Strange problems un/installing MSE on otherwise working machine

[Guest PC Pete]

G'day all,

 

I'm in a very frustrating situation on my Win7 Ultimate x64 system, which had MSE working a day ago, but now I can't seem to uninstall OR reinstall MSE.

 

Please excuse the long post, I'm trying to provide as much pertinent information about this as possible to save everyone time and frustration!

 

I'm running Windows 7 Ultimate x64, with all hotfixes, SPs, and update applied. I was connected initially through my firewall/gateway PC (which runs ICS, which has been fine for > 6 years), but I had no connection available. It turned out that there had been a disk failure on that system, and I have to reinstall on a new disk, etc. So I reconnected my main system directly to my router, changed the IP options to DHCP, and voilá, I had connection again. At that time, 2 days ago, I was able to run MSE (by "run", I mean I could start up the "Scan for spyware" UI with no problems) just fine.

 

However, last night (having changed NOTHING on either the main system or the router), I happened to be browsing through my services sorting out another issue (with interbase), when I noticed that the Windows Defender service was not running, and the startup type was set to "Manual".

 

I tried manually starting the Defender service (which is normally running), and I got the error "This operation returned because the timeout period expired. (Error code 0x800705b4)." In Process Explorer, I saw svchost repeatedly start and stop while this was happening.

 

After googling around, I discovered that Defender isn't supposed to run if I have MSE installed. My bad.

 

Then I noticed that the Microsoft Antimalware Service wasn't running either, and in the description field in the services.msc, it shows "" - which is just plain weird.

 

I tried downloading and reinstalling MSC (from the MS download site!), but it immediately returns with the installation error "Microsoft Security Essentials is already installed", error code 0x4FF02. I googled that, and found there were 2 registry values (HKCR/Installer/UpgradeCodes/blah blah, and HKLM/Sofware/Microsoft/Windows/CurrentVersion/Installer/UpgradeCodes/blah blah) that needed to be deleted. I removed JUST those two keys, rebooted, tried reinstalling, and then got error code 0x80070645. Re-running the installer again results in the "already installed" message.

 

So I'm stuck in that loop.

 

There is nothing posted in the event log(s) about either issue. At least, there's nothing about Antimalware or Defender or anything remotely similar.

 

Can anyone please help me figure out what the heck has gone wrong, and how to recover from this painful situation.

 

Since I appear to be without a firewall or protection of any kind, I'm composing all this offline and pasting, posting, and disconnecting as quickly as possible.

 

Some quick answers to possible questions :

1) I don't want to use a third-party firewall, as the MS firewall solution (MSE) has been protecting me perfectly for years, and Defender before that. I don't need or want another firewall program.

2) I used to be a network security specialist, so I'm 100% certain there's no malware on this system. I suspect a registry key has gotten corrupted somehow, and that's throwing me into this mess. Hopefully a registry fix can get me back out again.

3) This is a fully loaded, extremely stable system (98.5% uptime), and I don't want to have to reinstall everything again from scratch. It's a business system, so although I have my data on separate drives to the system boot disk, I don't want to have to reinstall hundreds of apps while my customers wait for me to rebuild the system, if at all possible.

 

Any and all suggestions would be most welcome.

 

Thanks in advance for any help you can offer!

 

Continue reading...