CC SecurityUninstallation and Troubleshooting Guide
This guide helps you safely exit CC Security, retain necessary data, and address uninstallation failures, quarantine restoration, or network problems. First distinguish closing the interface, turning off real-time protection, and uninstalling services and drivers: these are three different actions. Deleting the program directory is not a substitute for formal uninstallation.
1 Before Uninstalling
1. Save your current work and stop starting new tests or targeted cleanup tasks. If "Silver Fox Trojan Removal" is running, use the stop action on the page and wait for actions already underway to finish and networking to be restored.
2. Under "Virus and threat protection" > "Handled items", open "Quarantine and blocked items". If you need to retain quarantined files, verify their risk and provenance before deciding whether to restore them. Do not restore suspicious files in bulk just to keep a program running.
3. With administrator privileges, back up local settings, evidence, and the entire quarantine data directory that you need to retain. Do not copy only an individual encrypted file while discarding metadata or keys.
4. Retain the current complete installer, source package for the same revision or verification information, and important fault logs. Create a virtual-machine snapshot or system-level backup first if necessary.
2 Normal Uninstallation
Open Installed apps or "Apps & features" in Windows Settings, find CC Security, and select Uninstall. Alternatively, use "Uninstall CC Security" in the Start menu. Read the Windows UAC prompt, verify the source, and authorize the action.
Uninstallation attempts to place the protection service into maintenance mode, stop and remove the registrations for CCSecurityAgent, CCSecurityGuard, and CCSecurityScriptFilter, remove the product's startup entries, and remove the relevant CC test certificates imported by this installation according to its records.
If stopping services or drivers is reported as incomplete, restart the test computer as instructed and retry. Do not directly delete .sys files still in use or remove other security products' services, filter instances, or certificates. If a restart is requested after completion, restart before checking the remaining state.
Successful uninstallation does not mean quarantined files have been restored automatically, all historical actions have been undone, or the system contains no other threats. Separately verify data needing restoration, network status, and Windows' own security protection.
3 Data Retained After Uninstallation
The current component uninstallation script intentionally retains encrypted quarantine data, keys, settings, and evidence in %ProgramData%\CC Security so that users do not lose recovery capability. This directory may also contain diagnostic logs, targeted cleanup state, and cumulative statistics.
Preserve .ccq data, corresponding JSON metadata, vault-key.dpapi, and other associated materials in the quarantine directory together. DPAPI protection is tied to the original Windows environment. Having backup files alone does not guarantee decryption after reinstalling Windows, moving to another device, or losing the relevant keys.
Interface preferences, window layouts, WebView2 local data, and webview-diagnostics.log are stored in %LocalAppData%\CC Security. Machine-level uninstallation may not remove all such user directories. Once you confirm they are no longer needed, you may separately remove product-specific directories. Do not delete the shared Microsoft WebView2 Runtime.
Deleting quarantine keys or data may make recovery permanently impossible. If restoration is still needed, first retain a complete backup and use a valid CC quarantine management process, rather than directly decrypting, running, or copying unknown files back to their original locations.
4 Uninstallation Blocked by Network Restoration State
Targeted cleanup may temporarily create the product's own network isolation rules. If a network restoration lease remains unfinished, the current uninstallation entry point blocks further progress to avoid leaving networking isolated after removal.
Return to the targeted cleanup area of "Virus and threat protection". If "Restore network" appears, use it and complete UAC authorization if required. Wait for the result, verify actual connectivity, then retry uninstallation. "Restored" on the page is a product status; where necessary, also verify the network connections that previously worked.
Do not manually delete network-cleanup-lease.json, associated recovery tasks, or arbitrary firewall rules to bypass the check. They may be needed to complete restoration. If restoration still fails, retain logs and state files so maintenance personnel can check the product's own lease. Do not reset the entire machine's firewall or delete other applications' rules.
5 Restoring Quarantined Files
In a matching version that is still usable, open "Quarantine and blocked items", switch to "Quarantine", select an entry that genuinely needs restoration, and use Restore. Administrative operations require administrator authorization. Read the confirmation prompt before restoring.
Restoration may reintroduce risk. It may fail if a new file with the same name occupies the original path, identity verification fails, keys are damaged, access is denied, or encrypted data is incomplete. Do not forcibly overwrite new files, rewrite entry hashes, or copy keys from other versions to bypass checks.
If the Software has already been uninstalled and you need quarantined content back, preserve the entire data directory and use a complete version compatible with the data format, or contact support for verification. Reinstallation is not a guarantee of recovery. Recovery is not promised for data confirmed deleted without an independent backup.
"Blocked items" records do not necessarily mean a recoverable quarantined file exists. "Exclusions" only changes the scope of subsequent detection and does not automatically restore files. Understand the three pages' purposes separately.
6 Protection Service or Interface Problems
If the service is disconnected, first retain the error message, restart status, and version information, then review component-install.log and service-diagnostics.log. If only the interface fails to open, also check WebView2 and webview-diagnostics.log in the user directory. Closing the window does not necessarily stop the background service.
If the old service cannot enter maintenance mode during installation or upgrade, the installer may report that its automatic startup has been suspended and request a restart. Restart as instructed, then repair or reinstall using the complete installer. Do not repeatedly replace only the UI, a single worker, or one driver.
If Windows or another security product blocks the installer or a component, first verify the file's provenance, signature, hash, and the other product's final verdict. Do not routinely troubleshoot by disabling protection, excluding an entire directory, or forcibly restoring build outputs from quarantine.
7 Blue Screens or Failure to Start Windows
Prefer a previously prepared virtual-machine snapshot, System Restore in the Windows Recovery Environment, or a verified system backup. If Safe Mode is accessible, you may attempt formal uninstallation with administrator authorization. Driver and service availability may differ between recovery environments.
Offline registry changes, disabling service startup, or disk-encryption work should be performed by maintenance personnel familiar with Windows recovery. First verify the target Windows partition, recovery keys, and backups. Do not guess drive letters, delete system drivers, or apply cleanup scripts intended for other products.
Retain the blue-screen stop code, relevant driver name, CC build and revision, and the sequence of actions before and after the upgrade. Dumps may contain fragments of personal files, credentials, or session information. Do not email complete dumps without reviewing them first.
8 Final Checks and Feedback
After restarting, confirm that CC's installation entry has been removed, networking and applications needing restoration work normally, and existing Windows security products are in the expected state. Check service registrations, residual files, retained data, and recovery completion separately. A missing desktop icon alone does not establish complete uninstallation.
For issues you cannot resolve, contact kelematubako@gmail.com. Begin with the version, operating system build, error screenshots, time of occurrence, and sanitized excerpts from relevant logs. Explain which quarantine data you want to retain and the actions already completed. Do not send passwords, recovery keys, or other people's data without authorization.