Defender update fails..

[Guest]

Defender (1.1.1347) says: update - new version available.

I download the new version. On install it unpacks, validates, gets agreement
on license, checks validity, and starts install.
At the first step it fails on trying to uninstall the old version. It
complains that it cannot find the .msi file;
C:\Documents..\user\Locals..\IXP000.TMP\
".. show path to WindowsDefender.msi"
And then,
"The older version of Windows Defender cannot be uninstalled. Contact
your support group."

Trying to uninstall from control panel also fails.

I did all pending windows-update's.

 

[Guest]

Trying doing a system restore using a restore point prior to the update
attempt. See if you can do a clean uninstall (not update!) of the 1347
level. I assume you are Windows XP.

 

[Guest]

Trying doing a system restore using a restore point prior to the update
attempt. See if you can do a clean uninstall (not update!) of the 1347
level. I assume you are Windows XP.

-- I just did a complete backup recovery of the system (converted from FAT32
to NTFS), and installed a bunch of updates, so am reluctant to try to
rollback system, even if I could.

Yes, XP Pro SP2.

I noted that uninstall fails, also wants the find the original .msi file...

Seems like if I could get an install for it, it would be able to uninstall
from that .msi.

 

[Guest]

I understand. First goto Control Panel, Performance and Maintenance,
Adminstrative Tools, Services - Stop the Windows Defender Service, then right
click the Windows Defender Service and click properties and then disable the
service (under startup type) and reboot. Next delete the folder Windows
Defender under Program Files. Next delete the folder Windows Defender under
Documents and Settings/All Users/Application Data/Microsoft and delete the
folder Windows Defender under Document and Settings/your logon id/Local
Settings/Application Data/Microsoft. Remove the current signature file. To
do this, click Start, click Run, type Msiexec /x
{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}, and then click OK.
After you perform the above download Ccleaner (ccleaner.com) and install
without the Yahoo toolbar option. Click the Ccleaner Issues Icon and then
scan for issues and fix issues until no problems found - no need to backup
registry entries if you take a System Restore point first. Check add/remove
programs to see if there is still an entry for Windows Defender (at this
point it should be gone). If it is not gone, then use Ccleaner Tools to
delete the installer entry.

Since you are cleaning up registry entries with Ccleaner, you might want to
run Windows Live OneCare and do the "broom" cleanup as well. Make sure you
go to Windows/Microsoft Update and use Express to check for any updates.
Take a restore point and now download the latest version 1.1.1593.0 of
Windows Defender. If you have any questions, let me know. Good luck.

 

[Guest]

I have had similar problem as 'guthrie' and followed your instructions,
But I have come up against a couple of problems. Can you help.

I have deleted the Windows Defender folders as mentioned, except the folder
in 'C:\Program Files' a box appeared indicating 'unable to delete file
'MpShHook.dll' as it is in use. I then moved this file to 'C:\Program Files',
and i was then able to delete the folder '(C:\Program Files\Windows
Defender)', but i still cannot delete 'MpShHook.dll' from its new location.

I then attempted to remove 'Msiexec' as instructed, but was unable to do
this, a box indicated 'The installed product does not match the installation
source(s). Until a matching scource is provided or the installed product and
source are synchronized, this action can not be performed.

When i selected 'ok' a message appears.... The path 'C:\Program
Files\Windows Defender\AS_Sigs.MSI' cannot be found. Verify that you have
access to this location and try again, or try to find the installation
package 'AS_Sigs.MSI' in a folder from which you can install the product
Windows Defender Signatures.

The source of this file is (C:\Program Files\Windows Defender\), which i
have just deleted.
I then restored the deleted folder and files, moved the file 'AS_Sigs.MSI'
to 'C:\Program Files'. then deleted 'C:\Program Files\Windows Defender',
again.

I then attepted to remove 'Msiexec' again, and browsed to the new location,
only to be confronted with same problem when i first attepted to remove this
file. i feel this file has been corrupted and cannot be used.

i Have xp home edition with sp2, windows defender ver 1.1.1347.0

 

[Guest]

Thank you for bringing this to my attention. I'm still living in the past
regarding some of the early versions of the Windows Defender Beta. The issue
of the dll had been brought up by another user. To resolve:

http://ccollomb.free.fr/unlocker/

Forget about the MSIEXEC issue.

After deleting the dll, reboot. Do the Ccleaner stuff and give it a try.
If successful or any other problems, please let me know. Thanks.

 

[NewScience]

If you are familiar with the registry, try this:

1. Start | Run ... regedit.exe
2. Open registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

3. Click on Edit | File and enter Defender and search
4. Locate value in right panel under InstallProperties for LocalPackage
5. Locate that file in C:\Windows\Installer
6. Double-click on the file (mine is 67239.msi - depends on version of
Beta)
7. You should get prompted for Reinstall or Remove option.

If you wish to use the MSIExec manner, locate the UninstallString or
ModifyPath in the same key, double-click on one of them, Copy the
information.

Then, Start | Run .... [PASTE Info], then click OK. Basically does the same
thing.

 

[Guest]

I tried all of the above tricks and yet Windows Defender still showed up in
Add/Remove programs and I could not delete it or install another version. I
even had an older copy of the install msi file that i copied to my machine
and pointed the uninstall at it, but still the same message as the first post.

Finally I ran regedit and searched the entire registry for anything with
Defend in it. I deleted almost all such entries. There were a couple things
called windefend, safetydefend and udefender that I did not delete. This did
solve the problem and I was able to install the new version of windows
defender. You might hose your machine doing this especially if your fingers
slip and you delete the wrong thing...

btw, the way I deleted 'MpShHook.dll' was to start a cmd window, then start
the task manager and kill explorer.exe - then delete mpshhook.dll - the
explorer had a reference to it. If you happen to have tlist.exe, then run it
with tlist -m mpshook.dll to see which executables are referencing the dll,
then stop those executables and delete the dll. Next, restart explorer.exe
by cding to your windows directory ( c:\windows ) and run explorer.exe.

I hope someone comes up with a simpler solution. This is a bit crazy.

If you are familiar with the registry, try this:

1. Start | Run ... regedit.exe
2. Open registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

3. Click on Edit | File and enter Defender and search
4. Locate value in right panel under InstallProperties for LocalPackage
5. Locate that file in C:\Windows\Installer
6. Double-click on the file (mine is 67239.msi - depends on version of
Beta)
7. You should get prompted for Reinstall or Remove option.

If you wish to use the MSIExec manner, locate the UninstallString or
ModifyPath in the same key, double-click on one of them, Copy the
information.

Then, Start | Run .... [PASTE Info], then click OK. Basically does the same
thing.

Defender (1.1.1347) says: update - new version available.

I download the new version. On install it unpacks, validates, gets
agreement
on license, checks validity, and starts install.
At the first step it fails on trying to uninstall the old version. It
complains that it cannot find the .msi file;
C:\Documents..\user\Locals..\IXP000.TMP\
".. show path to WindowsDefender.msi"
And then,
"The older version of Windows Defender cannot be uninstalled. Contact
your support group."

Trying to uninstall from control panel also fails.

I did all pending windows-update's.

 

[Guest]

Thanks Jiminy

I think I got the kinks out of my procedure. The best way seems to be a few
deletes from the registry first, deletion of the WD folders, Ccleaner and
then a new install of WD. Here goes:

Stop the WD Service and Disable it. Run Regedit and do a find on
MpShHook.dll .
There should be 2 entries for MpSHHook (ignore the SearchAssistant keys).
Delete the 2 entries for MpShHook (delete the primary key - not the subkey).
Under regedit, move the registry pointer back to the top and do a find on
Windows Defender. Only delete the keys (again, I only found 2 entries) for
My Computer\HKEY_Classes_Root\Installer\Products\.... and My
Computer\HKEY_Classes_Root\Products\... Now reboot. Windows Defender
should give an error message about it couldn't start - Press OK. Now do a
search on files with the name Windows Defender. You should be able to delete
the folder Windows Defender under Program Files and the folders Document and
Settings\All Users\Application Data\Microsoft\Windows Defender and Documents
and Settings\laccount name(s)\Local Settings\Application
Data\Microsft\Windows Defender. Also you can delete WindowsDefender.msi and
WindowsDefender.adm if present. Now go into Ccleaner. Click Issues and do 2
iterations of finding and fixing until no problems found. Next go back into
regedit and do a search on the version of WD to be deleted (for example
1.1.1593) and do a find on the version number and delete those registry keys.
Reboot. You should not see any entries in add/remove programs for Windows
Defender or the Signatures. You should now be ready to re-install the latest
version of Defender. Let me know. Sorry for the previous faulty
instructions.

I tried all of the above tricks and yet Windows Defender still showed up in
Add/Remove programs and I could not delete it or install another version. I
even had an older copy of the install msi file that i copied to my machine
and pointed the uninstall at it, but still the same message as the first post.

Finally I ran regedit and searched the entire registry for anything with
Defend in it. I deleted almost all such entries. There were a couple things
called windefend, safetydefend and udefender that I did not delete. This did
solve the problem and I was able to install the new version of windows
defender. You might hose your machine doing this especially if your fingers
slip and you delete the wrong thing...

btw, the way I deleted 'MpShHook.dll' was to start a cmd window, then start
the task manager and kill explorer.exe - then delete mpshhook.dll - the
explorer had a reference to it. If you happen to have tlist.exe, then run it
with tlist -m mpshook.dll to see which executables are referencing the dll,
then stop those executables and delete the dll. Next, restart explorer.exe
by cding to your windows directory ( c:\windows ) and run explorer.exe.

I hope someone comes up with a simpler solution. This is a bit crazy.

If you are familiar with the registry, try this:

1. Start | Run ... regedit.exe
2. Open registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

3. Click on Edit | File and enter Defender and search
4. Locate value in right panel under InstallProperties for LocalPackage
5. Locate that file in C:\Windows\Installer
6. Double-click on the file (mine is 67239.msi - depends on version of
Beta)
7. You should get prompted for Reinstall or Remove option.

If you wish to use the MSIExec manner, locate the UninstallString or
ModifyPath in the same key, double-click on one of them, Copy the
information.

Then, Start | Run .... [PASTE Info], then click OK. Basically does the same
thing.

Defender (1.1.1347) says: update - new version available.

I download the new version. On install it unpacks, validates, gets
agreement
on license, checks validity, and starts install.
At the first step it fails on trying to uninstall the old version. It
complains that it cannot find the .msi file;
C:\Documents..\user\Locals..\IXP000.TMP\
".. show path to WindowsDefender.msi"
And then,
"The older version of Windows Defender cannot be uninstalled. Contact
your support group."

Trying to uninstall from control panel also fails.

I did all pending windows-update's.

 

[Guest]

Mr Cat, good point on moving the registry pointer backup to the containing
key, rather than just deleting the subkey. I realized I forgot to mention
that when I wrote down what I did. Your solution looks good, with less
chance for costly errors - deleting the wrong key for example, and also
solves the locked dll that can't be deleted problem.

Thanks Jiminy

I think I got the kinks out of my procedure. The best way seems to be a few
deletes from the registry first, deletion of the WD folders, Ccleaner and
then a new install of WD. Here goes:

Stop the WD Service and Disable it. Run Regedit and do a find on
MpShHook.dll .
There should be 2 entries for MpSHHook (ignore the SearchAssistant keys).
Delete the 2 entries for MpShHook (delete the primary key - not the subkey).
Under regedit, move the registry pointer back to the top and do a find on
Windows Defender. Only delete the keys (again, I only found 2 entries) for
My Computer\HKEY_Classes_Root\Installer\Products\.... and My
Computer\HKEY_Classes_Root\Products\... Now reboot. Windows Defender
should give an error message about it couldn't start - Press OK. Now do a
search on files with the name Windows Defender. You should be able to delete
the folder Windows Defender under Program Files and the folders Document and
Settings\All Users\Application Data\Microsoft\Windows Defender and Documents
and Settings\laccount name(s)\Local Settings\Application
Data\Microsft\Windows Defender. Also you can delete WindowsDefender.msi and
WindowsDefender.adm if present. Now go into Ccleaner. Click Issues and do 2
iterations of finding and fixing until no problems found. Next go back into
regedit and do a search on the version of WD to be deleted (for example
1.1.1593) and do a find on the version number and delete those registry keys.
Reboot. You should not see any entries in add/remove programs for Windows
Defender or the Signatures. You should now be ready to re-install the latest
version of Defender. Let me know. Sorry for the previous faulty
instructions.

I tried all of the above tricks and yet Windows Defender still showed up in
Add/Remove programs and I could not delete it or install another version. I
even had an older copy of the install msi file that i copied to my machine
and pointed the uninstall at it, but still the same message as the first post.

Finally I ran regedit and searched the entire registry for anything with
Defend in it. I deleted almost all such entries. There were a couple things
called windefend, safetydefend and udefender that I did not delete. This did
solve the problem and I was able to install the new version of windows
defender. You might hose your machine doing this especially if your fingers
slip and you delete the wrong thing...

btw, the way I deleted 'MpShHook.dll' was to start a cmd window, then start
the task manager and kill explorer.exe - then delete mpshhook.dll - the
explorer had a reference to it. If you happen to have tlist.exe, then run it
with tlist -m mpshook.dll to see which executables are referencing the dll,
then stop those executables and delete the dll. Next, restart explorer.exe
by cding to your windows directory ( c:\windows ) and run explorer.exe.

I hope someone comes up with a simpler solution. This is a bit crazy.

If you are familiar with the registry, try this:

1. Start | Run ... regedit.exe
2. Open registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

3. Click on Edit | File and enter Defender and search
4. Locate value in right panel under InstallProperties for LocalPackage
5. Locate that file in C:\Windows\Installer
6. Double-click on the file (mine is 67239.msi - depends on version of
Beta)
7. You should get prompted for Reinstall or Remove option.

If you wish to use the MSIExec manner, locate the UninstallString or
ModifyPath in the same key, double-click on one of them, Copy the
information.

Then, Start | Run .... [PASTE Info], then click OK. Basically does the same
thing.

Defender (1.1.1347) says: update - new version available.

I download the new version. On install it unpacks, validates, gets
agreement
on license, checks validity, and starts install.
At the first step it fails on trying to uninstall the old version. It
complains that it cannot find the .msi file;
C:\Documents..\user\Locals..\IXP000.TMP\
".. show path to WindowsDefender.msi"
And then,
"The older version of Windows Defender cannot be uninstalled. Contact
your support group."

Trying to uninstall from control panel also fails.

I did all pending windows-update's.

 

[Guest]

In safe mode, is easy to remove many hard to remove files.

Search Results: MpShHook.dll

http://www.microsoft.com/athome/sec...&pt=&catlist=&dglist=&ptlist=&exp=&sloc=en-US
--

Mr Cat, good point on moving the registry pointer backup to the containing
key, rather than just deleting the subkey. I realized I forgot to mention
that when I wrote down what I did. Your solution looks good, with less
chance for costly errors - deleting the wrong key for example, and also
solves the locked dll that can't be deleted problem.

Thanks Jiminy

I think I got the kinks out of my procedure. The best way seems to be a few
deletes from the registry first, deletion of the WD folders, Ccleaner and
then a new install of WD. Here goes:

Stop the WD Service and Disable it. Run Regedit and do a find on
MpShHook.dll .
There should be 2 entries for MpSHHook (ignore the SearchAssistant keys).
Delete the 2 entries for MpShHook (delete the primary key - not the subkey).
Under regedit, move the registry pointer back to the top and do a find on
Windows Defender. Only delete the keys (again, I only found 2 entries) for
My Computer\HKEY_Classes_Root\Installer\Products\.... and My
Computer\HKEY_Classes_Root\Products\... Now reboot. Windows Defender
should give an error message about it couldn't start - Press OK. Now do a
search on files with the name Windows Defender. You should be able to delete
the folder Windows Defender under Program Files and the folders Document and
Settings\All Users\Application Data\Microsoft\Windows Defender and Documents
and Settings\laccount name(s)\Local Settings\Application
Data\Microsft\Windows Defender. Also you can delete WindowsDefender.msi and
WindowsDefender.adm if present. Now go into Ccleaner. Click Issues and do 2
iterations of finding and fixing until no problems found. Next go back into
regedit and do a search on the version of WD to be deleted (for example
1.1.1593) and do a find on the version number and delete those registry keys.
Reboot. You should not see any entries in add/remove programs for Windows
Defender or the Signatures. You should now be ready to re-install the latest
version of Defender. Let me know. Sorry for the previous faulty
instructions.

I tried all of the above tricks and yet Windows Defender still showed up in
Add/Remove programs and I could not delete it or install another version. I
even had an older copy of the install msi file that i copied to my machine
and pointed the uninstall at it, but still the same message as the first post.

Finally I ran regedit and searched the entire registry for anything with
Defend in it. I deleted almost all such entries. There were a couple things
called windefend, safetydefend and udefender that I did not delete. This did
solve the problem and I was able to install the new version of windows
defender. You might hose your machine doing this especially if your fingers
slip and you delete the wrong thing...

btw, the way I deleted 'MpShHook.dll' was to start a cmd window, then start
the task manager and kill explorer.exe - then delete mpshhook.dll - the
explorer had a reference to it. If you happen to have tlist.exe, then run it
with tlist -m mpshook.dll to see which executables are referencing the dll,
then stop those executables and delete the dll. Next, restart explorer.exe
by cding to your windows directory ( c:\windows ) and run explorer.exe.

I hope someone comes up with a simpler solution. This is a bit crazy.


:

If you are familiar with the registry, try this:

1. Start | Run ... regedit.exe
2. Open registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

3. Click on Edit | File and enter Defender and search
4. Locate value in right panel under InstallProperties for LocalPackage
5. Locate that file in C:\Windows\Installer
6. Double-click on the file (mine is 67239.msi - depends on version of
Beta)
7. You should get prompted for Reinstall or Remove option.

If you wish to use the MSIExec manner, locate the UninstallString or
ModifyPath in the same key, double-click on one of them, Copy the
information.

Then, Start | Run .... [PASTE Info], then click OK. Basically does the same
thing.

Defender (1.1.1347) says: update - new version available.

I download the new version. On install it unpacks, validates, gets
agreement
on license, checks validity, and starts install.
At the first step it fails on trying to uninstall the old version. It
complains that it cannot find the .msi file;
C:\Documents..\user\Locals..\IXP000.TMP\
".. show path to WindowsDefender.msi"
And then,
"The older version of Windows Defender cannot be uninstalled. Contact
your support group."

Trying to uninstall from control panel also fails.

I did all pending windows-update's.

 

[Guest]

Mr Cat.
Managed to delete MpShHook.dll after reboot, so no need to use the 'unlocker'.
Did the ccleaner as you suggested, but defender is still present in
add/remove, and cant update to new version. for the same reason as before.

I have read all threads with great interest.
It looks like it's the registry route for me. only thing is, i cant seem to
follow everyone suggestions fully and i'm a bit of a novice in the registry.

For instance; regarding 'newscience' (12/11/2006)
i can get to instruction 4. but at number 5. i cant locate
'C:\windows\installer' (presume this is 'windows explorer' and not the
'registry'). to double click the file (mine is e832f.msi).

Regarding 'Jiminy' (12/12/2006)
I can also search and find many reference's to 'defender', but am very wary
of arbitrarily deleting entries in fear of causing a massive problem.

Also, 'Mr Cat'. you say (when using ccleaner) that there is no need to
backup the registry if a system restore is taken. does this refer to the
ccleaner registry back up, or windows backup, i have read about system
restore and there is no mention of it backing up anything regarding the
registry.

I would be very gratefull if someone could spend the time and explain what i
should do and what i shouldnt do.
If i need to be deleting keys, subkeys and values, how should i go about it.
and writing the exact path for me to follow.
I have familiarised my self with backing up and restoring the registry, if
need be, but i'm hoping not to have to do this.

 

[NewScience]

Pls repost my steps. I do not have that list anymore and there may be mods
to it that may help you.

BTW: c:\windows\installer is in Windows Explorer. You need to find the
package associated with WD from the registry under the the Uninstall key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

If you are trying to delete WD, search from this Uninstall key for Windows
Defender (there are two, one for Signatures and the other for the WD
application itself).

Once found, Copy the UninstallString and run it.

I would do all this in Safe Mode.

 

[Guest]

Thanks for quick reply;
things are becomeing clearer.
Hear are your steps;
_________________________________________________________________
If you are familiar with the registry, try this:

1. Start | Run ... regedit.exe
2. Open registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

3. Click on Edit | File and enter Defender and search
4. Locate value in right panel under InstallProperties for LocalPackage
5. Locate that file in C:\Windows\Installer
6. Double-click on the file (mine is 67239.msi - depends on version of Beta)
7. You should get prompted for Reinstall or Remove option.

If you wish to use the MSIExec manner, locate the UninstallString or
ModifyPath in the same key, double-click on one of them, Copy the information.

Then, Start | Run .... [PASTE Info], then click OK. Basically does the same
thing.
________________________________________________________________

I have been looking at other posts with the same problem, i apologise for
not offering a link to them as i cant remember where they are.

Anyway, I came accross this link to the 'Windows Installer CleanUp Utility'

http://support.microsoft.com/kb/290301

i downloaded and ran the installer cleanup utility and removed windows all
references to windows defender.

i then checked 'control panel' 'add or remove programmes' and there is now
no reference to 'windows defender'.

i checked the registry for references to defender, and there are still
plenty of them there, but non in these two.
locations.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products
and
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

so i'm presuming the cleanup utility has removed them.

However; my joy has been short lived as i tried to install the new version
of defender.
The installation was progressing well until the installation wizard came up
to 'starting service'. a box poped up which read
"service 'windows defender' (windefend) failed to start. verify that you
have sufficient priviledges to start system services".

Any ideas on this one?

 

[NewScience]

Well, at least we got you to be able to install WD.

Check the following:

1. Start Menu | Run ... SERVICES.MSC
2. Look for Windows Defender in the list and see what Log On AS is used
(far right of entry). Should be LocalSystem
3. See if set to AUtomatic for Startup Type.
4. Double-click on entry and check what application is started. SHould be:
"C:\Program Files\Windows Defender\MsMpEng.exe"
5. Close Properties Window for WD
6. Check for COM+ Event System and see if it is Started and Startup Type is
Manual

If everything OK:

1. OPen Regedit
2. Open key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend
3. Make sure everything matches what you just read in SERVICES.MSC, e.g.,

DependOnService REG_MUTLI_SZ RpcSs
Group REG_SZ COM Infrastructure

4. Right click on WinDefend key and click on Permissions
5. Check Administrators and SYSTEM user (Full COntrol and Read should be
checked)

Also check:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender
2. Right click, select Permissions
3. Administrators should be Read
4. SYSTEM should be Full Control and Read

Let me know.

Thanks for quick reply;
things are becomeing clearer.
Hear are your steps;
_________________________________________________________________
If you are familiar with the registry, try this:

1. Start | Run ... regedit.exe
2. Open registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

3. Click on Edit | File and enter Defender and search
4. Locate value in right panel under InstallProperties for LocalPackage
5. Locate that file in C:\Windows\Installer
6. Double-click on the file (mine is 67239.msi - depends on version of
Beta)
7. You should get prompted for Reinstall or Remove option.

If you wish to use the MSIExec manner, locate the UninstallString or
ModifyPath in the same key, double-click on one of them, Copy the
information.

Then, Start | Run .... [PASTE Info], then click OK. Basically does the
same
thing.
________________________________________________________________

I have been looking at other posts with the same problem, i apologise for
not offering a link to them as i cant remember where they are.

Anyway, I came accross this link to the 'Windows Installer CleanUp
Utility'

http://support.microsoft.com/kb/290301

i downloaded and ran the installer cleanup utility and removed windows all
references to windows defender.

i then checked 'control panel' 'add or remove programmes' and there is now
no reference to 'windows defender'.

i checked the registry for references to defender, and there are still
plenty of them there, but non in these two.
locations.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products
and
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

so i'm presuming the cleanup utility has removed them.

However; my joy has been short lived as i tried to install the new version
of defender.
The installation was progressing well until the installation wizard came
up
to 'starting service'. a box poped up which read
"service 'windows defender' (windefend) failed to start. verify that you
have sufficient priviledges to start system services".

Any ideas on this one?

Pls repost my steps. I do not have that list anymore and there may be
mods
to it that may help you.

BTW: c:\windows\installer is in Windows Explorer. You need to find the
package associated with WD from the registry under the the Uninstall key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

If you are trying to delete WD, search from this Uninstall key for
Windows
Defender (there are two, one for Signatures and the other for the WD
application itself).

Once found, Copy the UninstallString and run it.

I would do all this in Safe Mode.

 

[Guest]

No joy i'm afraid!

The only change i had to make was to make the 'start up type' in 'services'
automatic (was previously 'disabled').
All other entries were as you have wrote.

Defender installation halted at the same point, with the same message;
"service 'windows defender' (windefend) failed to start. verify that you
have sufficient priviledges to start system services".

Well, at least we got you to be able to install WD.

Check the following:

1. Start Menu | Run ... SERVICES.MSC
2. Look for Windows Defender in the list and see what Log On AS is used
(far right of entry). Should be LocalSystem
3. See if set to AUtomatic for Startup Type.
4. Double-click on entry and check what application is started. SHould be:
"C:\Program Files\Windows Defender\MsMpEng.exe"
5. Close Properties Window for WD
6. Check for COM+ Event System and see if it is Started and Startup Type is
Manual

If everything OK:

1. OPen Regedit
2. Open key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend
3. Make sure everything matches what you just read in SERVICES.MSC, e.g.,

DependOnService REG_MUTLI_SZ RpcSs
Group REG_SZ COM Infrastructure

4. Right click on WinDefend key and click on Permissions
5. Check Administrators and SYSTEM user (Full COntrol and Read should be
checked)

Also check:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender
2. Right click, select Permissions
3. Administrators should be Read
4. SYSTEM should be Full Control and Read

Let me know.

Thanks for quick reply;
things are becomeing clearer.
Hear are your steps;
_________________________________________________________________
If you are familiar with the registry, try this:

1. Start | Run ... regedit.exe
2. Open registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

3. Click on Edit | File and enter Defender and search
4. Locate value in right panel under InstallProperties for LocalPackage
5. Locate that file in C:\Windows\Installer
6. Double-click on the file (mine is 67239.msi - depends on version of
Beta)
7. You should get prompted for Reinstall or Remove option.

If you wish to use the MSIExec manner, locate the UninstallString or
ModifyPath in the same key, double-click on one of them, Copy the
information.

Then, Start | Run .... [PASTE Info], then click OK. Basically does the
same
thing.
________________________________________________________________

I have been looking at other posts with the same problem, i apologise for
not offering a link to them as i cant remember where they are.

Anyway, I came accross this link to the 'Windows Installer CleanUp
Utility'

http://support.microsoft.com/kb/290301

i downloaded and ran the installer cleanup utility and removed windows all
references to windows defender.

i then checked 'control panel' 'add or remove programmes' and there is now
no reference to 'windows defender'.

i checked the registry for references to defender, and there are still
plenty of them there, but non in these two.
locations.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products
and
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

so i'm presuming the cleanup utility has removed them.

However; my joy has been short lived as i tried to install the new version
of defender.
The installation was progressing well until the installation wizard came
up
to 'starting service'. a box poped up which read
"service 'windows defender' (windefend) failed to start. verify that you
have sufficient priviledges to start system services".

Any ideas on this one?

Pls repost my steps. I do not have that list anymore and there may be
mods
to it that may help you.

BTW: c:\windows\installer is in Windows Explorer. You need to find the
package associated with WD from the registry under the the Uninstall key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

If you are trying to delete WD, search from this Uninstall key for
Windows
Defender (there are two, one for Signatures and the other for the WD
application itself).

Once found, Copy the UninstallString and run it.

I would do all this in Safe Mode.

Mr Cat.
Managed to delete MpShHook.dll after reboot, so no need to use the
'unlocker'.
Did the ccleaner as you suggested, but defender is still present in
add/remove, and cant update to new version. for the same reason as
before.

I have read all threads with great interest.
It looks like it's the registry route for me. only thing is, i cant
seem
to
follow everyone suggestions fully and i'm a bit of a novice in the
registry.

For instance; regarding 'newscience' (12/11/2006)
i can get to instruction 4. but at number 5. i cant locate
'C:\windows\installer' (presume this is 'windows explorer' and not the
'registry'). to double click the file (mine is e832f.msi).

Regarding 'Jiminy' (12/12/2006)
I can also search and find many reference's to 'defender', but am very
wary
of arbitrarily deleting entries in fear of causing a massive problem.

Also, 'Mr Cat'. you say (when using ccleaner) that there is no need to
backup the registry if a system restore is taken. does this refer to
the
ccleaner registry back up, or windows backup, i have read about system
restore and there is no mention of it backing up anything regarding the
registry.

I would be very gratefull if someone could spend the time and explain
what
i
should do and what i shouldnt do.
If i need to be deleting keys, subkeys and values, how should i go
about
it.
and writing the exact path for me to follow.
I have familiarised my self with backing up and restoring the registry,
if
need be, but i'm hoping not to have to do this.

:

Thank you for bringing this to my attention. I'm still living in the
past
regarding some of the early versions of the Windows Defender Beta.
The
issue
of the dll had been brought up by another user. To resolve:

http://ccollomb.free.fr/unlocker/

Forget about the MSIEXEC issue.

After deleting the dll, reboot. Do the Ccleaner stuff and give it a
try.
If successful or any other problems, please let me know. Thanks.

:

I have had similar problem as 'guthrie' and followed your
instructions,
But I have come up against a couple of problems. Can you help.

I have deleted the Windows Defender folders as mentioned, except the
folder
in 'C:\Program Files' a box appeared indicating 'unable to delete
file
'MpShHook.dll' as it is in use. I then moved this file to
'C:\Program
Files',
and i was then able to delete the folder '(C:\Program Files\Windows
Defender)', but i still cannot delete 'MpShHook.dll' from its new
location.

I then attempted to remove 'Msiexec' as instructed, but was unable
to
do
this, a box indicated 'The installed product does not match the
installation
source(s). Until a matching scource is provided or the installed
product and
source are synchronized, this action can not be performed.

When i selected 'ok' a message appears.... The path 'C:\Program
Files\Windows Defender\AS_Sigs.MSI' cannot be found. Verify that you
have
access to this location and try again, or try to find the
installation
package 'AS_Sigs.MSI' in a folder from which you can install the
product
Windows Defender Signatures.

The source of this file is (C:\Program Files\Windows Defender\),
which
i
have just deleted.
I then restored the deleted folder and files, moved the file
'AS_Sigs.MSI'
to 'C:\Program Files'. then deleted 'C:\Program Files\Windows
Defender',
again.

I then attepted to remove 'Msiexec' again, and browsed to the new
location,
only to be confronted with same problem when i first attepted to
remove
this
file. i feel this file has been corrupted and cannot be used.

i Have xp home edition with sp2, windows defender ver 1.1.1347.0

:

I understand. First goto Control Panel, Performance and
Maintenance,
Adminstrative Tools, Services - Stop the Windows Defender Service,
then right
click the Windows Defender Service and click properties and then
disable the
service (under startup type) and reboot. Next delete the folder
Windows
Defender under Program Files. Next delete the folder Windows
Defender under
Documents and Settings/All Users/Application Data/Microsoft and
delete the
folder Windows Defender under Document and Settings/your logon
id/Local
Settings/Application Data/Microsoft. Remove the current signature
file. To
do this, click Start, click Run, type Msiexec /x
{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}, and then click OK.
After you perform the above download Ccleaner (ccleaner.com) and
install
without the Yahoo toolbar option. Click the Ccleaner Issues Icon
and
then
scan for issues and fix issues until no problems found - no need
to
backup
registry entries if you take a System Restore point first. Check
add/remove
programs to see if there is still an entry for Windows Defender
(at
this
point it should be gone). If it is not gone, then use Ccleaner
Tools
to
delete the installer entry.

Since you are cleaning up registry entries with Ccleaner, you
might
want to
run Windows Live OneCare and do the "broom" cleanup as well. Make
sure you
go to Windows/Microsoft Update and use Express to check for any
updates.
Take a restore point and now download the latest version
1.1.1593.0
of
Windows Defender. If you have any questions, let me know. Good
luck.



:



:

Trying doing a system restore using a restore point prior to
the
update
attempt. See if you can do a clean uninstall (not update!) of
the 1347