Problems with MS Security Essentials

[Allthumbs]

Greetings All,

I’ve been having trouble with MS Security Essentials ever since I deleted all the KB’s regarding Windows 10. I have been getting supposed downloads for MSSE around 3:00 P.M. CDT every day and they all seem to fail. I have enclosed the latest MpSigStub.log, below for your viewing. My OS is Win7 Pro, SP-1.

As you can see, there seem to be errors, but on another line, it states the MSSE is updated. I’ve been having this problem for quite some time. Is there anything to be concerned with?

Can anyone tell me what’s going on? I’m just about ready to uninstall MSSE and go with another security system.

Thanks for your consideration,

Allthumbs

----------------------------------------------------------------------------------
Command: c:\ac6a1dfb1432aed55891156f6e\mpsigstub.exe /q /ProductGUID EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Start time: 9/23/2015 3:25 PM (version 11.1.5020.0)

=================================== ProductSearch ==================================

Failed to get MpTriggerErrorHeartbeatReport address for product WD (Win7). (error 0x8007007f).
Microsoft Windows Defender (Windows 7): Microsoft Security Essentials:
Status: Disabled Active
Product: 6.1.7601.18170 4.8.204.0
Engine: 1.1.8502.0 1.1.12101.0
Signatures: 1.129.268.0 1.207.578.0
NIS Engine: 2.1.11804.0
NIS Signatures: 115.21.0.0

================================ PackageDiscovery ================================

Package files discovered:
c:\ac6a1dfb1432aed55891156f6e\115.0.0.0_to_115.22.0.0_NISfull.vdm_source_NISbase.vdm._p (?.?.?.?)
c:\ac6a1dfb1432aed55891156f6e\nisbase.vdm (115.0.0.0)
c:\ac6a1dfb1432aed55891156f6e\gapaengine.dll (2.1.11804.0)

NIS Full:
NIS engine: 2.1.11804.0
NIS base VDM: 115.0.0.0
NIS full VDM: 115.22.0.0

================================ PatchApplication ================================

Patched nisfull.vdm to 115.22.0.0

================================= MpUpdateEngine =================================

Package files for the engine update:
c:\ac6a1dfb1432aed55891156f6e\115.0.0.0_to_115.22.0.0_NISfull.vdm_source_NISbase.vdm._p (?.?.?.?)
c:\ac6a1dfb1432aed55891156f6e\nisbase.vdm (115.0.0.0)
c:\ac6a1dfb1432aed55891156f6e\nisfull.vdm (115.22.0.0)
c:\ac6a1dfb1432aed55891156f6e\gapaengine.dll (2.1.11804.0)

Updated from c:\ac6a1dfb1432aed55891156f6e (0x0)

================================= ValidateUpdate =================================

MpSigStub successfully updated Microsoft Security Essentials using the NIS Full package.

Original: Updated to:
NIS engine: 2.1.11804.0 2.1.11804.0
NIS base VDM: 115.0.0.0 115.0.0.0
NIS full VDM: 115.21.0.0 115.22.0.0

ERROR 0x80070005 : MpConfigSetValue(NISDeltaUpdateFailure)
ERROR 0x80070005 : UtilRegOpenKey64(SOFTWARE\Microsoft\Microsoft Antimalware\Miscellaneous Configuration)
Deleted c:\ac6a1dfb1432aed55891156f6e\115.0.0.0_to_115.22.0.0_NISfull.vdm_source_NISbase.vdm._p
Deleted c:\ac6a1dfb1432aed55891156f6e\gapaengine.dll
End time: 9/23/2015 3:25 PM
----------------------------------------------------------------------------------

[jdc2000]

Possibly useful links:

http://answers.microsoft.com/en-us/w...8bbf509?auth=1

http://answers.microsoft.com/en-us/p...4-c121b81247b9

[Welshjim]

Allthumbs--
Uninstall MS Security Essentials and then reinstall.
Do not uninstall MSSE KB's in the future. MSSE will update automatically as new KB's become available.
If you are also running Windows Defender, uninstall it.

[Train]

I would uninstall MSE, reboot and reinstall it.

[Allthumbs]

Jim and Train,

Thanks to you both for you assistance on this, I appreciate it.

MS antimalware properties file size 582 MB. I would like to delete this as I use Malwarebytes. Do you know where it resides or is it part of MSSE?

I did not find it in Control Panel Uninstall Programs. I did find it in Program Files (x86). According to a message box, Windows Defender is turned off. I hesitate to delete it from Program Files (x86), knowing there is probably a key somewhere that needs to be deleted too.

If I delete Security Essentials, from Control Panel Uninstall Programs, I will have to download a new copy from Microsoft from the web unless you or Train say otherwise.

The only KB's I deleted were pertaining to Win10. I don't plan on going with Win10 now or in the future.

[Train]

Download it first, now you can uninstall MSE, reboot and re install it.


Sometimes this is the only route open for us to get rid of corrupt stuff.

[Welshjim]

Allthumbs--
"MS antimalware"
I have never heard of that. What name is given in Program Files? Do you mean "Malicious Software Removal Tool"
http://www.microsoft.com/security/pc...e-removal.aspx
It is not a substitute for MalwareBytes or vice versa. You get a new version (and an automatic scan) with the Update Tuesday downloads. Leave it alone.

Windows Defender is turned off automatically if you use Win 7 and another antivirus program. It works only on spyware in Win 7. You will not miss it by uninstalling it, but leaving it "off" is just as good.
http://blogs.microsoft.com/cybertrus...one-do-i-need/

You can easily download a fresh copy of MS Security Essentials.
http://windows.microsoft.com/en-us/w...tials-download

[Allthumbs]

Jim,

I have been a bit remiss in getting back to you. The file is C:\ProgramData\Microsoft\Microsoft Antimalware\Support

\MpSupportFiles.cab. This is where MSE cab file is located when you do a scan of all MSE downloads. It’s also listed,like that when on a MS download begins. These are the downloads I have no control over. They usually begin at a time when I am on the web, which is most inconvenient.

Thanks for all your help on this.

John

I have enclosed the latest MpRunCmd.log:

MpCmdRun: Command Line: "c:\Program Files\Microsoft Security Client\MpCmdRun.exe" -UploadSQM -RestrictPrivileges
Start Time: ?Wed ?Sep ?30 ?2015 05:49:58

Run as Network Service
MpCmdRun: End Time: ?Wed ?Sep ?30 ?2015 05:49:58
-------------------------------------------------------------------------------------


-------------------------------------------------------------------------------------
MpCmdRun: Command Line: "c:\Program Files\Microsoft Security Client\MpCmdRun.exe" -IdleTask -TaskName MpIdleTask
Start Time: ?Wed ?Sep ?30 ?2015 06:09:44

Start: Idle Task - MpIdleTask


-------------------------------------------------------------------------------------
MpCmdRun: Command Line: "c:\Program Files\Microsoft Security Client\MpCmdRun.exe" SignatureUpdate -ScheduleJob -

RestrictPrivileges
Start Time: ?Wed ?Sep ?30 ?2015 16:17:45

Run as Network Service
MpCmdRun: End Time: ?Wed ?Sep ?30 ?2015 16:17:45
-------------------------------------------------------------------------------------


-------------------------------------------------------------------------------------
MpCmdRun: Command Line: "c:\Program Files\Microsoft Security Client\MpCmdRun.exe" SignaturesUpdateService -

ScheduleJob -UnmanagedUpdate
Start Time: ?Wed ?Sep ?30 ?2015 16:17:45

Start: Signatures Update Service
Update Started
Search Started (MU/WU update) (Path: http://www.microsoft.com)...
Search Completed
Update failed with hr: 0x8024402c
Update completed with hr: 0x8024402c
End: Signatures Update Service
MpCmdRun: End Time: ?Wed ?Sep ?30 ?2015 16:17:45

>>>>>To find the MSE log files:>>>>>>

The MpCmdRun function of MSE provides the ability to gather the following information/logs and packages them together in a

compressed file in the support directory. This information includes:
•Any trace files from Microsoft Antimalware Service
•The Windows Update history log
•All Microsoft Antimalware Service events from the System event log
•All relevant Microsoft Antimalware Service registry locations
•The log file of this tool
•The log file of the signature update helper tool

To run this tool, go to Start, All Programs, Accessories, right-click on Command Prompt, and select Run as Administrator.

Click YES at the UAC prompt.

Then, from the Command Prompt window, enter the following commands:
•cd\
•cd Program Files
•cd Microsoft Security Client
•MpCmdRun -getfiles -scan

At this point, logs will be collected and placed in a cab file. This process can take several minutes.

When the process is complete, you will find the collected information here:

Files successfully created in C:\ProgramData\Microsoft\Microsoft Antimalware\Support\MpSupportFiles.cab

Close the Command Prompt window.

Then, extract the logs from the cab file to a location of your choice, and browse, examine, peruse the logs and information.

Use Notepad to open and view the log files. Also, review this thread for more information regarding MSE logs and events.

[Welshjim]

Allthumbs--
I do not have the file, MpSupportFiles.cab, on my Win 7 SP1 PC. So I cannot give you any comments based on experience.
I suspect you still have Windows Defender as an active, installed program. It will conflict with Security Essentials and is really not a very useful program for Win 7 since it detects only spyware and not viruses and other malware.
I would uninstall Windows Defender.
If that does not help, then uninstall Security Essentials and reinstall. Download site
http://windows.microsoft.com/en-us/w...tials-download

[Allthumbs]

Jim,
Windows Defender wasn't listed as an installed program on Control Panel Uninstall. As I stated above, I found it in Program Files (x86) and deleted it. As far as Security Essentials is concerned, along with M$ Antimalware, I am going to uninstall both and go with another security system. Security Essentials problems...resolved.

Thanks for your help.

John

[Allthumbs]

Jim,

For whatever reason, MSE has straightened itself out. I now receive downloads with no problem, so I will keep MSE.

I also went with fiber optics for internet delivery. What a difference!

My Thanks to Fink for his "cancel my Win10 download" fix. Fink, you done real good.

Kindest regards,

Allthumbs