensures that any running processes or services are stopped, and that the new system configuration will be fully loaded.

Uninstall without Safe Mode: users should be aware that some of the alternative uninstallers require the user to boot into Windows Safe Mode. This may present some challenges to non-expert users, so we have noted here whether alternative uninstallers can be run in Normal Mode.

Subscription reminder: the user is informed about an active license/subscription, which is evaluated for paid products only. We think that vendors should remind the user about an ongoing subscription while or after uninstalling the product. In that case, users are likely to check for and/or backup the license key immediately. Otherwise, they might forget about or not be aware of an unused license they still pay for if, for example, the auto-renewal option is activated.

Backup configuration data: the uninstaller either automatically backs up/exports data such as licence information or settings, or provides the user with the opportunity to do this.

Usability features of uninstallers


Present

Absent

Default: default uninstallation of the AV program
Alt.: alternative uninstallation of the AV program

† Not applicable, as there is no alternative uninstaller.
* The feature is available but disabled by default.

Summary Results (Leftovers)

The table below shows the approximate number of registry entries and files/folders left behind by the respective uninstallers, along with the approximate total disk space taken up by these. In some cases, two or more default uninstallers have to be run in order to remove the AV itself and the additional programs that were installed with it. For more information, see “Test Methodology”.

AV + apps: default uninstallation of the AV program and all additional applications
Alt.: alternative uninstallation of the AV program and all additional applications

† Not applicable, as there is no alternative uninstaller.

To improve readability, we have colour-coded the figures for disk space used as follows:
Green text = less than 100 MB
Yellow text = 100-200 MB
Red text = over 200 MB

After the uninstallation, programs usually leave registry entries behind, but these are very small in terms of size and have nearly no impact on disk space. However, there might be situations where leftover registry entries could cause a problem, e.g. when installing a new AV product.

Most products leave less than 100 MB of data behind after the uninstallation. The outliers are Bitdefender, NortonLifeLock, and VIPRE (only for the alternative uninstallers), with more than 200 MB of data remaining on disk. This includes remaining setup and temporary files for all of them, and the browser extensions in the case of NortonLifeLock.

The alternative uninstaller of McAfee leaves many registry entries behind. The alternative uninstallers of Kaspersky, Total Defense, and VIPRE have considerably more leftovers than their default counterparts, as they create additional logs and temporary files on the disk.

The table below shows the number of additional applications, processes, services, scheduled tasks, and browser extensions left behind by each of the respective uninstallers.

In some cases, two or more default uninstallers have to be run in order to remove the AV itself and the additional programs that were installed with it. We note that some alternative uninstallers leave behind more leftovers than their respective default counterparts.

No leftovers found

Additional default uninstaller(s) has/have to be run to remove the last leftovers

Leftovers found (number of items is shown in brackets)

† Not applicable, as there is no alternative uninstaller.
* Not applicable, as there are no additional apps, scheduled tasks, or browser extensions to be uninstalled.

For all products, all additional applications and processes are completely removed after running the default/alternative uninstallers plus additional uninstallers. In addition, all uninstallers except the alternative one by Kaspersky remove all services. However, this single service is stopped.

The alternative uninstallers of Avast and AVG, as well as both uninstallers of Kaspersky, leave one scheduled task behind. Although this is set to “Ready” in each case, it will not be executed because of missing dependencies.

Browser extensions are left behind by the uninstallers of Avira (1), G Data (1), K7 (1), Kaspersky (1), Malwarebytes (1), McAfee (1), NortonLifeLock (4), and Trend Micro (1).

General Observations

Almost all vendors provide a manual or help for the product uninstallation on their website, and advise the user to reboot the system after uninstallation in order to complete the process. Moreover, all product uninstallers guide the user through the uninstallation with step-by-step instructions.

The default uninstaller of most products (Avast, AVG, Avira, Bitdefender, G Data, Kaspersky, Malwarebytes, NortonLifeLock, Panda, VIPRE) asks the user to optionally give feedback or take a survey in either the wizard or a browser window. Additionally, the user is asked to send feedback during the alternative uninstallation of G Data and Malwarebytes.

In general, the uninstallation process takes only a couple of minutes depending on the size and number of installed files, system performance, and boot time. In our test, the uninstallation took 5 minutes at most, including a system reboot and 3-4 clicks on average to finish.

Stand-out features of the tested programs

During the course of testing, we found some particularly useful features in some of the default uninstallers. ESET and Kaspersky both allow the user to export personal settings for the program, so these can be used for a later (re)installation. Kaspersky additionally lets you export the licence key.

The following programs have uninstallation protection enabled by default: Avast, AVG, Kaspersky, McAfee, Total Defense and Trend Micro.

The default uninstallers of Avast, AVG, Avira, and VIPRE offer a “Repair” option. Furthermore, the uninstallers of Avast, AVG, and G Data let you customize the product by uninstalling or (re)installing certain features.

Conclusion

Most of the products in the test can be almost completely removed using the default uninstaller. Consequently, we suggest trying this method first for any of the products. If the default uninstallation should fail, or leave behind significant leftovers, you can try using the alternative uninstaller. We suggest that some vendors should improve the scope of their uninstallers, by e.g. giving the option to remove browser extensions that were installed along with the AV product. We also feel that help features for uninstallers could be improved. Four of the vendors in the test do not provide any help with at least one of their uninstallers.

Notes on individual product uninstallers

Avast & AVG

Both Avast Free Antivirus and AVG Antivirus are made by the same parent company, Avast. As the two products are technically identical, we have combined our observations on them into one section here.

The Avast/AVG Secure Browser is installed by default along with the antivirus product, though you can opt out of this. The product has a self-defence mechanism, activated by default, that prevents an automatic uninstallation. This only applies to the default uninstallation.

The Avast/AVG Secure Browser, along with its processes, services, and scheduled tasks, remains on disk after uninstalling the antivirus product. The application itself claims around 750 MB of disk space and needs to be manually uninstalled by the user. If the Secure Browser is removed manually, the total number and size of leftovers is greatly reduced. This is the case for both the default and alternative uninstallation. The alternative uninstallation requires a system reboot into Windows Safe Mode before the security software can be uninstalled.

When installed, both Avast-made products (Avast Free Antivirus and AVG Free Antivirus) products create a licence/ID file, with the same name and location used in both cases. This file remains on the disk after the respective AV product has been uninstalled, and will retain details of any previously installed Avast products, as well as the current one.

Avira

The product installs specific .NET Framework packages (~100 MB) in order to run properly; these are not removed after uninstallation.

One browser extension is not removed during the uninstallation, but the vendor gives online instructions on how to do it. The vendor does not provide an alternative uninstaller.

Bitdefender

The Bitdefender Agent application is installed along with the antivirus product. Choosing the Reinstall option in the default uninstallation wizard leaves the product settings on the system disk after the product itself is uninstalled.

After the default uninstallation, the Bitdefender Agent application, including its processes, services, and scheduled task, remains on the system and thus needs to be manually uninstalled. This could cause issues when the user tries to install other Bitdefender or competing antivirus products. In addition, a temporary installation folder claims about 577 MB of disk space. No online manual or help is available for the alternative uninstallation.

ESET

The default uninstaller allows the user to export and save the product settings before starting the removal process.

The alternative uninstaller requires a system reboot into Windows Safe Mode, and its wizard is run inside a command prompt window.

G Data

During both the default and the alternative uninstallations, the user is given the choice as to whether to keep or delete personal settings. There is also an option to delete quarantined files. The alternative uninstaller does not need to be downloaded separately, as it is included as an option within the full installer file. Neither of the two uninstallers removes the only browser extension.

K7

The vendor does not provide an online manual or help for the product uninstallation. Only after using the alternative uninstaller is the user asked to reboot the system. We feel that the warning in the screenshot here (from the default uninstaller), “If you uninstall this product you will not be protected from viruses and threats from the Internet”, is rather exaggerated. If you uninstall K7 Total Security, Microsoft Defender will be activated, at the latest after a reboot.

Kaspersky

The Kaspersky Password Manager and VPN Secure Connection apps are installed by default along with the antivirus product, although it is possible to opt out. The default uninstaller advises the user to save the activation code to a Kaspersky account. Moreover, the user can select the data they want to keep on disk, e.g. the license information. When the default uninstallation is completed, the Password Manager and VPN applications, along with their processes, services, and scheduled tasks, remain on disk. Before uninstalling any Kaspersky product via the alternative uninstaller, the user must enter an on-screen code which prevents an unintentional or automatic uninstallation, by e.g. malware. The alternative uninstallation creates several log files on disk and leaves behind one service, one scheduled task, and one browser extension. We note that the alternative uninstaller can only remove one application at a time. Hence, you would need to run it once to remove the AV itself, and then once more for each additional Kaspersky application that you want to uninstall.

Malwarebytes

An uninstallation protection feature is available, but disabled by default. If enabled, the user must enter either a password or the license key during both the default and alternative uninstallations. In the last step of the alternative uninstallation, the user is prompted to reinstall Malwarebytes. Regardless of whether they click Yes or Cancel here, the installer for Malwarebytes Privacy (VPN) is started. This behaviour is unexpected and potentially irritating. Although it leaves fewer leftovers, the alternative uninstallation creates an additional log file and a license information file on the system disk. Neither of the uninstallers prompts the user to restart the system or removes the only browser extension.

McAfee

The WebAdvisor application is installed along with the antivirus product. During the default uninstallation, the user can choose to keep or remove subscription information and personal settings.

Furthermore, the uninstaller informs the user that WebAdvisor will not be uninstalled, and that a subscription is still active. Only during the alternative uninstallation must the user enter an on-screen verification code in order to continue the process.

Panda

If the Opera browser is not already installed on the system, it will be installed along with the antivirus by default (the user can opt out of this). The Opera browser remains on disk after uninstalling the antivirus. Please note that although the tested product was called Panda Free Antivirus, the name “Panda Dome” is used in the program interface. On the vendor’s website, there is no alternative uninstaller shown for Panda Free Antivirus.

The alternative uninstaller provided for paid-for Panda products does not work with Panda Free Antivirus.

Total AV

The default uninstaller lets you choose to keep your user preferences. The vendor does not provide an alternative uninstaller.

Please note that we have frequently seen on the Internet the following uninstallation advice from TotalAV support: “We advise all customers that if you wish to cancel your account, please do not simply uninstall your software, you need to contact us in order to cancel the account.”

Total Defense

During the default uninstallation, the user is asked to solve a simple mathematical problem before continuing the uninstallation. This verification step ensures that the antivirus cannot be automatically uninstalled by an unauthorised user or malware.

The alternative uninstallation has no verification step. It also creates temporary files on the system disk that are not deleted afterwards, meaning that it has more leftovers than its default counterpart.

Trend Micro

The Trend Micro Troubleshooting Tool is installed along with the antivirus product.

During the alternative uninstallation, the user is asked to enter an on-screen 4-digits code in order to perform the uninstallation. The alternative uninstallation does not remove the browser extension in Internet Explorer. Interestingly, no verification code needs to be entered during the default uninstallation.

VIPRE

During the default uninstallation, the user can decide to remove or keep personal settings.

The alternative uninstallation produces more leftovers than the default analogue, as it installs specific .NET Framework packages (~100 MB) in order to run properly, and does not remove the temporary installer file (~86 MB).

 

Appendix

In the two tables below, we have listed a few examples of leftovers such as (a) file paths and (b) registry keys that can be associated with the respective product.

  Registry entries
Avast %AllUsersProfile%\Avast Software\Persistent Data\Avast\Logs
%CommonProgramFiles%\Avast Software\Overseer
AVG %AllUsersProfile%\AVG\Persistent Data\Antivirus\Logs
%CommonProgramFiles%\AVG\Overseer
Avira Explorer\DOMStorage\*avira.com
%SystemRoot%\assembly\NativeImages_v4.0.30319_32\Avira*
%AppData%\Mozilla\Firefox\Profiles\Y5qfIH9s.default\extensions\[email protected]
%Temp%\Avira*.log
Bitdefender %ProgramData%\BDLogging
%ProgramData%\Bitdefender Agent
%ProgramData%\agent.*.bdinstall.v2.bin
%ProgramData%\cl.*.bdinstall.v2.bin
%ProgramFiles%\Bitdefender Agent
%Temp%\RarSFX0\packages\bd*
ESET %Temp%\eset
%LocalAppData%\ESET\ESET Security
%SystemRoot%\System32\config\systemprofile\AppData\Local\ESET\ESET Security
G Data %Temp%\gd*.dll.tmp
%CommonProgramFiles%\AV
%ProgramFiles(x86)%\G DATA\TotalSecurity
%ProgramData%\G Data
K7 %ProgramFiles(x86)%\K7 Computing\K7TSecurity
%SystemRoot%\Temp\K7TS*
Kaspersky %CommonProgramFiles%\AV\Kaspersky Lab
%SystemDrive%\Users\Default\AppData\Local\Kaspersky Lab\Kaspersky Password Manager
Malwarebytes %ProgramFiles%\Malwarebytes\Anti-Malware
%LocalAppData%\mbam
%SystemRoot%\Temp\mbam*.log
%Temp%\MBAMInstallerService.exe
%Temp%\mbam
McAfee %ProgramFiles%\McAfee
%SystemRoot%\System32\CatRoot\[ID]\McAfee-VSCore*.cat
%UserProfile%\Documents\McAfee Vaults
%LocalAppData%\McAfee File Lock
Norton %Public%\Downloads\Norton
%ProgramData%\Norton
%ProgramData%\NortonInstaller
%LocalAppData%\Google\Chrome\User Data\Default\Extensions\admmjipmmciaobhojoghlmleefbicajg
%LocalAppData%\Google\Chrome\User Data\Default\Extensions\fnpbeacklnhmkkilekogeiekaglbmmka
%LocalAppData%\Google\Chrome\User Data\Default\Extensions\\mhffmephdchhhbfjmdpoaldedhhdanbn
%LocalAppData%\Google\Chrome\User Data\Default\Extensions\mpnlkmlkncncpgnnkmkgoobfpnjmblnk
Panda %ProgramData%\Panda Security\PSLogs
%AppData%\Panda Security
TotalAV %ProgramData%\SecuritySuite\Quarantine
%SystemRoot%\SysWOW64\config\systemprofile\AppData\Roaming\TotalAV
%UserProfile%\Documents\TotalAV\PasswordVault
Total Defense %ProgramData%\TotalDefenseTng\StoredData
%Temp%\antivirus_tmpddae.exe.exe
Trend Micro %ProgramData%\Trend Micro*
%LocalAppData%\Trend Micro
%Temp%\Trend Micro
%SystemRoot%\Temp\TrendMicro AntiThreat Toolkit
%SystemRoot%\System32\Amsp*
%SystemRoot%\System32\Debug\Amsp_DebugLog.log
VIPRE %ProgramData%\Downloaded Installations\{ID}\…\VIPRE Advanced Security.msi
%LocalAppData%\VIPRE
%Temp%\VIPRE
%SystemRoot%\System32\config\systemprofile\AppData\Local\VipreEdgeProtection
%SystemRoot%\assembly\NativeImages_v4.0.30319_32\VIPRE*
  Registry entries
Avast HKCR\Avast*
HKCU\SOFTWARE\AVAST Software
HKLM\SOFTWARE\Avast Software
AVG HKCR\AVG*
HKCU\SOFTWARE\AVG
HKLM\SOFTWARE\AVG
Avira HKCU\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\*avira.com
HKLM\SOFTWARE\Microsoft\Tracing\Avira*
HKLM\SYSTEM\*ControlSet*\Services\EventLog\Application\Avira*
Bitdefender HKLM\SOFTWARE\WOW6432Node\Bitdefender Agent
ESET HKCU\SOFTWARE\ESET
HKLM\SOFTWARE\ESET
G Data HKCR\GDSetup
HKCU\SOFTWARE\G Data
HKLM\SOFTWARE\G DATA
K7 HKCU\SOFTWARE\K7 Computing
HKU\[USER-ID]\SOFTWARE\K7 Computing
Kaspersky HKLM\SOFTWARE\KasperskyLab
HKLM\SYSTEM\*ControlSet*\Services\EventLog\Kaspersky Event Log
HKU\[USER-ID]\Software\KasperskyLab
Malwarebytes Registry values/data remain but no standalone keys
McAfee HKCU\SOFTWARE\McAfee
HKLM\SOFTWARE\WOW6432Node\MCPR
HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\webadvisor.mcafee.chrome.extension
HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\wss.mcafee.chrome.extension
Norton HKCR\Norton*
HKCU\SOFTWARE\Norton
HKCU\SOFTWARE\Classes\NortonSecurity
HKLM\SOFTWARE\Norton
HKLM\SOFTWARE\Microsoft\Tracing\NortonSecurity*
Panda HKCU\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\psuamain.exe
HKLM\SOFTWARE\WOW6432Node\Panda Software
HKLM\SOFTWARE\WOW6432Node\Microsoft\Tracing\PSUA*
TotalAV HKCR\totalav
HKLM\SOFTWARE\Classes\totalav
HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.totalav.passwordvaultassistant
HKLM\SOFTWARE\WOW6432Node\Microsoft\Tracing\TotalAV*
Total Defense HKLM\SOFTWARE\Bitdefender
Trend Micro HKU\[USER-ID]\Software\TrendMicro
VIPRE HKCR\SBAMSvc*
HKCR\Vipre*
HKCU\SOFTWARE\SBAMSvc
HKCU\SOFTWARE\VIPRE
HKLM\SOFTWARE\Bitdefender

Copyright and Disclaimer

This publication is Copyright © 2022 by AV-Comparatives ®. Any use of the results, etc. in whole or in part, is ONLY permitted after the explicit written agreement of the management board of AV-Comparatives prior to any publication. AV-Comparatives and its testers cannot be held liable for any damage or loss, which might occur as result of, or in connection with, the use of the information provided in this paper. We take every possible care to ensure the correctness of the basic data, but a liability for the correctness of the test results cannot be taken by any representative of AV-Comparatives. We do not give any guarantee of the correctness, completeness, or suitability for a specific purpose of any of the information/content provided at any given time. No one else involved in creating, producing or delivering test results shall be liable for any indirect, special or consequential damage, or loss of profits, arising out of, or related to, the use or inability to use, the services provided by the website, test documents or any related data.

For more information about AV-Comparatives and the testing methodologies, please visit our website.

AV-Comparatives
(April 2022)