Windows Installer Issue....

[John Morley]

Hi All,

A couple of weeks ago, one of our (under-protected) office PC's was
infected by some sort malware or spyware (I wasn't involved in this
process). Following it's removal with a new installation of Kaspersky
anti-virus, Windows Installer wants to run whenever we launch certain
applications. I've gone and shut-off Windows Installer globally by
disabling it using the Group Policy Editor, but it(Windows Installer)
still flashes up for a couple of seconds before going away. Is it
possible to restore whatever was lost during the malware eradication to
prevent this from happening?

Thanks,

John

 

[PA Bear [MS MVP]]

See...

Help: I Got Hacked. Now What Do I Do?
http://technet.microsoft.com/en-us/library/cc700813.aspx

Back-up any personal data (none of which should be considered 100%
trustworthy at this point) then do a format & clean install of Windows.
Please note that a Repair Install (AKA in-place upgrade) will NOT fix this!

HOW TO do a clean install of WinXP: See
http://michaelstevenstech.com/cleanxpinstall.html#steps and/or Method 1 in
http://support.microsoft.com/kb/978307

After the clean install, you'll have the equivalent of a "new computer" so
take care of everything on the following page before otherwise connecting
the machine to the internet or a network and before using a USB key that
isn't brand-new or hasn't been freshly formatted:

5 steps to help protect your new computer before you go online
http://www.microsoft.com/protect/computer/advanced/xppc.mspx

Other helpful references include:

HOW TO get a computer running WinXP Gold (no Service Packs) fully patched
(after a clean install)
http://groups.google.com/group/microsoft.public.windowsupdate/msg/3f5afa8ed33e121c

HOW TO get a computer running WinXP SP1(a) or SP2 fully patched (after a
clean install)
http://groups.google.com/group/microsoft.public.windowsxp.general/msg/a066ae41add7dd2b

NB: Any Norton or McAfee free-trial that came preinstalled on the computer
when you bought it will be reinstalled (but invalid) when Windows is
reinstalled. You MUST uninstall the free-trial and download/run the
appropriate removal tool before installing any Windows Service Packs or IE
upgrades and before installing your new anti-virus application.

Norton Removal Tool
ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe

McAfee Consumer Products Removal Tool
http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Also see:

Steps To Help Prevent Spyware
http://www.microsoft.com/security/spyware/prevent.aspx

Steps to Help Prevent Computer Worms
http://www.microsoft.com/security/worms/prevent.aspx

Avoid Rogue Security Software!
http://www.microsoft.com/security/antivirus/rogue.aspx

 

[sgopus]

First you have to figure out what's trying to install, msconfig and startup
may give you a clue.

 

[Jose]

Hi All,

A couple of weeks ago, one of our (under-protected) office PC's was
infected by some sort malware or spyware (I wasn't involved in this
process). Following it's removal with a new installation of Kaspersky
anti-virus, Windows Installer wants to run whenever we launch certain
applications. I've gone and shut-off Windows Installer globally by
disabling it using the Group Policy Editor, but it(Windows Installer)
still flashes up for a couple of seconds before going away. Is it
possible to restore whatever was lost during the malware eradication to
prevent this from happening?

Thanks,

John

The Windows Installer can provide more than one kind of message when
it is broken and the solution depends on the message. GPE is not
necessary to resolve a broken Windows Installer.


What exactly does your troublesome message report and when do you see
it - launching programs, reboot, etc.