Defender (1.1.1347) says: update - new version available.

I download the new version. On install it unpacks, validates, gets agreement
on license, checks validity, and starts install.
At the first step it fails on trying to uninstall the old version. It
complains that it cannot find the .msi file;
C:\Documents..\user\Locals..\IXP000.TMP\
".. show path to WindowsDefender.msi"
And then,
"The older version of Windows Defender cannot be uninstalled. Contact
your support group."

Trying to uninstall from control panel also fails.

I did all pending windows-update's.

Trying doing a system restore using a restore point prior to the update
attempt. See if you can do a clean uninstall (not update!) of the 1347
level. I assume you are Windows XP.

"guthrie" wrote:

> Defender (1.1.1347) says: update - new version available.
>
> I download the new version. On install it unpacks, validates, gets agreement
> on license, checks validity, and starts install.
> At the first step it fails on trying to uninstall the old version. It
> complains that it cannot find the .msi file;
> C:\Documents..\user\Locals..\IXP000.TMP\
> ".. show path to WindowsDefender.msi"
> And then,
> "The older version of Windows Defender cannot be uninstalled. Contact
> your support group."
>
> Trying to uninstall from control panel also fails.
>
> I did all pending windows-update's.

"Mr Cat" wrote:

> Trying doing a system restore using a restore point prior to the update
> attempt. See if you can do a clean uninstall (not update!) of the 1347
> level. I assume you are Windows XP.
>
-- I just did a complete backup recovery of the system (converted from FAT32
to NTFS), and installed a bunch of updates, so am reluctant to try to
rollback system, even if I could.

Yes, XP Pro SP2.

I noted that uninstall fails, also wants the find the original .msi file...

Seems like if I could get an install for it, it would be able to uninstall
from that .msi.


> "guthrie" wrote:
>

I understand. First goto Control Panel, Performance and Maintenance,
Adminstrative Tools, Services - Stop the Windows Defender Service, then right
click the Windows Defender Service and click properties and then disable the
service (under startup type) and reboot. Next delete the folder Windows
Defender under Program Files. Next delete the folder Windows Defender under
Documents and Settings/All Users/Application Data/Microsoft and delete the
folder Windows Defender under Document and Settings/your logon id/Local
Settings/Application Data/Microsoft. Remove the current signature file. To
do this, click Start, click Run, type Msiexec /x
{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}, and then click OK.
After you perform the above download Ccleaner (ccleaner.com) and install
without the Yahoo toolbar option. Click the Ccleaner Issues Icon and then
scan for issues and fix issues until no problems found - no need to backup
registry entries if you take a System Restore point first. Check add/remove
programs to see if there is still an entry for Windows Defender (at this
point it should be gone). If it is not gone, then use Ccleaner Tools to
delete the installer entry.

Since you are cleaning up registry entries with Ccleaner, you might want to
run Windows Live OneCare and do the "broom" cleanup as well. Make sure you
go to Windows/Microsoft Update and use Express to check for any updates.
Take a restore point and now download the latest version 1.1.1593.0 of
Windows Defender. If you have any questions, let me know. Good luck.



"guthrie" wrote:

>
>
> "Mr Cat" wrote:
>
> > Trying doing a system restore using a restore point prior to the update
> > attempt. See if you can do a clean uninstall (not update!) of the 1347
> > level. I assume you are Windows XP.
> >
> -- I just did a complete backup recovery of the system (converted from FAT32
> to NTFS), and installed a bunch of updates, so am reluctant to try to
> rollback system, even if I could.
>
> Yes, XP Pro SP2.
>
> I noted that uninstall fails, also wants the find the original .msi file...
>
> Seems like if I could get an install for it, it would be able to uninstall
> from that .msi.
>
>
> > "guthrie" wrote:
> >

I have had similar problem as 'guthrie' and followed your instructions,
But I have come up against a couple of problems. Can you help.

I have deleted the Windows Defender folders as mentioned, except the folder
in 'C:\Program Files' a box appeared indicating 'unable to delete file
'MpShHook.dll' as it is in use. I then moved this file to 'C:\Program Files',
and i was then able to delete the folder '(C:\Program Files\Windows
Defender)', but i still cannot delete 'MpShHook.dll' from its new location.

I then attempted to remove 'Msiexec' as instructed, but was unable to do
this, a box indicated 'The installed product does not match the installation
source(s). Until a matching scource is provided or the installed product and
source are synchronized, this action can not be performed.

When i selected 'ok' a message appears.... The path 'C:\Program
Files\Windows Defender\AS_Sigs.MSI' cannot be found. Verify that you have
access to this location and try again, or try to find the installation
package 'AS_Sigs.MSI' in a folder from which you can install the product
Windows Defender Signatures.

The source of this file is (C:\Program Files\Windows Defender\), which i
have just deleted.
I then restored the deleted folder and files, moved the file 'AS_Sigs.MSI'
to 'C:\Program Files'. then deleted 'C:\Program Files\Windows Defender',
again.

I then attepted to remove 'Msiexec' again, and browsed to the new location,
only to be confronted with same problem when i first attepted to remove this
file. i feel this file has been corrupted and cannot be used.

i Have xp home edition with sp2, windows defender ver 1.1.1347.0

"Mr Cat" wrote:

> I understand. First goto Control Panel, Performance and Maintenance,
> Adminstrative Tools, Services - Stop the Windows Defender Service, then right
> click the Windows Defender Service and click properties and then disable the
> service (under startup type) and reboot. Next delete the folder Windows
> Defender under Program Files. Next delete the folder Windows Defender under
> Documents and Settings/All Users/Application Data/Microsoft and delete the
> folder Windows Defender under Document and Settings/your logon id/Local
> Settings/Application Data/Microsoft. Remove the current signature file. To
> do this, click Start, click Run, type Msiexec /x
> {A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}, and then click OK.
> After you perform the above download Ccleaner (ccleaner.com) and install
> without the Yahoo toolbar option. Click the Ccleaner Issues Icon and then
> scan for issues and fix issues until no problems found - no need to backup
> registry entries if you take a System Restore point first. Check add/remove
> programs to see if there is still an entry for Windows Defender (at this
> point it should be gone). If it is not gone, then use Ccleaner Tools to
> delete the installer entry.
>
> Since you are cleaning up registry entries with Ccleaner, you might want to
> run Windows Live OneCare and do the "broom" cleanup as well. Make sure you
> go to Windows/Microsoft Update and use Express to check for any updates.
> Take a restore point and now download the latest version 1.1.1593.0 of
> Windows Defender. If you have any questions, let me know. Good luck.
>
>
>
> "guthrie" wrote:
>
> >
> >
> > "Mr Cat" wrote:
> >
> > > Trying doing a system restore using a restore point prior to the update
> > > attempt. See if you can do a clean uninstall (not update!) of the 1347
> > > level. I assume you are Windows XP.
> > >
> > -- I just did a complete backup recovery of the system (converted from FAT32
> > to NTFS), and installed a bunch of updates, so am reluctant to try to
> > rollback system, even if I could.
> >
> > Yes, XP Pro SP2.
> >
> > I noted that uninstall fails, also wants the find the original .msi file...
> >
> > Seems like if I could get an install for it, it would be able to uninstall
> > from that .msi.
> >
> >
> > > "guthrie" wrote:
> > >

Thank you for bringing this to my attention. I'm still living in the past
regarding some of the early versions of the Windows Defender Beta. The issue
of the dll had been brought up by another user. To resolve:

http://ccollomb.free.fr/unlocker/

Forget about the MSIEXEC issue.

After deleting the dll, reboot. Do the Ccleaner stuff and give it a try.
If successful or any other problems, please let me know. Thanks.

"bigbear" wrote:

> I have had similar problem as 'guthrie' and followed your instructions,
> But I have come up against a couple of problems. Can you help.
>
> I have deleted the Windows Defender folders as mentioned, except the folder
> in 'C:\Program Files' a box appeared indicating 'unable to delete file
> 'MpShHook.dll' as it is in use. I then moved this file to 'C:\Program Files',
> and i was then able to delete the folder '(C:\Program Files\Windows
> Defender)', but i still cannot delete 'MpShHook.dll' from its new location.
>
> I then attempted to remove 'Msiexec' as instructed, but was unable to do
> this, a box indicated 'The installed product does not match the installation
> source(s). Until a matching scource is provided or the installed product and
> source are synchronized, this action can not be performed.
>
> When i selected 'ok' a message appears.... The path 'C:\Program
> Files\Windows Defender\AS_Sigs.MSI' cannot be found. Verify that you have
> access to this location and try again, or try to find the installation
> package 'AS_Sigs.MSI' in a folder from which you can install the product
> Windows Defender Signatures.
>
> The source of this file is (C:\Program Files\Windows Defender\), which i
> have just deleted.
> I then restored the deleted folder and files, moved the file 'AS_Sigs.MSI'
> to 'C:\Program Files'. then deleted 'C:\Program Files\Windows Defender',
> again.
>
> I then attepted to remove 'Msiexec' again, and browsed to the new location,
> only to be confronted with same problem when i first attepted to remove this
> file. i feel this file has been corrupted and cannot be used.
>
> i Have xp home edition with sp2, windows defender ver 1.1.1347.0
>
> "Mr Cat" wrote:
>
> > I understand. First goto Control Panel, Performance and Maintenance,
> > Adminstrative Tools, Services - Stop the Windows Defender Service, then right
> > click the Windows Defender Service and click properties and then disable the
> > service (under startup type) and reboot. Next delete the folder Windows
> > Defender under Program Files. Next delete the folder Windows Defender under
> > Documents and Settings/All Users/Application Data/Microsoft and delete the
> > folder Windows Defender under Document and Settings/your logon id/Local
> > Settings/Application Data/Microsoft. Remove the current signature file. To
> > do this, click Start, click Run, type Msiexec /x
> > {A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}, and then click OK.
> > After you perform the above download Ccleaner (ccleaner.com) and install
> > without the Yahoo toolbar option. Click the Ccleaner Issues Icon and then
> > scan for issues and fix issues until no problems found - no need to backup
> > registry entries if you take a System Restore point first. Check add/remove
> > programs to see if there is still an entry for Windows Defender (at this
> > point it should be gone). If it is not gone, then use Ccleaner Tools to
> > delete the installer entry.
> >
> > Since you are cleaning up registry entries with Ccleaner, you might want to
> > run Windows Live OneCare and do the "broom" cleanup as well. Make sure you
> > go to Windows/Microsoft Update and use Express to check for any updates.
> > Take a restore point and now download the latest version 1.1.1593.0 of
> > Windows Defender. If you have any questions, let me know. Good luck.
> >
> >
> >
> > "guthrie" wrote:
> >
> > >
> > >
> > > "Mr Cat" wrote:
> > >
> > > > Trying doing a system restore using a restore point prior to the update
> > > > attempt. See if you can do a clean uninstall (not update!) of the 1347
> > > > level. I assume you are Windows XP.
> > > >
> > > -- I just did a complete backup recovery of the system (converted from FAT32
> > > to NTFS), and installed a bunch of updates, so am reluctant to try to
> > > rollback system, even if I could.
> > >
> > > Yes, XP Pro SP2.
> > >
> > > I noted that uninstall fails, also wants the find the original .msi file...
> > >
> > > Seems like if I could get an install for it, it would be able to uninstall
> > > from that .msi.
> > >
> > >
> > > > "guthrie" wrote:
> > > >

If you are familiar with the registry, try this:

1. Start | Run ... regedit.exe
2. Open registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

3. Click on Edit | File and enter Defender and search
4. Locate value in right panel under InstallProperties for LocalPackage
5. Locate that file in C:\Windows\Installer
6. Double-click on the file (mine is 67239.msi - depends on version of
Beta)
7. You should get prompted for Reinstall or Remove option.

If you wish to use the MSIExec manner, locate the UninstallString or
ModifyPath in the same key, double-click on one of them, Copy the
information.

Then, Start | Run .... [PASTE Info], then click OK. Basically does the same
thing.

"guthrie" <(E-Mail Removed)> wrote in message
news:8FC9A2A9-95CA-484A-92B7-(E-Mail Removed)...
> Defender (1.1.1347) says: update - new version available.
>
> I download the new version. On install it unpacks, validates, gets
> agreement
> on license, checks validity, and starts install.
> At the first step it fails on trying to uninstall the old version. It
> complains that it cannot find the .msi file;
> C:\Documents..\user\Locals..\IXP000.TMP\
> ".. show path to WindowsDefender.msi"
> And then,
> "The older version of Windows Defender cannot be uninstalled. Contact
> your support group."
>
> Trying to uninstall from control panel also fails.
>
> I did all pending windows-update's.

I tried all of the above tricks and yet Windows Defender still showed up in
Add/Remove programs and I could not delete it or install another version. I
even had an older copy of the install msi file that i copied to my machine
and pointed the uninstall at it, but still the same message as the first post.

Finally I ran regedit and searched the entire registry for anything with
Defend in it. I deleted almost all such entries. There were a couple things
called windefend, safetydefend and udefender that I did not delete. This did
solve the problem and I was able to install the new version of windows
defender. You might hose your machine doing this especially if your fingers
slip and you delete the wrong thing...

btw, the way I deleted 'MpShHook.dll' was to start a cmd window, then start
the task manager and kill explorer.exe - then delete mpshhook.dll - the
explorer had a reference to it. If you happen to have tlist.exe, then run it
with tlist -m mpshook.dll to see which executables are referencing the dll,
then stop those executables and delete the dll. Next, restart explorer.exe
by cding to your windows directory ( c:\windows ) and run explorer.exe.

I hope someone comes up with a simpler solution. This is a bit crazy.


"NewScience" wrote:

> If you are familiar with the registry, try this:
>
> 1. Start | Run ... regedit.exe
> 2. Open registry key:
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products
>
> 3. Click on Edit | File and enter Defender and search
> 4. Locate value in right panel under InstallProperties for LocalPackage
> 5. Locate that file in C:\Windows\Installer
> 6. Double-click on the file (mine is 67239.msi - depends on version of
> Beta)
> 7. You should get prompted for Reinstall or Remove option.
>
> If you wish to use the MSIExec manner, locate the UninstallString or
> ModifyPath in the same key, double-click on one of them, Copy the
> information.
>
> Then, Start | Run .... [PASTE Info], then click OK. Basically does the same
> thing.
>
> "guthrie" <(E-Mail Removed)> wrote in message
> news:8FC9A2A9-95CA-484A-92B7-(E-Mail Removed)...
> > Defender (1.1.1347) says: update - new version available.
> >
> > I download the new version. On install it unpacks, validates, gets
> > agreement
> > on license, checks validity, and starts install.
> > At the first step it fails on trying to uninstall the old version. It
> > complains that it cannot find the .msi file;
> > C:\Documents..\user\Locals..\IXP000.TMP\
> > ".. show path to WindowsDefender.msi"
> > And then,
> > "The older version of Windows Defender cannot be uninstalled. Contact
> > your support group."
> >
> > Trying to uninstall from control panel also fails.
> >
> > I did all pending windows-update's.
>
>
>

Thanks Jiminy

I think I got the kinks out of my procedure. The best way seems to be a few
deletes from the registry first, deletion of the WD folders, Ccleaner and
then a new install of WD. Here goes:

Stop the WD Service and Disable it. Run Regedit and do a find on
MpShHook.dll .
There should be 2 entries for MpSHHook (ignore the SearchAssistant keys).
Delete the 2 entries for MpShHook (delete the primary key - not the subkey).
Under regedit, move the registry pointer back to the top and do a find on
Windows Defender. Only delete the keys (again, I only found 2 entries) for
My Computer\HKEY_Classes_Root\Installer\Products\.... and My
Computer\HKEY_Classes_Root\Products\... Now reboot. Windows Defender
should give an error message about it couldn't start - Press OK. Now do a
search on files with the name Windows Defender. You should be able to delete
the folder Windows Defender under Program Files and the folders Document and
Settings\All Users\Application Data\Microsoft\Windows Defender and Documents
and Settings\laccount name(s)\Local Settings\Application
Data\Microsft\Windows Defender. Also you can delete WindowsDefender.msi and
WindowsDefender.adm if present. Now go into Ccleaner. Click Issues and do 2
iterations of finding and fixing until no problems found. Next go back into
regedit and do a search on the version of WD to be deleted (for example
1.1.1593) and do a find on the version number and delete those registry keys.
Reboot. You should not see any entries in add/remove programs for Windows
Defender or the Signatures. You should now be ready to re-install the latest
version of Defender. Let me know. Sorry for the previous faulty
instructions.

"Jiminy" wrote:

> I tried all of the above tricks and yet Windows Defender still showed up in
> Add/Remove programs and I could not delete it or install another version. I
> even had an older copy of the install msi file that i copied to my machine
> and pointed the uninstall at it, but still the same message as the first post.
>
> Finally I ran regedit and searched the entire registry for anything with
> Defend in it. I deleted almost all such entries. There were a couple things
> called windefend, safetydefend and udefender that I did not delete. This did
> solve the problem and I was able to install the new version of windows
> defender. You might hose your machine doing this especially if your fingers
> slip and you delete the wrong thing...
>
> btw, the way I deleted 'MpShHook.dll' was to start a cmd window, then start
> the task manager and kill explorer.exe - then delete mpshhook.dll - the
> explorer had a reference to it. If you happen to have tlist.exe, then run it
> with tlist -m mpshook.dll to see which executables are referencing the dll,
> then stop those executables and delete the dll. Next, restart explorer.exe
> by cding to your windows directory ( c:\windows ) and run explorer.exe.
>
> I hope someone comes up with a simpler solution. This is a bit crazy.
>
>
> "NewScience" wrote:
>
> > If you are familiar with the registry, try this:
> >
> > 1. Start | Run ... regedit.exe
> > 2. Open registry key:
> >
> > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products
> >
> > 3. Click on Edit | File and enter Defender and search
> > 4. Locate value in right panel under InstallProperties for LocalPackage
> > 5. Locate that file in C:\Windows\Installer
> > 6. Double-click on the file (mine is 67239.msi - depends on version of
> > Beta)
> > 7. You should get prompted for Reinstall or Remove option.
> >
> > If you wish to use the MSIExec manner, locate the UninstallString or
> > ModifyPath in the same key, double-click on one of them, Copy the
> > information.
> >
> > Then, Start | Run .... [PASTE Info], then click OK. Basically does the same
> > thing.
> >
> > "guthrie" <(E-Mail Removed)> wrote in message
> > news:8FC9A2A9-95CA-484A-92B7-(E-Mail Removed)...
> > > Defender (1.1.1347) says: update - new version available.
> > >
> > > I download the new version. On install it unpacks, validates, gets
> > > agreement
> > > on license, checks validity, and starts install.
> > > At the first step it fails on trying to uninstall the old version. It
> > > complains that it cannot find the .msi file;
> > > C:\Documents..\user\Locals..\IXP000.TMP\
> > > ".. show path to WindowsDefender.msi"
> > > And then,
> > > "The older version of Windows Defender cannot be uninstalled. Contact
> > > your support group."
> > >
> > > Trying to uninstall from control panel also fails.
> > >
> > > I did all pending windows-update's.
> >
> >
> >

Mr Cat, good point on moving the registry pointer backup to the containing
key, rather than just deleting the subkey. I realized I forgot to mention
that when I wrote down what I did. Your solution looks good, with less
chance for costly errors - deleting the wrong key for example, and also
solves the locked dll that can't be deleted problem.

"Mr Cat" wrote:

> Thanks Jiminy
>
> I think I got the kinks out of my procedure. The best way seems to be a few
> deletes from the registry first, deletion of the WD folders, Ccleaner and
> then a new install of WD. Here goes:
>
> Stop the WD Service and Disable it. Run Regedit and do a find on
> MpShHook.dll .
> There should be 2 entries for MpSHHook (ignore the SearchAssistant keys).
> Delete the 2 entries for MpShHook (delete the primary key - not the subkey).
> Under regedit, move the registry pointer back to the top and do a find on
> Windows Defender. Only delete the keys (again, I only found 2 entries) for
> My Computer\HKEY_Classes_Root\Installer\Products\.... and My
> Computer\HKEY_Classes_Root\Products\... Now reboot. Windows Defender
> should give an error message about it couldn't start - Press OK. Now do a
> search on files with the name Windows Defender. You should be able to delete
> the folder Windows Defender under Program Files and the folders Document and
> Settings\All Users\Application Data\Microsoft\Windows Defender and Documents
> and Settings\laccount name(s)\Local Settings\Application
> Data\Microsft\Windows Defender. Also you can delete WindowsDefender.msi and
> WindowsDefender.adm if present. Now go into Ccleaner. Click Issues and do 2
> iterations of finding and fixing until no problems found. Next go back into
> regedit and do a search on the version of WD to be deleted (for example
> 1.1.1593) and do a find on the version number and delete those registry keys.
> Reboot. You should not see any entries in add/remove programs for Windows
> Defender or the Signatures. You should now be ready to re-install the latest
> version of Defender. Let me know. Sorry for the previous faulty
> instructions.
>
> "Jiminy" wrote:
>
> > I tried all of the above tricks and yet Windows Defender still showed up in
> > Add/Remove programs and I could not delete it or install another version. I
> > even had an older copy of the install msi file that i copied to my machine
> > and pointed the uninstall at it, but still the same message as the first post.
> >
> > Finally I ran regedit and searched the entire registry for anything with
> > Defend in it. I deleted almost all such entries. There were a couple things
> > called windefend, safetydefend and udefender that I did not delete. This did
> > solve the problem and I was able to install the new version of windows
> > defender. You might hose your machine doing this especially if your fingers
> > slip and you delete the wrong thing...
> >
> > btw, the way I deleted 'MpShHook.dll' was to start a cmd window, then start
> > the task manager and kill explorer.exe - then delete mpshhook.dll - the
> > explorer had a reference to it. If you happen to have tlist.exe, then run it
> > with tlist -m mpshook.dll to see which executables are referencing the dll,
> > then stop those executables and delete the dll. Next, restart explorer.exe
> > by cding to your windows directory ( c:\windows ) and run explorer.exe.
> >
> > I hope someone comes up with a simpler solution. This is a bit crazy.
> >
> >
> > "NewScience" wrote:
> >
> > > If you are familiar with the registry, try this:
> > >
> > > 1. Start | Run ... regedit.exe
> > > 2. Open registry key:
> > >
> > > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products
> > >
> > > 3. Click on Edit | File and enter Defender and search
> > > 4. Locate value in right panel under InstallProperties for LocalPackage
> > > 5. Locate that file in C:\Windows\Installer
> > > 6. Double-click on the file (mine is 67239.msi - depends on version of
> > > Beta)
> > > 7. You should get prompted for Reinstall or Remove option.
> > >
> > > If you wish to use the MSIExec manner, locate the UninstallString or
> > > ModifyPath in the same key, double-click on one of them, Copy the
> > > information.
> > >
> > > Then, Start | Run .... [PASTE Info], then click OK. Basically does the same
> > > thing.
> > >
> > > "guthrie" <(E-Mail Removed)> wrote in message
> > > news:8FC9A2A9-95CA-484A-92B7-(E-Mail Removed)...
> > > > Defender (1.1.1347) says: update - new version available.
> > > >
> > > > I download the new version. On install it unpacks, validates, gets
> > > > agreement
> > > > on license, checks validity, and starts install.
> > > > At the first step it fails on trying to uninstall the old version. It
> > > > complains that it cannot find the .msi file;
> > > > C:\Documents..\user\Locals..\IXP000.TMP\
> > > > ".. show path to WindowsDefender.msi"
> > > > And then,
> > > > "The older version of Windows Defender cannot be uninstalled. Contact
> > > > your support group."
> > > >
> > > > Trying to uninstall from control panel also fails.
> > > >
> > > > I did all pending windows-update's.
> > >
> > >
> > >