Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

cannot re-install Microsoft Security Essentials


  • Please log in to reply
23 replies to this topic

#1 smind44

smind44

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:10:23 PM

Posted 10 May 2013 - 01:10 PM

Last night I found my computer was infected with a rogue security program called "Internet Security 2013".  It was announcing false positives, hogging resources with a fake svchost process, and redirecting google searches.  After running TDSSKiller and Combofix, it looks like I've removed any trace of the rogue program-- at least, there's nothing hogging the cpu or memory, and I'm not being redirected to obvious fake security-related sites.

 

So here's my problem:  when I was running ComboFix, it asked be to de-activate Microsoft Security Essentials.  When I tried to open the MSE control panel, I got some generic error window (sorry, I didn't write down what it said).  So i decided to uninstall MSE throgh the "add/remove programs" panel.  After running ComboFix, I was able to download the legit MSE installer  from the microsoft website.  I thought I'd be able to reinstall MSE easily, but whe I run the install wizard I get an error message saying the installation can not be completed.

 

It gives this error code:  0x80070643

 

I did some searching, and apparently this error happens when you have other anti-virus software installed that conflicts with MSE.  I don't have any other AV software, and I thought I uninstalled my old MSE correctly (it no longer shows up in my add/remove programs window).  I used this microsoft fixit thing to uninstall Microsoft Security Client, but when I try to instal MSE again I get the same error.

 

A related problem:  when I look in "C:\Program Files\Microsoft Security Client"  I see the following subfolders: "Antimalware", "Backpup", "Drivers", and "en-us", but if I try to open any of them I get the error:

 

C:\Program Files\Microsoft Security Client\Drivers is not accessible.

The file can not be accessed by the system.

 

So I'm really stumped here.  I can't instal my antivirus program because I can't remove my old one. Have I corrupted my install of Security Essentials, or is there possibly still Malware on my system? 

 

Thanks.


Edited by hamluis, 10 May 2013 - 01:12 PM.
Moved from XP to Am I Infected - Hamluis.


BC AdBot (Login to Remove)

 


#2 firestormerc

firestormerc

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:23 PM

Posted 10 May 2013 - 01:31 PM

Download Malwarebytes Antimalware and Install Malwarebytes Antimalware. Run a scan to remove anything related to the rogue and any malware. Then try to reinstall MSE.


Edited by firestormerc, 10 May 2013 - 01:40 PM.


#3 smind44

smind44
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:10:23 PM

Posted 10 May 2013 - 01:38 PM

I've already uninstalled MSE through the "add/remove programs" window, but It's left behind files and registry keys that I can't remove.  I will try Malwarebytes, though.

 

EDIT:  downloaded Malwarebytes Anti-Malware and performed a quick scan.  No malicious items detected.


Edited by smind44, 10 May 2013 - 01:57 PM.


#4 firestormerc

firestormerc

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:23 PM

Posted 10 May 2013 - 03:56 PM

Try the Microsoft Fix It from: http://support.microsoft.com/kb/2435760 or copy what is in () (rmdir /s /q "C:\Program Files\Microsoft Security Client\Drivers") to a notepad then click Save As then click the drop down menu for the Save as type to All Files and save it as RemoveMSE.bat. Double click RemoveMSE.bat from where you saved it.


Edited by firestormerc, 10 May 2013 - 03:56 PM.


#5 smind44

smind44
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:10:23 PM

Posted 10 May 2013 - 05:34 PM

I downloaded and ran the FixIt msi from that link, but the Security Client directory is still in my Program Files.  I also ran regedit and looked for the registry keys mentioned in that article...  I can't find anythign relating to Microsoft Security Essentials in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run or HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current version\Uninstall\

 

I don't think I want to manually delete those folders (that's what rmdir does, right?), but I did try to look inside them from the Command Prompt by typing (cd\program files\microsoft security client\drivers) and it says "The File cannot be accessed by the system"... basically the same thing it says when I try to open it from explorer.



#6 firestormerc

firestormerc

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:23 PM

Posted 10 May 2013 - 11:18 PM

Yes, rmdir does delete the drivers folder not any other folders. Download CCleaner and install it. Once installed double click it to open up CCleaner. Click Registry on the left side and then click Scan for issues. Now once it finds some issues click Fix all selected issues. Note: You do not need to create a back up of your registry. Do this until nothing shows up when you click Scan for Issues. Now try to reinstall MSE.


Edited by firestormerc, 10 May 2013 - 11:19 PM.


#7 InadequateInfirmity

InadequateInfirmity

    I Gots Me A Certified Edumication


  • Banned
  • 5,180 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:23 PM

Posted 11 May 2013 - 06:02 AM

Bad idea on not creating the backup for the registry you would at least need to do that if you are going to toy with the registry and I doubt that it will help at all anyway.

 

I would suggest creating a new admin profile and installing MSE from there if no dice then there may be a bigger issue here and I suggest following up in the malware removal forums as you should not be running combofix alone anyways. 


Edited by InadequateInfirmity, 11 May 2013 - 06:03 AM.


#8 firestormerc

firestormerc

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:23 PM

Posted 11 May 2013 - 06:39 AM

It is not a bad idea because CCleaner is looking for useless registry issues. Some files to MSE are corrupted and need to be removed. CCleaner will find those types of files in the registry and allow you to fix them. I have been around computers my whole life and took classes for them. I know what I am talking about.



#9 smind44

smind44
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:10:23 PM

Posted 11 May 2013 - 08:07 PM

InadequateInfirmity:  I tried installing MSE under a new admin profile, and got the same error. 

 

Firestormerc: I tried CCleaner and it found a few issues with Microsoft Security Client, so I let it fix them, but agin there's no change.

 

I guess I can try the malware help forums.  Will they be able to help me if I've already used Combofix?



#10 InadequateInfirmity

InadequateInfirmity

    I Gots Me A Certified Edumication


  • Banned
  • 5,180 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:23 PM

Posted 11 May 2013 - 08:49 PM

They should be able to assist you,ask a mod to move your thread.



#11 Queen-Evie

Queen-Evie

    Official Bleepin' G.R.I.T.S. (and proud of it)


  • Members
  • 16,485 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:My own little corner of the universe (somewhere in Alabama). It's OK, they know me here
  • Local time:09:23 PM

Posted 13 May 2013 - 05:55 PM

Yes, rmdir does delete the drivers folder not any other folders. Download CCleaner and install it. Once installed double click it to open up CCleaner. Click Registry on the left side and then click Scan for issues. Now once it finds some issues click Fix all selected issues. Note: You do not need to create a back up of your registry. Do this until nothing shows up when you click Scan for Issues. Now try to reinstall MSE.

 
 

It is not a bad idea because CCleaner is looking for useless registry issues. Some files to MSE are corrupted and need to be removed. CCleaner will find those types of files in the registry and allow you to fix them. I have been around computers my whole life and took classes for them. I know what I am talking about.

 
You are not the only one who has been around computers for a long time. Not all of us took classes but we also know what we are talking about. Taking classes does not make one any smarter or better than someone who has not taken computer classes. Sometimes experience is a much better teacher. What happens in the real world often bears no resemblence to what was learned in a classroom.

Having said that:
 
Bleeping Computer does not endorse the use of ANY registry cleaner, which also includes registry cleaners in tools such as CCleaner.
 
It is also the policy of Bleeping Computer to advise backing up the registry if a registry cleaner is suggested. It doesn't matter if it's CCleaner or a program dedicated solely to registry cleaning or changing only one setting in the registry.
 
Sometimes mistakes happen and with a back up it can be easily reversed.
 
For future reference here is the Bleeping Computer official policy:

Bleeping Computer DOES NOT recommend the use of registry cleaners/optimizers for several reasons:
  • Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.
  • The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
  • Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
  • Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
  • Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
  • The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".
Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.Please do not try to argue the point in this topic as it detracts from the main goal which is helping smind44 with malware removal. You have already detracted from that by arguing with InadequateInfirmity.

To smind44 I apologize for the fact that this has taken place in your topic. Hopefully it will stay on track now and you will get the help you deserve.

Edited by Queen-Evie, 13 May 2013 - 07:53 PM.


#12 firestormerc

firestormerc

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:23 PM

Posted 13 May 2013 - 09:13 PM

I am sorry smind44 and InadequateInfirmity.



#13 CheeseyFace

CheeseyFace

  • Members
  • 77 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:23 PM

Posted 01 June 2013 - 05:55 PM

I have this same exact problem and it happened about 5/14/13.

My system is XP Pro sp3.

Has there been any resolution here?

 

I also used MalWareBytes which found one or two bad files like 1416.exe.

I installed WRSA which did nothing useful but hang up my system,

locking FF and explorer which required a process kill,  and cause BSOD with WRKRN.SYS

I found more with the file search tool Where'sMyStuff at Smoothduck.com :

142.exe, 142F.exe, 142C.exe., 1412.exe

This can search by type and date and I found several files that way.

Very useful since it found files AV products did not.

Still did not fix problem.

 

Cannot install MSE and cannot remove Microsoft Security Client folder in Program Files due to "not empty".

There are 3 folders in there: drivers, backup and en-us. These cannot be removed and get error "this folder not empty";

cannot view, get error:"the file cannot be accessed by the system."

Copied these 3 folders to a FAT32 USB stick and could view folders, which were empty. Used disk props to discover

that these 3 folders occupy ~ 100k of storage.

Found out these were junction folders; used junction tool from sys internals to view contents/delete but no go.

Thought re-install problem for MSE may be due to residual folders described here.

Also cannot install ZA, 2006 version 6.5.700.0.

 

Any help would be much appreciated as I have suspended all  work on this box and it is my main one.



#14 smind44

smind44
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:10:23 PM

Posted 01 June 2013 - 08:13 PM

CheesyFace:  No, I haven't completely solved this problem.  I haven't been home much the past couple of weeks, so I put this computer stuff on the back burner.  I don't see any sign of malware on my machine, but I can't install MSE.    I've been running the system without any antivirus, and although I haven't run into any further malware problems, I know this is risky... so I will probably just wipe the system clean and reinstall Windows once I have the time to back up my stuff.  Sorry I couldn't be more helpful.



#15 CheeseyFace

CheeseyFace

  • Members
  • 77 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:23 PM

Posted 01 June 2013 - 09:28 PM

Smind:

This is very bad for us.

I do not wish to go that route as I spent 30+ hours last Dec rebuilding this new box after partial and ongoing disk failure on old box.

I'll wait to see if anyone comes up with a fix and let you know if I do.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users