Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Need help reinstalling MS Security Essentials


  • Please log in to reply
20 replies to this topic

#1 Kassel

Kassel

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:09:58 AM

Posted 26 March 2014 - 07:34 AM

Hello!

 

I have a problem with my Windows 7 64-bit installed laptop: microsoft security essentials stopped working properly, tried uninstalling&installing and i keep getting an error:

 

"Cannot complete the Security Essentials installation.

 

An error....

 

 

Error code: 0x80070645"

 

I must say that I've tried all the solutions found on google by searching for this error code; none of them worked.

I've investigated the problem a bit and i think the problem is that I can't delete the NisSrv key(which appears to be corrupted) from the registry.

 

 

Any ideeas?



BC AdBot (Login to Remove)

 


#2 JohnC_21

JohnC_21

  • Members
  • 22,923 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:58 AM

Posted 26 March 2014 - 08:41 AM

Hello, and welcome to Bleeping Computer

 

Try the steps here. Starting with the Fixit Uninstaller tool and then the batch file if the Fixit does not work.


Edited by JohnC_21, 26 March 2014 - 08:42 AM.


#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:58 AM

Posted 26 March 2014 - 08:25 PM

Uninstalling Microsoft Security Essentials by Stephen Boots last updated 01/12/2014 supersedes the above.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 Kassel

Kassel
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:09:58 AM

Posted 26 April 2014 - 08:03 AM

hey, guys!

 

tried all the solutions, still the same error message.

 

any other ideea?



#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:58 AM

Posted 26 April 2014 - 10:10 AM

There is a Microsoft Fix it solution (step 3) for removing all MSE registry subkeys in Article ID: 2635095 related to Error: 0x80070645.

All other known solutions I am aware of are included by Stephen Boots in his Uninstall topic.

If none of those solutions work, then you may want to consider just replacing MSE with another anti-virus program.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 Kassel

Kassel
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:09:58 AM

Posted 26 April 2014 - 12:56 PM

i've vound a registry key which i can't delete:

 

HKLM\software\microsoft\microsoft antimalware setup

 

it gives me the following error: "cannot delete microsoft antimalware setup: error while deleting key"

 

could that be the reason MSSE fails to install?



#7 Kassel

Kassel
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:09:58 AM

Posted 26 April 2014 - 01:07 PM

wow, got over that error! i've deleted the "26D13F39948E1D546B0106B5539504D9" entry in my registry (hkl\installer\upgradecodes & hklm\software\microsoft\windows\currentversion\upgradecodes)

 

now i get 0x80070643 instead :|

 

Later edit:

 

tried a startup with the "load startup items" and all the non-microsoft services unchecked, still nothing.

 

it seems i can't delete the following file: C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl

 

i've also noticed that system restore doesn't work.


Edited by Kassel, 26 April 2014 - 01:42 PM.


#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:58 AM

Posted 26 April 2014 - 03:55 PM

0x80070643 is an installation error sometimes seen when installing applications on Windows such as .NET Framework, Internet Explorer, and Windows Defender as well as MSE. Microsoft released this support article indicating Error 0x80070643 was related to Windows Firewall being turned off.

I found a few more troubleshooting links.

Unofficial Repair Microsoft Security Essentials with Fix MSE Utility
Repair Microsoft Security Essentials with Fix MSE Utility

Note: The Fix MSE Utility will restore all registry values & service settings to known good defaults, without re-installing MSE. This tool is not certified by Microsoft.

I can't install Microsoft Security Essentials
Trouble Reinstalling MS Security Essentials
Troubleshooting a Failed Microsoft Security Essentials Install - Error Code 0x80070643

What is wrong with system restore?...You need to be specific.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:04:58 PM

Posted 26 April 2014 - 04:02 PM

Hello -

I found 2 options for this problem. No guarantees, but both seem to have worked for the people -

 

Method 1 (provided from a private person)

Do you mean the oobeldr ?

This procedure appears to solve the issue.

It MUST be done Exactly by the Steps.

 

1. FIRST : DISABLE the Microsoft Antimalware Service How To Temporarily Disable Your Anti-virus
2. REBOOT the machine
3. NOW : DELELETE the EppOobe.etl File
 (Reference Path) C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl
4. REBOOT the machine
5. ENABLE the Microsoft Antimalware Service
6. REBOOT the machine
7. Frequently CHECK the Administrative Events Log under Custom Views to ensure the error does not reappear.
NOTE: Just Deleting the EppOobe.etl file and Rebooting will NOT work.

 

 

 

Method 2 (provided from M/soft forums)

Go to C:\ProgramData\Microsoft\Microsoft Security Essentials\Support and delete MSSEOOBE.etl and Reboot.
After reboot this file should be recreated and the error should be gone.
I have found that when you delete MSE this folder remains and the files get updated when you run MSE.
It looks like the one file was not updating properly and causing the failure.
After it was working I did another test.

I deleted MSE and also all the files in the Support directory.
I then reinstalled MSE and everything is still fine.
If you look at the error under Detail it will point to this file.



#10 Kassel

Kassel
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:09:58 AM

Posted 26 April 2014 - 04:14 PM

@noknojon

i have no service named ms security essentials or microsoft antimalware.

when i try to delete that file it gives me no error, but it doesn't get deleted, neither.

 

@quietman7

 

tried all those solutions, still no effect.

when i try to restore it says the restore couldn't be completed.

i will try later another restore just to show you a more specific error.



#11 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:58 AM

Posted 26 April 2014 - 04:23 PM

Were you having any malware issues when all this started?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#12 Kassel

Kassel
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:09:58 AM

Posted 27 April 2014 - 03:14 PM

Were you having any malware issues when all this started?

 

i don't think so, haven't found any infection on my computer.

 

this all started with a broken update from MS which caused the MSSE to stop working

 

i can try to investigate this with your assistance, if you want to...


Edited by Kassel, 27 April 2014 - 03:14 PM.


#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:58 AM

Posted 27 April 2014 - 03:47 PM

Ok. Let's do some quick checks for malware.

Please download and use the following tools (in the order listed) which will search for and remove many potentially unwanted programs (PUPs), adware, toolbars, browser hijackers, extensions, add-ons and other junkware as well as related registry entries (values, keys) and remnants.

RKill created by Grinler (aka Lawrence Abrams), the site owner of BleepingComputer.
AdwCleaner created by Xplode.
Junkware Removal Tool created by thisisu.

1. Double-click on RKill to launch the tool. A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully. A log file will be created and saved to the root directory, C:\RKill.log. Copy and paste the contents of RKill.log in your next reply.

Important: Do not reboot your computer until you complete the next step.

2. Double-click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • After reviewing the log, click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.
-- Note: The contents of the AdwCleaner log file may be confusing. Unless you see a program name that you recognize and know should not be removed, don't worry about it. If you see an entry you want to keep, return to AdwCleaner before cleaning...all detected items will be listed (and checked) in each tab. Click on and uncheck any items you want to keep (except you cannot uncheck Chrome and Firefox preferences lines).


Close all open programs and shut down any protection/security software to avoid potential conflicts.

3. Double-click on JRT.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log file named JRT.txt will automatically open and be saved to your Desktop.
  • Copy and paste the contents of JRT.txt in your next reply.
.
4. As a final step, download, install and perform a THREAT SCAN with Malwarebytes Anti-Malware 2.0.
Be sure to print out and follow these instructions. When done, please post the complete results of your Malwarebytes scan for review.

To retrieve the Malwarebytes Anti-Malware 2.0 scan log information (Method 1)
  • Open Malwarebytes Anti-Malware.
  • Click the History Tab at the top and select Application Logs.
  • Select (check) the box next to Scan Log. Choose the most current scan.
  • Click the View button.
To retrieve the Malwarebytes Anti-Malware 2.0 scan log information (Method 2)
  • Open Malwarebytes Anti-Malware.
  • Click the Scan Tab at the top.
  • Click the View detailed log link on the right..
Click Copy to Clipboard at the bottom...come back to this thread, click Add Reply, then right-click and choose Paste.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#14 Kassel

Kassel
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:09:58 AM

Posted 27 April 2014 - 04:58 PM

ok, here we go:

 

 

Rkill 2.6.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 04/27/2014 11:51:30 PM in x64 mode.
Windows Version: Windows 7 Ultimate Service Pack 1

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * No malware processes found to kill.

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * Windows Defender Disabled

   [HKLM\SOFTWARE\Microsoft\Windows Defender]
   "DisableAntiSpyware" = dword:00000001

 * Windows Firewall Disabled

   [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
   "EnableFirewall" = dword:00000000

Checking Windows Service Integrity:

 * Windows Defender (WinDefend) is not Running.
   Startup Type set to: Manual

Searching for Missing Digital Signatures:

 * No issues found.

Checking HOSTS File:

 * HOSTS file entries found:

  127.0.0.1       localhost
  127.0.0.1       uac.advertising.com
  127.0.0.1       ads.yahoo.com

Program finished at: 04/27/2014 11:52:52 PM
Execution time: 0 hours(s), 1 minute(s), and 21 seconds(s)
 

 

 

# AdwCleaner v3.204 - Report created 27/04/2014 at 23:55:59
# Updated 26/04/2014 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : dv7 - HP
# Running from : C:\Users\dv7\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\avg-secure-search-installer_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\avg-secure-search-installer_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\IGearSettings
Key Deleted : HKLM\Software\Conduit

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16496


-\\ Mozilla Firefox v28.0 (en-US)

[ File : C:\Users\dv7\AppData\Roaming\Mozilla\Firefox\Profiles\cd2jl6k1.default\prefs.js ]

Line Deleted : user_pref("extensions.proxytool.referers", "www.google.com,google.com,yahoo.com,bing.com,ask.com,currate.com,alwaysmath.com,facebook.com,twitter.com,craigslist.org");

-\\ Google Chrome v34.0.1847.116

[ File : C:\Users\dv7\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
Deleted [Search Provider] : hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&ctid=CT3220468
Deleted [Search Provider] : hxxp://dts.search-results.com/sr?src=crb&gct=ds&appid=390&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=9635101020504756&q={searchTerms}
Deleted [Search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms}
Deleted [Startup_urls] : hxxp://search.conduit.com/?ctid=CT3220468&SearchSource=48
Deleted [Startup_urls] : hxxp://www.searchnu.com/406

*************************

AdwCleaner[R0].txt - [3028 octets] - [27/04/2014 23:53:22]
AdwCleaner[S0].txt - [2885 octets] - [27/04/2014 23:55:59]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2945 octets] ##########
 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Ultimate x64
Ran by dv7 on Mon 04/28/2014 at  0:00:21.85
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\dv7\AppData\Roaming\mozilla\firefox\profiles\cd2jl6k1.default\minidumps [49 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 04/28/2014 at  0:08:01.79
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

 

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/28/2014
Scan Time: 12:46:16 AM
Logfile:
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.04.27.05
Rootkit Database: v2014.03.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Chameleon: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: dv7

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 246588
Time Elapsed: 11 min, 53 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)



#15 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:58 AM

Posted 27 April 2014 - 05:04 PM

Nothing of significant concern showing in your log(s)...so the issue does not appear to be anything malware related.

I don't have any other suggestions other than replacing MSE with another anti-virus.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users