Microsoft Security Essentials

slipperyfox

Reputable
Nov 23, 2014
3
0
4,510
I am having no end of trouble trying to get rid of this program. I have been reading for the last 2 days and still unable to get rid of.
I am running Windows 7 Home Premium 4 gig ram
Things I have tried are

<LI xzf9="1">Tried to reinstall the application when I try that I get an error and am Installing as Admin<LI xzf9="1">Tried Microsoft Fix it 50535. No Good get an error code 2203 (installer has encountered and expected error installing this package. This may indicate a problem with this package.) I get this error with any application I try and install<LI xzf9="1">Tried Microsoft Fix it Program Install and Uninstall. Ran manually and auto and same outcome.<LI xzf9="1">Tried to delete in regedit and tells me Can not delete error with keys
Have ran batch file and get the following

SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Results\Resource\{6D02ECF8-54B0-4A34-9CB9-40383BDC2AE9}" now owned
by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Results\Resource\{6D4026D4-8F72-4ECF-B51A-5A7C22F7559F}" now owned
by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Results\Resource\{882741A4-4C85-45B5-A253-7B36E5534C07}" now owned
by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Results\Resource\{88A3C23C-E988-46E8-842A-0D336BD91EF5}" now owned
by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Results\Resource\{974F27A9-BF40-4791-AC27-37651AC66CB2}" now owned
by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Results\Resource\{B160CEFE-EF40-4C56-B144-8C5C9C7BDE13}" now owned
by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Results\Resource\{B4FAD909-AC6E-4327-98C2-ED2B0BA62CF6}" now owned
by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Results\Resource\{BE43EAEF-E050-4445-8975-A9606F22F5CB}" now owned
by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Results\Resource\{C1824DD3-9ABB-42D2-94F4-D82EBF5B1699}" now owned
by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Results\Resource\{CE3554D6-D70F-42D8-AD31-61F26DAD266D}" now owned
by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Results\Resource\{E43C38D2-DE17-49F4-8D86-EE03A7890016}" now owned
by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Results\Resource\{E7AE8BE6-F1D7-4B93-A42A-D8E94AEB12D5}" now owned
by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Results\Resource\{FFCAE988-81B9-43B8-A564-CBA57A2C20CF}" now owned
by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\History\Store\67EB0C947CCA3515E63DF6D4A672720F" now owned by the administra
tors group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\MetaStore\1" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\MetaStore\2" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\MetaStore\3" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\MetaStore\4" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\MetaStore\1\0000000000000000.idx" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\MetaStore\2\0000000000000000.idx" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\MetaStore\3\0000000000000000.idx" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\MetaStore\4\0000000000000000.idx" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
cans\RtSigs\Data" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
upport\MPDetection-04042015-191606.log" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
upport\MPLog-03032015-112904.log" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
upport\MpWppTracing-04052015-153345-00000003-ffffffff.bin" now owned by the admi
nistrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
upport\MpWppTracing-04052015-153511-00000003-ffffffff.bin" now owned by the admi
nistrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Antimalware\S
upport\MpWppTracing-04052015-154343-00000003-ffffffff.bin" now owned by the admi
nistrators group.
C:\Program Files\Microsoft Security Client>takeown /f "C:\ProgramData\Microsoft\
Microsoft Security Client" /a /r
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Security Clie
nt" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Security Clie
nt\Support" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Security Clie
nt\Support\EppSetup.etl" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Security Clie
nt\Support\EppSetup.log" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Security Clie
nt\Support\EppSetupResult.ini" now owned by the administrators group.
SUCCESS: The file (or folder): "C:\ProgramData\Microsoft\Microsoft Security Clie
nt\Support\MSSecurityClient_Setup_4.7.205.0_epp_Install.log" now owned by the ad
ministrators group.
C:\Program Files\Microsoft Security Client>takeown /f "C:\Program Files\Microsof
t Security Client" /a /r
ERROR: Access is denied.
C:\Program Files\Microsoft Security Client>REM Delete the MSE folders.
C:\Program Files\Microsoft Security Client>rmdir /s /q "C:\ProgramData\Microsoft
\Microsoft Antimalware"
C:\ProgramData\Microsoft\Microsoft Antimalware\DEFINI~1\{4C159~1\mpengine.dll -
Access is denied.
C:\ProgramData\Microsoft\Microsoft Antimalware\IMpServiceEDB4FA23-53B8-4AFA-8C5D
-99752CCA7094.lock - The process cannot access the file because it is being used
by another process.
C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\CACHEM~1\MpScanCach
e-1.bin - The process cannot access the file because it is being used by another
process.
C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\MpDiag.bin - The process ca
nnot access the file because it is being used by another process.
C:\ProgramData\Microsoft\Microsoft Antimalware\Support\MPDetection-04042015-1916
06.log - The process cannot access the file because it is being used by another
process.
C:\ProgramData\Microsoft\Microsoft Antimalware\Support\MPLog-03032015-112904.log
- The process cannot access the file because it is being used by another proces
s.
C:\Program Files\Microsoft Security Client>rmdir /s /q "C:\ProgramData\Microsoft
\Microsoft Security Client"
C:\Program Files\Microsoft Security Client>rmdir /s /q "C:\Program Files\Microso
ft Security Client"
C:\Program Files\Microsoft Security Client\DbgHelp.dll - Access is denied.
C:\Program Files\Microsoft Security Client\EppManifest.dll - Access is denied.
C:\Program Files\Microsoft Security Client\MpAsDesc.dll - Access is denied.
C:\Program Files\Microsoft Security Client\MpClient.dll - Access is denied.
C:\Program Files\Microsoft Security Client\MpCmdRun.exe - Access is denied.
C:\Program Files\Microsoft Security Client\MpCommu.dll - Access is denied.
C:\Program Files\Microsoft Security Client\mpevmsg.dll - Access is denied.
C:\Program Files\Microsoft Security Client\MpOAv.dll - Access is denied.
C:\Program Files\Microsoft Security Client\MpRTP.dll - Access is denied.
C:\Program Files\Microsoft Security Client\MpSvc.dll - Access is denied.
C:\Program Files\Microsoft Security Client\MSESysprep.dll - Access is denied.
C:\Program Files\Microsoft Security Client\MsMpCom.dll - Access is denied.
C:\Program Files\Microsoft Security Client\MsMpEng.exe - Access is denied.
C:\Program Files\Microsoft Security Client\MsMpLics.dll - Access is denied.
C:\Program Files\Microsoft Security Client\MsMpRes.dll - Access is denied.
C:\Program Files\Microsoft Security Client\msseces.exe - Access is denied.
C:\Program Files\Microsoft Security Client\msseoobe.exe - Access is denied.
C:\Program Files\Microsoft Security Client\msseooberes.dll - Access is denied.
C:\Program Files\Microsoft Security Client\MsseWat.dll - Access is denied.
C:\Program Files\Microsoft Security Client\NisIpsPlugin.dll - Access is denied.
C:\Program Files\Microsoft Security Client\NisLog.dll - Access is denied.
C:\Program Files\Microsoft Security Client\NisSrv.exe - Access is denied.
C:\Program Files\Microsoft Security Client\NisWFP.dll - Access is denied.
C:\Program Files\Microsoft Security Client\Setup.exe - Access is denied.
C:\Program Files\Microsoft Security Client\SetupRes.dll - Access is denied.
C:\Program Files\Microsoft Security Client\shellext.dll - Access is denied.
C:\Program Files\Microsoft Security Client\SqmApi.dll - Access is denied.
C:\Program Files\Microsoft Security Client\SymSrv.dll - Access is denied.
C:\Program Files\Microsoft Security Client\SymSrv.yes - Access is denied.
The process cannot access the file because it is being used by another process.
C:\Program Files\Microsoft Security Client>REM Stop the WMI and its dependency s
ervices
C:\Program Files\Microsoft Security Client>sc stop sharedaccess
[SC] ControlService FAILED 1062:
The service has not been started.

C:\Program Files\Microsoft Security Client>sc stop MpsSvc
SERVICE_NAME: MpsSvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 3 STOP_PENDING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x7530
C:\Program Files\Microsoft Security Client>sc stop wscsvc
SERVICE_NAME: wscsvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 3 STOP_PENDING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
C:\Program Files\Microsoft Security Client>sc stop iphlpsvc
SERVICE_NAME: iphlpsvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 3 STOP_PENDING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x7530
C:\Program Files\Microsoft Security Client>sc stop winmgmt
[SC] ControlService FAILED 1051:
A stop control has been sent to a service that other running services are depend
ent on.

C:\Program Files\Microsoft Security Client>REM Delete the Repository folder.
C:\Program Files\Microsoft Security Client>rmdir /s /q "C:\Windows\System32\wbem
\Repository"
C:\Windows\System32\wbem\Repository\INDEX.BTR - The process cannot access the fi
le because it is being used by another process.
C:\Windows\System32\wbem\Repository\MAPPING1.MAP - The process cannot access the
file because it is being used by another process.
C:\Windows\System32\wbem\Repository\MAPPING2.MAP - The process cannot access the
file because it is being used by another process.
C:\Windows\System32\wbem\Repository\MAPPING3.MAP - The process cannot access the
file because it is being used by another process.
C:\Windows\System32\wbem\Repository\OBJECTS.DATA - The process cannot access the
file because it is being used by another process.
C:\Program Files\Microsoft Security Client>sc stop
DESCRIPTION:
Sends a STOP control request to a service.
USAGE:
sc <server> stop [service name] <reason> <comment>
<reason> = Optional reason code number for service stop
formed with the following elements in the format:
Flag:Major reason:Minor reason
[E.g., 1:2:8 means Hardware: Disk (Unplanned)]
Flag Major reason
------------------ ---------------------------
1 - Unplanned 1 - Other
2 - Custom 2 - Hardware
4 - Planned 3 - Operating System
4 - Software
5 - Application
64-255 - Custom
Minor reason
-----------------------------------
1 - Other
2 - Maintenance
3 - Installation
4 - Upgrade
5 - Reconfiguration
6 - Hung
7 - Unstable
8 - Disk
9 - Network Card
10 - Environment
11 - Hardware Driver
12 - Other Driver
13 - Service Pack
14 - Software Update
15 - Security Fix
16 - Security
17 - Network Connectivity
18 - WMI
19 - Service Pack Uninstall
20 - Software Update Uninstall
22 - Security Fix Uninstall
23 - MMC
256-65535 - Custom
<comment> = Optional comment for the reason above (127 characters maximum
)
C:\Program Files\Microsoft Security Client>PAUSE
Press any key to continue . . .


I have deleted the folder out of the %temp% as well as in the %Appdata%. In Program dir I still have
a folder Microsoft Security Client. In the Programdata under Microsoft I have Microsoft Antimalware and Microsoft Security Essentials and unable to delete any of them.
I am unable to stop the service running MSMPSVC with "TaskKill" using both the name and PID
When I go into Services I am unable to change the Start-up type is on auto and unable to Stop or Pause as well.

Can someone please help out. I hoping there is an easy fix so I don't have to rebuild.
Thanks in advance
 

slipperyfox

Reputable
Nov 23, 2014
3
0
4,510
Thanks for the reply Dee Kay but i have tried all of them results of MSremoval is above. I ended up finding another tread and put me onto PSexec and this then worked kind of.
https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx
I ran the regedit using PSexec with the command and manage to delete all relations to Microsoft Security Essentials, Microsoft Security Centre, and tried to delete MsMpSvc but wouldnt let me but deleted the ones I could.
I then booted into Safe Mode and deleted the folders in Program folder, Program(x86) and Programdata, then rebooted and problem fixed. It still shows in Services but not turned On. I then was able to install ESet and Malware protection. I also used the program Hitman Pro. Link below where I git info
http://answers.microsoft.com/en-us/protect/forum/mse-protect_start/cant-delete-registry-key/e1ad14aa-0ded-4467-ba67-9b038551ba5e?page=2
 

slipperyfox

Reputable
Nov 23, 2014
3
0
4,510
Tman1 did that while running MSremoval.txt shown above as well I did again to show you. Thanks anyway
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sc delete MsMpSvc
[SC] OpenService FAILED 5:

Access is denied.


C:\Windows\system32>