Installs fails with many applications. Avira Antivirus uninstall

Page 1 of 2 12 LastLast

  1. Posts : 12
    Windows 7 64 bit
       #1

    Installs fails with many applications. Avira Antivirus uninstall


    W7 SP1, 64 bit, English. AMD Phenom II CPU.
    Problems started a week ago, when Firefox and Thunderbird did not open application window: they only started the firefox.exe and thunderbird.exe processes, and that's it. And I could not kill those processes with Task Manager, Process Explorer or elevated rights TASKKILL /F /IM, NIRCMD killprocess or PSKILL64: only way to get rid of them was rebooting the computer. I am using administrator level user account.
    I know Firefox and Thunderbird won't start, if previous run parent.lock file exist in temp or profile folders, so I always removed them after rebooting computer and running Firefox or Thunderbird again.

    There was an important Windows update available, so I thought maybe it helps, and accepted, but it failed in both quality rollup and security update installs. Downloaded them manually, and they did install.
    As that didn't help, tried to update newest 442.19 GeForce drivers, as I had Firefox not responding-problems once untill I updated graphics drivers. Well that installation stuck right in the beginning, uninstalling the old drivers "Removing telemetry" phase. Tried clean install option then. It stuck in the first phase: "Preparing to install."
    Next failed Adobe Flashplayer install. Tried 3 times, stuck twice in 89% and once in 90%.
    GeForce drivers and Flash player updates I have done many times, don't recall seeing either stuck in installation before!
    Run Avira Antivirus scan. Did not find problems.
    Started to think Windows problems. Run SFC /Scannow. Didn't find problems. Run Microsoft File and Folder Troubleshooter winfilefolder.DiagCab, didn't find problems. Started disk repair tool. No problems. Went to USER account pages (C:\USERS) to verify my account has access to all the folders there. Some folders had Everyone account denied to list folder and read data: removed that.
    Uninstalled Firefox, and installed the newest version 73.0. Didn't start application window either. Couldn't kill the process.
    Decided to create a new Firefox profile with another administrator level account. Added -P into Firefox shortcut after target path. The window to create/choose profile did not open. Went to Windows SAFE MODE, and there the window opened, was able to create a new profile for the other account. Firefox didn't open as application though, not in Windows SAFE MODE nor in NORMAL MODE, only the process started. Same result after changing into the shortcut to use administrator rights to run Firefox. Also choosing to run as an administrator did not change anything.
    Thought to disable Avira antivirus real time protection. Didn't help. Decided to uninstall Avira, it had updated a new interface and components shortly before problems started. It's done by Windows Programs and Features, each component must be uninstalled separately. Two components installed cleanly, the OrganiZen speed up uninstalled dirty: a minimized window could not be popped open nor closed, but it disappeared from the installed applications list. Antivirus and VPN components didn't uninstall: they did ask do you want to uninstall, but nothing happened after answering YES. If I started another uninstall job, I got a window complaining that I must wait, one program is being changed or uninstalled already.
    Since the two Avira components resisted normal uninstalls, went to Windows SAFE MODE, managed to disable Avira services, and tried uninstalling again. Same failure. Back to safe mode trying to uninstall there. The VPN component did uninstall, and the component that says only "Avira", the antivirus component didn't.
    As Avira support suggested, I did run Microsoft Program Install and Uninstall troubleshooter to uninstall old Avira residue, and it did do some cleaning. There seems to be two versions of this cleaner: MicrosoftProgram_Install_and_Uninstall.meta.diagcab and Program_Install_and_Uninstall.diagcab. I used both.
    In case some other protection software caused problems, decided to remove their protections.
    I had Arovax Antispyware installed. Uninstalled that succesfully.
    Stopped all protections from Spyware Blaster, but didn't try to uninstall.
    Since Task Manager shows Data Execution Prevention (DEP) enabled with antivirus process avgnt.exe *32 decided to remove DEP protection: with admin rights command prompt this command WMIC OS Get DataExecutionPrevention_SupportPolicy showed I had the default setting (code value 2). Gave command bcdedit.exe /set {current} nx AlwaysOff andrebooted computer. Now WMIC showed the value was 0, which means DEP is disabled. HOWEVER, Task Manager still shows DEP enabled with many processes, including avgnt.exe, firefox.exe and thunderbird.exe.
    Run Kapersky TDSSKiller to seek rootkits. Didn't find anything, but the scan never ended. Closed the window, but the process couldn't be killed. Rebooted the computer.
    Went to F-Secure Online scanner page with IE 11. Started the scanner by selecting to run the file it wants you to run. Nothing happened. It did start two processes, but they didn't seem to do anything. Could not kill those processes, rebooted the computer.
    Tried to install new Spybot Search and Destroy. The install opened a minimized window that couldn't be popped front nor closed. Went to Windows SAFE MODE with networking, the install only opened the upper bar of the SS&D installation window, and stuck. Went to SAFE MODE without Networking support, and SS&D installed succesfully. Tried to update the detection files in Windows normal mode: SS&D stopped with not-responding window in the very beginning. Tried to update detection files in SAFE MODE, SS&D stopped again with not-responding window. Found a way to manually update the detection files, run the install to do that in Windows SAFE MODE without network support. Started SS&D, it didn't find any problems except couple of tracking cookies and log files.
    Unistalled Firefox as there is a new version 73.0.1 now. Didn't change a thing, still only the process starts.
    Still trying to uninstall Avira Antivirus and wondering why Task Manager shows DEP enabled. I have Avira's own avira_registry_cleaner_en.exe but that I did not run yet. Thought to do it after antivirus us uninstalled.
    Last edited by Nakkisoosi; 02 Mar 2020 at 11:48. Reason: Corrected wrong word.
      My Computer


  2. Posts : 12
    Windows 7 64 bit
    Thread Starter
       #2

    And DEP gets weirder and weirder.
    I haven't touched it again, WMIC still returns value 0 (DEP disabled) but with this Windows session Taskmanager shows many programs DEP as disabled, and others with enabled. For example (and yes, I notice how firefox.exe process is running and so is setup... I'll reboot to correct that) :
    disabled avgnt.exe
    enabled cmd.exe
    enabled csrss.exe
    disabled dllhost.exe
    enabled explorer.exe
    disabled eyerest.exe
    disabled Firefox setup 73.0.1.exe
    enabled firefox.exe
    enabled gamingApp_Service.exe
    enabled iexplore.exe
    disabled iexplore.exe (all other instances except one are disabled)
    enabled lsass.exe
    disabled MSI_ActiveX_Service.exe
    enabled notepad.exe
    enabled services.exe
    enabled svchost.exe (all instances enabled)

    To me this look more like DEP would have the default value 2 (OptIn), enabled for essentials Windows programs and services only. But then...why is it enabled for firefox.exe... while some other non-windows programs have it disabled?
    TWILIGHT ZONE WEIRD!
    Last edited by Nakkisoosi; 19 Feb 2020 at 06:35. Reason: A spell correction.
      My Computer


  3. Posts : 12
    Windows 7 64 bit
    Thread Starter
       #3

    Seems I'm talking to myself here. But...


    Firefox is now working.
    Thunderbird is not working, still doesn't open application window.
    Still haven't been able to uninstall Avira.
    DEP probably not the problem, and yes, definately can't get it disabled for all the application (in another thread I was told you can't disable DEP for 64-bit applications... seems to be correct).

    How I got Firefox working again? This was weird.

    UPDATE: Realize now how Firefox started working. I once opened ZoneAlarm to see if Flash Player installer was allowed or denied Internet access. I must have started Firefox the same session, and thus it managed to ask a permission from ZoneAlarm.


    There seems to be a problem with zombie processes. Maybe the unkillable Firefox and Thunderbird processes were zombies too. I noticed this problem with Guild Wars game. It left a process GW.exe into Task Manager, and I could not kill that either: same "access denied" error as Firefox and Thunderbird processes gave me. And also the GWsetup.exe left similar unkillable process - it did open an application window, but after closing the window the process was still in Task Manager.
    While GW.exe was still running according to Task Manager, I was however able to change permissions to the file, take ownership and even delete the file. Hence I think it is a zombie process.
    Last edited by Nakkisoosi; 09 Mar 2020 at 13:23. Reason: Realized now how Firefox started working
      My Computer


  4. Posts : 12
    Windows 7 64 bit
    Thread Starter
       #4

    Changing permissions to folders in C:\USERS was a mistake.
    Do not remove the deny listing folder permission from EVERYONE user! If you remove this deny permission, searches will have results to folders which have "Appdata" (or Application Data, don't recall which) folder listed multiple times in a row. The deny permission is there for a reason.
    Last edited by Nakkisoosi; 02 Mar 2020 at 11:34.
      My Computer


  5. Posts : 7,107
    W7 home premium 32bit/W7HP 64bit/w10 tp insider ring
       #5

    Hi

    I would shootover to BleepingComputers, they have excellent Malware support.

    They will require the output from this tool
    Download Farbar Recovery Scan Tool

    note some AV's regard it as malware its not, allow it

    There is also the Tweaking.com system tool, opt for the portable version
    in your case select the Repair Permissions changed by malware.


    Roy
      My Computer


  6. Posts : 12
    Windows 7 64 bit
    Thread Starter
       #6

    Thanks Roy, I shall.

    Installations continue failing...

    Uninstalled Thunderbird. Success! Deleted installation folder. Installed again the newest 64-bit version Thunderbird Setup 68.5.0.exe. Rebooted computer even though not asked. There's no parent.lock -files, checked. Disabled anti-virus real time protection. Thunderbird again won't open application window. Cannot kill thunderbird.exe process.

    Rebooted and tried Flash Player on-line installation. There was a new version since last attempt.
    After downloading the installation file and running it, the program opens the application window where it shows message: "Installation will begin shortly..."
    Takes long time, then finally window refreshed: "Application initialization error" and it has a button to "Finish." Clicking that the application closes.
    Trying to run the setup again. Complains that "Only a single copy of the installer can run at a time. Please close the other window and try again."
    There is no other window, but there's process "Flashplayer32ax_a_install.exe *32" which can't be killed.
    Because Flash Player log-file complained about HttpConnector errors, tried off-line installation, after reboot.
    Downloaded the latest firefox installer file from Installation problems | Flash Player | Windows 7 and earlier
    Running the installation file: asks permission to do changs to the computer. Yes, go ahead. After that nothing happens, does not open application window.
    Can't kill the install_flash_player.exe process.
      My Computer


  7. Posts : 7,351
    Windows 7 HP 64
       #7

    Do the basic first.

    Open a cmd window as administrator and type:
    chkdsk c: /f
    It will say the disk is in use and ask if you want to schedule no next restart = Yes
    Restart
    Pay attention on the results, specially bad blocks, bad clusters, bad sectors etc

    Back to windows, do a System File Check
    Open a cmd window as administrator and type:
    sfc / scannow

    Report
      My Computers


  8. Posts : 12
    Windows 7 64 bit
    Thread Starter
       #8

    Megahertz07 said:
    Do the basic first.

    Open a cmd window as administrator and type:
    chkdsk c: /f
    It will say the disk is in use and ask if you want to schedule no next restart = Yes
    Restart
    Pay attention on the results, specially bad blocks, bad clusters, bad sectors etc

    Back to windows, do a System File Check
    Open a cmd window as administrator and type:
    sfc / scannow

    Report
    You do the basics first and read my first comment. Already did those.
      My Computer


  9. Posts : 7,351
    Windows 7 HP 64
       #9

    Nakkisoosi said:
    You do the basics first and read my first comment. Already did those.
    Yes you did. I'm sorry.
    Your posts are so extensive that is difficult to remember all you did.
    Good luck.
      My Computers


  10. Posts : 12
    Windows 7 64 bit
    Thread Starter
       #10

    Solved at least part of the problems, maybe all. I'm still yet to try if it solved all.


    At least one problem was ZONEALARM firewall.


    Many (installation) programs want to take internet connections very early, apparently even before they open the application window. I downloaded early on the offline installations for Adobe Flashplayer, but even they wanted to have internet access (or maybe have sort of system access that ZoneAlarms asks a permission)! That's when the installations halted.


    Started to think there's some problem with network, when I saw the HTTPConnector error in Flash Player log. Then I realised that some Anti-Virus / Anti-Malware programs that failed their install, were so small they probably have to download stuff from Internent.


    Then I noticed that ZoneAlarm icon wasn't visible in Windows Taskbar. There should be an icon. I have ZoneAlarm set up to ask every time, when a new program wants to take internet connections. Suddenly it came to me that none of these programs had asked permissions for Intenet connection.


    I clicked ZoneAlarm in the Start Menu, THEN the program appeared into the Windows Taskbar! I've started Windows now a few time, and it happens every time that it fails to start properly and add the icon to Taskbar. When it doesn't, it prevents new programs to ask permission for internet connections. When the icon is in the Taskbar, ZoneAlarm works as it should.


    I'm wondering if that's the reason why these programs started processes can't be terminated by any process killing programs either, because Zonealarm is keeping hold of them processes.


    I'm close to set this thread solved. Will return shortly.
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 23:07.
Find Us