can't update important files and services while the system is using

drfhoule · 02 Dec 2012

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>reg query hklm\system\currentcontrolset\services\mpsdrv

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpsdrv
DisplayName REG_SZ @%SystemRoot%\system32\FirewallAPI.dll,-23092
Group REG_SZ network
ImagePath REG_EXPAND_SZ System32\drivers\mpsdrv.sys
Description REG_SZ @%SystemRoot%\system32\FirewallAPI.dll,-23093
ErrorControl REG_DWORD 0x1
Start REG_DWORD 0x3
Type REG_DWORD 0x1

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpsdrv\Enum

C:\Windows\system32>reg query hklm!system\currentcontrolset\enum\root\legacy_mps
drv
ERROR: Invalid key name.
Type "REG QUERY /?" for usage.

C:\Windows\system32>reg query hklm\system\currentcontrolset\enum\root\legacy_mps
drv

HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_mpsdrv
NextInstance REG_DWORD 0x1

HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\legacy_mpsdrv\0000

C:\Windows\system32>

NoelDP · 02 Dec 2012

They look OK - I was half-expecting one to be missing completely - we need to look a little deeper.
(it's easier if your copy/paste!)

Please run the following commands, and post the results....

REG QUERY HKLM\SYSTEM\CurrentControlSet\services\mpsdrv\Enum /S
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MPSDRV\0000 /S

drfhoule · 02 Dec 2012

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\services\mpsdrv\Enum
/S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mpsdrv\Enum
0 REG_SZ Root\LEGACY_MPSDRV\0000
Count REG_DWORD 0x1
NextInstance REG_DWORD 0x1

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MPS
DRV\0000 /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MPSDRV\0000
Service REG_SZ mpsdrv
Legacy REG_DWORD 0x1
ConfigFlags REG_DWORD 0x400
Class REG_SZ LegacyDriver
ClassGUID REG_SZ {8ECC055D-047F-11D1-A537-0000F8753ED1}
DeviceDesc REG_SZ @%SystemRoot%\system32\FirewallAPI.dll,-23092
Capabilities REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MPSDRV\0000\Control

ActiveService REG_SZ mpsdrv

C:\Windows\system32>

NoelDP · 02 Dec 2012

That's OK- and the final line means that the service is actually running.
....back to teh drawing-board!

drfhoule · 04 Dec 2012

My AVG tune-up license had expired so I uninstalled it. Even used the avg uninstaller from the command prompt but I still have a bunch of files that refuse to be deleted manually (see attached). Is there a command to delete all files containing the letters "avg"? Attachment 244254

NoelDP · 04 Dec 2012

You should not be able to see the content of the System Volume Information folders - they are the System Restore point data - if you remove the files manually, you'll break System Restore. Just wait a while, and they'll drop off the end of the storage tray.

The FileRepository files are so small you can ignore them - and they have no effect on the system anyhow.

The AVG folder in Tasks should be empty - if not, check Task Scheduler and delete any AVG tasks.