Page 2 of 2 FirstFirst 12
Results 16 to 24 of 24

Thread: Windows installer V3

  1. #16
    ron123 Guest

    RE: Windows installer V3

    just had the same problem. Its not permissions there is a driver trapping the
    registry access. It hides in sys32\drivers as a legacy driver, I used Root
    Kit Analyzer(free) to find it. Find the name then delete it in safe mode and
    tidy up the registry.
    Ron

    "haloterry" wrote:

    > There are some programs I couldn't load due to error messages from Windows
    > installer. I attempted to update my installer to v3 but I keep getting a
    > message "unable to load", any ideas?
    > --
    > Terry in Help


  2. #17
    haloterry Guest

    RE: Windows installer V3

    is there a particular file name I should be looking for?
    --
    Terry in Help


    "ron123" wrote:

    > just had the same problem. Its not permissions there is a driver trapping the
    > registry access. It hides in sys32\drivers as a legacy driver, I used Root
    > Kit Analyzer(free) to find it. Find the name then delete it in safe mode and
    > tidy up the registry.
    > Ron
    >
    > "haloterry" wrote:
    >
    > > There are some programs I couldn't load due to error messages from Windows
    > > installer. I attempted to update my installer to v3 but I keep getting a
    > > message "unable to load", any ideas?
    > > --
    > > Terry in Help


  3. #18
    MowGreen [MVP] Guest

    Re: Windows installer V3

    Posted by Martin:

    " > the solution for this problem is to remove a hidden PNP driver.
    > Open XP Device Manager.
    > Select "Show Hidden Devices" from Menue.
    > Open PNP Tree and look for a driver named lime "swuurqlm.sys".
    > Disable or delete this driver and Reboot.


    He meant Non-Plug and Play driver
    *Right* click My Computer either on the Desktop or Start Menu and choose
    Manage [ this is the Computer Management module ]

    In the left frame, click the plus sign next to System Tools
    Click on Device Manager
    On the menu bar at the top, click View, Show hidden devices
    Click the plus sign next to Non-Plug and Play Drivers
    Look for a randomly named driver, such as the one Martin listed above,
    swuurqlm.sys. When you locate any of such, go to Google and see if there
    are any hits for it. IF *none* appear or all the hits lead to
    anti-malware forums then that's the culprit.
    Boot to Safe Mode to delete the malware-related driver.
    It should be located in WINDOWS\system32.

    IF there is *no* hidden driver [s], then suggest you stop the Windows
    Installer service prior to another attempt at installing Windows
    Installer 4.5.
    The Services and Applications module is in Computer Management, the same
    place that Device Manager is, Terry.
    Look for it in the left frame.

    IF you're having difficulty removing this 'driver', than suggest you
    read this, and then post to the HijackThis Logs forum for expert
    assistance: http://aumha.net/viewtopic.php?f=30&t=4075
    Forum: http://aumha.net/viewforum.php?f=30

    MowGreen [MVP 2003-2008]
    ===============
    *-343-* FDNY
    Never Forgotten
    ===============



    haloterry wrote:

    > is there a particular file name I should be looking for?


  4. #19
    CBNY01 Guest

    Re: Windows installer V3

    Hey - I have been struggling with this exact same issue. I have been through
    all the articles. Here is what fixed it for me. In the hidden devices under
    the 'Non PNP' tree, there was a driver named XQIXWOPP. Once i removed this
    and rebooted, I could access the registry keys again.

    "MowGreen [MVP]" wrote:

    > Hello, Terry ? If you see this suggest you read this and then post to
    > the HijackThis Logs forum:
    > http://aumha.net/viewtopic.php?f=30&t=4075
    >
    > HijackThis Logs
    > http://aumha.net/viewforum.php?f=30
    >
    > At the very least, we'll determine if the system has been cleaned up and
    > what damage was done.
    >
    > MowGreen [MVP 2003-2008]
    > ===============
    > *-343-* FDNY
    > Never Forgotten
    > ===============
    >
    >
    > > haloterry wrote:
    > >
    > >> First let me say, thanks for all the help you are giving me. I can see
    > >> a few people are having this problem....
    > >> Now, even afte showing all hidden files, per the instructions you sent
    > >> me to, there is no "C:\windows\$NtUninstallKB942288-v3$" in my Windows
    > >> directory. I conducted a search, looking in hidden and system files.
    > >> Anything else to try?
    > >>

    > >
    > > haloterry *previously* wrote:
    > >
    > >> I have XP Meida but the trouble started after Norton remoted into my
    > >> computer to fix viruses. Now I can't install anything because I get
    > >> error messages on anything I try to install referring to the windows
    > >> installer. I went to Microsoft to get a new version and it won't
    > >> install, just stops and saids it failed.
    > >> -- Terry in Help

    > >
    > >

    >


  5. #20
    MowGreen [MVP] Guest

    Re: Windows installer V3

    Great ! At this point in time you'd best ensure that there's no other
    hidden malware on the system. If not, suggest this system
    *** NOT be Trusted *** as you've already found one hidden driver.

    If you need any recommendations as to what to do next, just ask CBNY01.

    MowGreen [MVP 2003-2008]
    ===============
    *-343-* FDNY
    Never Forgotten
    ===============


    CBNY01 wrote:

    > Hey - I have been struggling with this exact same issue. I have been through
    > all the articles. Here is what fixed it for me. In the hidden devices under
    > the 'Non PNP' tree, there was a driver named XQIXWOPP. Once i removed this
    > and rebooted, I could access the registry keys again.
    >
    > "MowGreen [MVP]" wrote:
    >
    >
    >>Hello, Terry ? If you see this suggest you read this and then post to
    >>the HijackThis Logs forum:
    >>http://aumha.net/viewtopic.php?f=30&t=4075
    >>
    >>HijackThis Logs
    >>http://aumha.net/viewforum.php?f=30
    >>
    >>At the very least, we'll determine if the system has been cleaned up and
    >>what damage was done.
    >>
    >>MowGreen [MVP 2003-2008]
    >>===============
    >> *-343-* FDNY
    >>Never Forgotten
    >>===============
    >>
    >>
    >>
    >>>haloterry wrote:
    >>>
    >>>
    >>>>First let me say, thanks for all the help you are giving me. I can see
    >>>>a few people are having this problem....
    >>>>Now, even afte showing all hidden files, per the instructions you sent
    >>>>me to, there is no "C:\windows\$NtUninstallKB942288-v3$" in my Windows
    >>>>directory. I conducted a search, looking in hidden and system files.
    >>>>Anything else to try?
    >>>>
    >>>
    >>>haloterry *previously* wrote:
    >>>
    >>>
    >>>>I have XP Meida but the trouble started after Norton remoted into my
    >>>>computer to fix viruses. Now I can't install anything because I get
    >>>>error messages on anything I try to install referring to the windows
    >>>>installer. I went to Microsoft to get a new version and it won't
    >>>>install, just stops and saids it failed.
    >>>>-- Terry in Help
    >>>
    >>>


  6. #21
    GrahamD Guest

    Re: Windows installer V3

    I too have suffered with this problem and can summarise a few points which
    may be of assistance to others;

    First of all the Non PNP driver name is random - on my system it was ZJZRRRR
    - which makes it easy to spot (fortunately!)

    Secondly, for those that are confused by the existence, or otherwise, of the
    "C:\windows\$NtUninstallKB942288-v3$" directory this is created when you run
    the Windows Installer install program but gets removed afterwards.

    On my system even after disabling the driver, removing the offending file
    and re-booting, I still couldn't edit the DllVersion registry key but then,
    suddenly, Norton popped up and re-discovered the offending file which seems
    to have found its way back onto the system so beware. The filename was the
    same in this case.

    Once I was able to edit the registry key I thought I could then go ahead and
    re-install the Windows Installer but it wasn't that simple. I tried this in
    Safe mode and it appeared to work but still the installer was not working.
    Starting the Installer server resulted in in stopping again straight away
    which is not correct. Although this service is set to manual, it should
    start, and stay running. The cure for this was to de-register and then
    re-register the service. Please see; http://support.microsoft.com/kb/555175
    for details of how to do this.

    I now have this system working in all but one respect, the Win Installer
    does not appear in the list of Add/Remove programs for some reason.

    My final comment is that nowhere have I seen reference to what causes this
    problem i.e. what virus or trojan can be accredited (if that's the right
    word!) with this thorn in the side (polite version)? Any ideas?

    "MowGreen [MVP]" wrote:

    > haloterry wrote:
    >
    > > I did both a visual and computer search, there is no file under that name, I
    > > did look in hidden files also.

    >
    > What about the folder, does it exist ?
    >
    > C:\windows\$NtUninstallKB942288-v3$ <---- this one
    >
    > How to show hidden files, folders, and *system files*
    > http://www.bleepingcomputer.com/tuto...l62.html#winxp
    >
    > The file is a *system* file, Terry.
    >
    >
    > MowGreen [MVP 2003-2008]
    > ===============
    > *-343-* FDNY
    > Never Forgotten
    > ===============
    >


  7. #22
    MowGreen [MVP] Guest

    Re: Windows installer V3

    >> My final comment is that nowhere have I seen reference to what causes this
    >> problem i.e. what virus or trojan can be accredited (if that's the right
    >> word!) with this thorn in the side (polite version)? Any ideas?


    Then you haven't looked very hard. It's mentioned in this thread and
    numerous others that cite a disabled Automatic|Windows update service,
    which apparently you can't see because you are using a "Web-based
    newsreader". From the headers of your post:

    > X-newsreader: Microsoft CDO for Windows 2000


    The malware in question is Vundo/Virtumonde/Zlob.
    The randomly named Non PnP 'driver' is a rootkit-like component.

    > Secondly, for those that are confused by the existence, or otherwise, of the
    > "C:\windows\$NtUninstallKB942288-v3$" directory this is created when you run
    > the Windows Installer install program but gets removed afterwards.


    No, that's incorrect. The subfolder you've cited is the UNinstall folder
    for Windows Installer. There is no mention on either the Download page
    nor the KB article that it can be uninstalled from Add/Remove Programs.
    The previous version of Windows Installer could be uninstalled from ARP.


    MowGreen [MVP 2003-2008]
    ===============
    *-343-* FDNY
    Never Forgotten
    ===============




    GrahamD wrote:

    > I too have suffered with this problem and can summarise a few points which
    > may be of assistance to others;
    >
    > First of all the Non PNP driver name is random - on my system it was ZJZRRRR
    > - which makes it easy to spot (fortunately!)
    >
    > Secondly, for those that are confused by the existence, or otherwise, of the
    > "C:\windows\$NtUninstallKB942288-v3$" directory this is created when you run
    > the Windows Installer install program but gets removed afterwards.
    >
    > On my system even after disabling the driver, removing the offending file
    > and re-booting, I still couldn't edit the DllVersion registry key but then,
    > suddenly, Norton popped up and re-discovered the offending file which seems
    > to have found its way back onto the system so beware. The filename was the
    > same in this case.
    >
    > Once I was able to edit the registry key I thought I could then go ahead and
    > re-install the Windows Installer but it wasn't that simple. I tried this in
    > Safe mode and it appeared to work but still the installer was not working.
    > Starting the Installer server resulted in in stopping again straight away
    > which is not correct. Although this service is set to manual, it should
    > start, and stay running. The cure for this was to de-register and then
    > re-register the service. Please see; http://support.microsoft.com/kb/555175
    > for details of how to do this.
    >
    > I now have this system working in all but one respect, the Win Installer
    > does not appear in the list of Add/Remove programs for some reason.
    >
    > My final comment is that nowhere have I seen reference to what causes this
    > problem i.e. what virus or trojan can be accredited (if that's the right
    > word!) with this thorn in the side (polite version)? Any ideas?
    >
    > "MowGreen [MVP]" wrote:
    >
    >
    >>haloterry wrote:
    >>
    >>
    >>>I did both a visual and computer search, there is no file under that name, I
    >>>did look in hidden files also.

    >>
    >>What about the folder, does it exist ?
    >>
    >>C:\windows\$NtUninstallKB942288-v3$ <---- this one
    >>
    >>How to show hidden files, folders, and *system files*
    >>http://www.bleepingcomputer.com/tuto...l62.html#winxp
    >>
    >>The file is a *system* file, Terry.
    >>
    >>
    >>MowGreen [MVP 2003-2008]
    >>===============
    >> *-343-* FDNY
    >>Never Forgotten
    >>===============
    >>


  8. #23
    bpetrikic@gmail.com Guest

    Re: Windows installer V3

    damn... i lost 3 days on my friends box... well, 1.5 days to remove
    outdated norton security something

    thanks to everyone, this saved me...

    also thanks for the headsup on rootkit analyzer...

    btw, yeah it was infected with antivirus 2008, I have found everything
    and removed it with hijackthis, than lost a lot of time to kill
    nortons s**t and then install new antivirus - can't? - wtf - registry
    corrupted - search around the net

    I should have realized it my self - when in safe mode registry works
    ok, when in normal mode it does not

    anyway thanks again

    Boris

  9. #24
    michiel.peeters Guest

    Youre God!

    Quote Originally Posted by Martin View Post
    Hi,

    the solution for this problem is to remove a hidden PNP driver.
    Open XP Device Manager.
    Select "Show Hidden Devices" from Menue.
    Open PNP Tree and look for a driver named lime "swuurqlm.sys".
    Disable or delete this driver and Reboot.
    Voila.

    Regards
    Martin
    THANKS! I spend about 12 hours on this problem, tried everything, couldnt reinstall xp because our costumer had alot of software installed on his computer and didnt had all the original CD's.

    I searched the hidden "non plug and play devices" for abnormal service names, mine called "TMOXVJRV" i disabled it, restart the computer, everything was normal again!!!!

    I LOVE YOU!

Page 2 of 2 FirstFirst 12

Similar Threads

  1. Replies: 24
    Last Post: 07-05-2012, 11:11 AM
  2. Replies: 5
    Last Post: 29-03-2011, 07:49 PM
  3. Replies: 6
    Last Post: 02-08-2010, 09:47 AM
  4. Replies: 5
    Last Post: 27-12-2007, 08:46 AM
  5. Replies: 0
    Last Post: 11-10-2006, 12:29 PM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
Page generated in 1,634,881,991.93435 seconds with 17 queries