Crippled WindowsSecurityCenter after removal of Malwarebytes Anti-Malware

[easyentry]

Hello,

after removing Malwarebytes Anti-Malware my WindowsSecurityCenter got crippled:

-5 minutes after PC boots, it displays: "getting protection info"

-then it switches to "Unknown" and notes (you have another 3rd party AV installed - as I have none)

What happened:

1. I installed Malwarebytes Anti-Malware to C:\Program Files\Anti-Malware (so to the CUSTOM directory).

2. Uninstallation via CP failed. I downloaded removal tool (no idea if mb-clean.exe or mb-support.exe, I don't remember.)

3. Removed Malwarebytes Anti-Malware via tool. Then WindowsSecurity was crippled.

What I have tried:

1. Searched registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{23007AD3-69FE-687C-2629-D584AFFAF72B}

"GUID"="{23007AD3-69FE-687C-2629-D584AFFAF72B}"
"DISPLAYNAME"="Malwarebytes"
"STATE"=dword:00060010
"PRODUCTEXE"="C:\\Program Files\\Anti-Malware\\MBAMWsc.exe"
"REPORTINGEXE"="C:\\Program Files\\Anti-Malware\\MBAMWsc.exe"

Took ownership of the key, deleted it rebooted. Nothing.

2. run: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get * /value

again I found 23007AD3-69FE-687C-2629-D584AFFAF72B, Malwarebytes

run WBEMTEST, connected to root/securitycenter2, entered query SELECT * from Antivirusproduct, deleted 23007AD3-69FE-687C-2629-D584AFFAF72B, Malwarebytes, rebooted. Nothing

3. run net stop winmgmt,cd /d %windir%\system32\wbem, killed repo: deltree repository, rebooted, nothing

Only way, how to have uncrippled WindowsSecuriteCenter is to install Malwarebytes Anti-Malware again to the same custom directory (which reached end of trial period, so it only nags). When I uninstall it, I got error again, because Malwarebytes Anti-Malware uses new GUID for each installation, so uninstall doesn't clean it (23007AD3-69FE-687C-2629-D584AFFAF72B), it cleans only the last GUID.

So thanks guys, that you crippled my Windows installation. Many thanks.

 

 

 

[easyentry]

Could you send me customised uninstaller, which will do the uninstall procedure, but for GUID (23007AD3-69FE-687C-2629-D584AFFAF72B)? Thx.

[AdvancedSetup]

Hello  and       @easyentry

 

My screen name is AdvancedSetup and I will assist you with your system issues.
 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

• Please follow all steps in the provided order and post back all requested logs
• Please attach all log files to your post, unless otherwise requested
• Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans have been completed.
• Temporarily disable Microsoft SmartScreen to download the software below if needed. Make sure to turn it back on once the scans are completed.
• Searching, detecting, and removing malware isn't instantaneous and there is no guarantee to repair every system.
• Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
• Do not run online games while the case is ongoing. Do not do any free-wheeling or risky web-surfing.
• Only run the tools I guide you to use. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Cracked, Hacked, or Pirated programs are not only illegal but also can make a computer a malware victim. Having such programs installed is the easiest way to get infected. It is the leading cause of ransomware encryption. It is at times also a big source of current Trojan infections. If there are any on the system you should uninstall them before we proceed.
• Please be patient and stick with me until I give you the "all clear". We don't want to waste your time, please don't waste ours.
• If your system is running Discord, please be sure to Exit it while this case is ongoing.

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting. This is a report only.

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply

Thank you

 

 

[easyentry]

Thanks for reply.

Output of the tool is attached. Let's see, where it goes. :)

mbst-grab-results.zip

[AdvancedSetup]

Actually this is a cracked stolen version of Windows. I will attempt to help you fix it but we will not help you further in stealing software.

Please run the following @easyentry

 

Please download the following tool

Farbar Service Scanner and run it on the computer with the issue
http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/

 

Make sure the following options are checked:

• Internet Services
• Windows Firewall
• System Restore
• Security Center/Action Center
• Windows Update
• Windows Defender

Click "Scan"

It will create a log (FSS.txt) in the same directory the tool is run.
Please attach the log to your next reply.

 

[easyentry]

It is neither cracked or stolen. I just use AutoKMS for my own reasons, which isn't your business.

Also when somebody sends you private info data, it doesn't feel right disclosing them to public without the owner's agreement.

I thank you for your time. No other advices are needed, I already concluded, that Malwarebytes Anti-Malware is trash program, which can corrupt your OS by its failed uninstall.

Bye.

 

[AdvancedSetup]

Up to you but it it is impossible for the home user to obtain a legal version of the Enterprise version of Windows. AutoKMS is only used for theft.

Good bye