MSE is gone

[joe53]

Help.

I have lost my AV, MSE.  Can't install /uninstall any version of it. I have no resaon to suspect malware infection, but I need direction. Presently I have no AV. (This is very humbling for me}.

[Hoov]

Have you looked in your event viewer log to see if you have a disk problem? Are the folders for MSE still there? Have you tried installing another AV just until you get this resolved?

Try doing a clean boot of windows and see if you can start it that way.

[1972vet]

If it weren't you Joe, I'd attempt to walk you through the steps, but I am familiar with your outstanding skill level. I'm also fully aware you are as good friends with google as we all are so...I'll point you to one of the more likely candidates for resolution that I found Here and wait to hear back from you as to the results.

I'm sure you'll fill us in as to exactly what works for you...but in the meantime, I'll suggest that one thing I suspect is perhaps conflicting remnants of old (other) antivirus products that may have been left behind from the uninstall which got caught up in a tangle with one of Microsoft's latest updates to MSE. That's my gut feeling since I also would be of the opinion that yours isn't malware related.

MSE's scan engine is so deeply imbedded that any remnant of some other a/v product could cause issues. It's for this reason that it's so strongly recommended to uninstall whatever a/v product is on board before installing MSE.

Also, I know that you know that too Joe, but it should be said for other readers since I'm quite certain folks would find this thread.

[1972vet]

Since I brought it up, for those who now may think that some old remnant might still be hanging around on their system and would like to know how to remove it(them), follow these instructions:

To find out if there are any drivers left behind from some failed uninstall string(s):

1) Open the "Start" menu and choose "Run..."
2) Type cmd in the run box and click "ok".
3) At the cmd prompt, type or copy and paste:
set devmgr_show_nonpresent_devices=1

...and press enter. (Note that nothing seems to happen--this is expected. We are actually setting an environment variable which is going to help us to see hidden devices)
4) On the next cmd prompt line, type in:
devmgmt.msc
...and press enter. This will launch the Windows Device Manager Console.
5) In the Device Manager Console, from the "View" menu, select "Show Hidden Devices".

Note:
This is NOT the same as just selecting 'Show Hidden Devices' from within the menu of the normal default view in device manager. This method exposes the super hidden drivers/devices from having changed the environment variable.

Now, scroll down to and click  "Non-Plug and Play Drivers" in the listing. You will see not only the items that Windows currently detects as installed on your pc (these are the usual items displayed), but you will also see drivers, devices, and services which have been loaded in the past but were not uninstalled (properly) or are not currently started.

These are identified by those drivers listed which appear to be grayed out...

Make note of which drivers you see there that are grayed out. Research those items to help you determine what they are and if you need to keep them. If you find they belong to some program, specifically some antivirus program, that you KNOW you have already uninstalled then you can right-click that driver and select "Uninstall".

Also, if you happen to notice anything (from any other category other than "non-plug and play drivers") that has an exclamation mark or question mark next to it you might want to take the opportunity here and research those as well to find out why the question mark or exclamation mark is there. Those indicate a problem with those drivers. Your event viewer will tell you  more about them.

Last thing, if you accidentally exit the Device Manager Console before you finish your review of these items, you will need to start over again at the cmd prompt in order to re-set the environment variable.

To close the cmd prompt window, type exit then press the "Enter" key. When you finish, if you indeed found one or more that you uninstalled you should reboot, if Windows hasn't already prompted you...in order for Windows to properly record the changes to the hard disk. This also ensure the best "Last know configuration that worked" will be recorded to the disk in the event you may need it so that you won't have to go through this again.

[Bugbatter]

Joe, just a thought... Did you use this system for doing any testing of other security products lately?

[joe53]

Thanks everyone.

I'm in the middle of doing my tax return, and can't investigate this further at this time.

I can say I was able to roll my system back a bit (using Acronis TI from a recent image on an external HD) and was able to uninstall MSE 2.1, and I find no MSE files or folders on my XP system. Still can't install a fresh downloaded copy of the MSE 4.0. Windows Disk Manager reports all my drives as "healthy".

I haven't installed any new security programs for evaluation since this happened, and my MBAM Pro  still scans clean.

Event Viewer is reporting some warnings/errors about .Net Runtime (a perennial headache for me!) which I will follow up when I find the time. I did have to re-download some critical .Net updates from MSU after restoring.

I'll consider this an opportunity to test all my other layers of security in the meantime, and will report back when I sort this out.

[Hoov]

Try downloading Windows Installer Cleanup and see if it finds part of MSE that was left behind. I know it is no longer supported, but it might be able to get rid of the problem.

As for dotnet, I have had really good luck using the .Net Framework Update tool. Basically you use the tool to uninstall all the dotnet installs, then you install them all over again.

[kevinf80]

Microsoft have procedure available to completely remove MSE:

http://support.microsoft.com/kb/2435760

[joe53]

Follow-up:

Kevin - you are da man!  I ran the program from your link, and it deleted some remnants of MSE on my XP/sp3 box. Afterwards 4.0 installed quickly. Initially it would not run in real-time, but after a re-boot I was good to go. My sincere thanks.

In retrospect, my original mistake was to install MSE 4.0 on top of 2.1. Not a good move on a 7 year old system with a gazillion updates and patches!

But at least I found I could survive 2 days without a resident AV.

Thanks again to all who responded.

[1972vet]

Glad you got it sorted...just to be clear though for other readers, the link I provided in post #2 does the same thing.
Techlogon =  "How To Uninstall MSE If Normal Uninstallation Fails"
Microsoft stuff =  How to manually uninstall Microsoft Security Essentials 1.0.1963 if you cannot uninstall it by using the Add or Remove Programs item.
...I just wasn't sure anymore, if those "fix-it" buttons still work. I know when MS started out with them, they were fine but many of them went dark since the beta program was terminated so...I posted the manual removal the tech folks translated from that. Those uninstall codes do the same thing as the automated removal, just using the command prompt instead.