I think my solution will be deleting all the presence of Cylance from the registry and the C drive … After talking with Cylance support, I was told to disable Cylance services and then delete Cylance from this locations
Remove Cylance folders from C:\Program Files, %ProgramData%, and %AppData%\Local
Remove the Cylance driver from C:\Windows\system32\drivers and C:\Windows\system32\drvstore
Remove Cylance registry keys from HKLM\Software and HKLM\System\CurrentControlSet\services
You may also need to remove:
HKEY_CLASSES_ROOT\Installer\Products\C5CF46E2682913A419B6D0A84E2B9245
HKEY_CLASSES_ROOT\Installer\Products\D3D0C4A204C6F4843BBBD1487384BFF5
Comprehensive list:
C:\Program Files\Cylance
C:\ProgramData\Cylance
C:\Windows\System32\drivers\CyOpticsDrv.bak
C:\Windows\System32\drivers\CyOpticsDrv.sys
C:\Windows\System32\drivers\CyProtectDrv64.sys
C:\Windows\System32\drivers\CylanceDrv64.sys
C:\Windows\System32\drivers\CyDevFlt64.sys
C:\Windows\System32\DrvStore\CyOpticsDr_93D37CBD237A3B772B26BAC98F74A83C7DB67130
C:\Windows\System32\DrvStore\CyProtectD_35DEA6E5F703DD2A525FF0BF84B2520B9A03E8BC
HKEY_CLASSES_ROOT\Installer\Products\C5CF46E2682913A419B6D0A84E2B9245
KEY_CLASSES_ROOT\Installer\Products\D3D0C4A204C6F4843BBBD1487384BFF5
HKEY_LOCAL_MACHINE\SOFTWARE\Cylance
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CyProtectDrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CyOpticsDrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CyOptics
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CylanceSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CyDevFlt64
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CylanceDrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CyDevFlt
Also, search for any instances of Cylance in the following keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\
It worked doing all this but I need to be able to create action fixlet to delete all the presence of cylance in C: and registry. I created a fixlet to disable cylance service already.