MalwareBytes is not fully uninstalled

[I_hate_W10]

I have uninstalled Malwarebytes from windows 10 and cleared everything from the registry except for the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{23007AD3-69FE-687C-2629-D584AFFAF72B}

which will not delete.

I have tried to change ownership of the key but still I cannot delete it. Nor am I able to modify any of the values.

It appears that this key is preventing Windows Defender from starting.

Thanks for any replies. 

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download and run the Uninstaller tool.
https://support.malwarebytes.com/docs/DOC-2674

Let me know if the problem is solved.

[AdvancedSetup]

@I_hate_W10

Was that able to resolve your issue?

 

[exile360]

Additionally, verifying and rebuilding the WMI Repository may correct the issue (it is a known fix for obsolete entries and inaccurate data in Security Center/Action Center).  The following articles provide further details:

https://techcommunity.microsoft.com/t5/Ask-The-Performance-Team/WMIDiag-2-2-is-here/ba-p/375642
https://success.solarwindsmsp.com/kb/solarwinds_n-central/Re-sync-or-rebuild-the-WMI-Repository
https://techcommunity.microsoft.com/t5/Ask-The-Performance-Team/WMI-Rebuilding-the-WMI-Repository/ba-p/373846

NOTE: while I have verified these functions in Windows Vista and Windows 7, I do not know for certain that they work the same in Windows 10, so please follow the advice from AdvancedSetup if he believes this method should not be used.

Edited November 15, 2019 by exile360

[I_hate_W10]

18 minutes ago, AdvancedSetup said:

@I_hate_W10

Was that able to resolve your issue?

 

Hi Ron,

I'm afraid not. The registry key that I was looking at removing is still there and cannot be removed by me even though I am the administrator and I have taken ownership.

I don't know for sure but I suspect this key is stopping me from switching Windows Defender AV on which means I have no anti-virus protection.

 

Mike

[AdvancedSetup]

Let me have you run the following so that we can see what's going on @I_hate_W10

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

Ron

 

Edited November 15, 2019 by AdvancedSetup
updated info

[I_hate_W10]

Hi Ron scan completed, files attached.

Thanks

Mike

Addition.txt FRST.txt

[AdvancedSetup]

Let me have you start out by Uninstalling Java. Please go into Control Panel, Programs, Add/Remove and uninstall JAVA

Then reboot the computer.

 

[AdvancedSetup]

Once you have uninstalled Java please run the following fix. It will check on Windows operating system file integrity as well as clean up temp files and remove a couple of very old programs from 2004 from starting when Windows starts. Almost any software from that long ago needs to be verified that it's still both valid and useful on Windows 10

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

[I_hate_W10]

Hi Ron,

What programmes will be removed? I do not know of any programmes that are so old and not needed.

 

Regards

 

Mike

[AdvancedSetup]

activeX\AcroIEHelper.dll [2004-12-13] (Adobe Systems, Incorporated

Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-13] (Adobe Systems Incorporated)

 

[AdvancedSetup]

Nothing that old from Adobe is even safe to run on Windows 10

 

[I_hate_W10]

If ever another reason was needed to get rid of W10 , this is it. It is surely time to change.

It is a bad show when MS starts to make expensive software unsafe to use on its operating systems.

In what way is Acrobat7 unsafe?

Mike

[I_hate_W10]

13 hours ago, AdvancedSetup said:

Once you have uninstalled Java please run the following fix. It will check on Windows operating system file integrity as well as clean up temp files and remove a couple of very old programs from 2004 from starting when Windows starts. Almost any software from that long ago needs to be verified that it's still both valid and useful on Windows 10

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txtUnavailable

Thanks

Ron

 

Hi Ron,

I cannot download the file 'fixlist.txt', it quickly becomes unavailable after I refresh the page.

 

Mike

[AdvancedSetup]

Please try another web browser if needed @I_hate_W10

 

 

Edited November 16, 2019 by AdvancedSetup
updated info

[I_hate_W10]

Hi Ron,

I have completed the fix. The fix log is attached.

 

Mike 

Fixlog.txt

[AdvancedSetup]

Please follow the link again to remove and reinstall Malwarebytes

https://support.malwarebytes.com/docs/DOC-2674

Then let me know if it runs okay now or not and how the computer is working now

 

[I_hate_W10]

Hi Ron,

I have run the tool and Malwarebytes appears to be working OK but I am still not getting Windows Defender to switch on. It shows under Antivirus in the Settings/Security Providers page but it will not switch on.

Widows Update appears to be working but it will not install the Security Intelligence Update for Windows Defender Anti-Virus, KB2267602 update.

Regards

Mike

 

[AdvancedSetup]

That KB is from 2 years ago. Let me get a new fresh set of logs from FRST please. But first Reboot the computer 2 times before running FRST

 

 

[I_hate_W10]

Good morning Ron,

I have done as requested and the resultant logs are attached.

Mike

Addition.txt FRST.txt

[AdvancedSetup]

Okay, please run this tool again. But this time just uninstall Malwarebytes and do not allow it to do the reinstall.

Once completed please reboot the computer 2 more times. Then run FRST again and post back both new logs again.

https://support.malwarebytes.com/docs/DOC-2674

Thanks

Ron

 

[I_hate_W10]

Hi Ron,

Files attached.

Mike

Addition.txt FRST.txt

[AdvancedSetup]

Hi there. Please try the following.

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.
 

fixlist.txt

Ron

 

 

[I_hate_W10]

Hi Ron,

Fixlog file attached.

Mike

Fixlog.txt

[AdvancedSetup]

Good, that looks good. So, that just confirms this is a known issue with our removal process and a bug has been submitted for it. Hopefully in the next program update they'll address this issue where it shows as installed and disabled even though it's been uninstalled.

You can go ahead now and reinstall Malwarebytes and let me know if there are any other issues

Thank you

Ron