Solved Update for Microsoft Security Essentials - 4.9.218.0 (KB3140527)

[albertz]

MSE 4.9 was installed during SP1. I remember being able to reboot to the desktop. There was a previous 4.4 version that had been removed. (I should have paid better attention, I'm fairly certain of being able to reboot SP1 with MSE 4.9 installed.)

After installing SP2 upgrade via Windows update, the problem with the black screen began during login. I attempted a system restore and Macrium image to SP1, the same problem persisted with the black screen.

 

[Vistaar]

...There was a previous 4.4 version that had been removed...After booting to safe mode i used an old version of iobit uninstaller to uninstall MSE 4.9...I then used MSconfig to remove MSE from startup...mseinstall_en.exe was then able to successfully install MSE version 4.8...

Was your "fresh install" actually from an old image that included MSE 4.4? (I don't see why Windows Update would give you 4.4 when 4.9 supports SP1 - not that I would suggest installing MSE via Windows Update these days - or did your installation disk or image not include SP1 to begin with?)

As mentioned previously, MSE 4.9 has a new Administrator setting that makes it simple to disable. Perhaps a picture is worth a thousand words:



There have been numerous reports that this can be done in Safe Mode, and that those suffering from "black screen" are then able to log in normally - meaning they can uninstall MSE normally. I'm not an authority on uninstalling MSE because I never had to do it (my MSE 4.9 upgrade having been successful), but your report seems to suggest that uninstalling MSE in Safe Mode using Iobit is not the best way.

Where did you find an MSE 4.8.204.0 installer?

I really wish that someone suffering from "black screen" would try disabling ShellHWDetection service in Safe Mode before disabling MSE or otherwise restoring their system, in order to see if that alone would enable them to log in normally. This would not be an ideal solution (AutoPlay wouldn't work), but we might actually learn something. I also wish that someone would check Problem Reports and Solutions (via Control Panel > System and Maintenance) before restoring their system to see if they have a problem report, perhaps along the lines of this one:

Problem Event Name: MpTelemetry
Problem Signature 01: 0x80004004
Problem Signature 02: MpUpdateEngine
Problem Signature 03: AM Delta
Problem Signature 04: 11.1.5276.0
Problem Signature 05: mpsigstub.exe
Problem Signature 06: 4.9.218.0
Problem Signature 07: Microsoft Security Essentials
OS Version: 6.0.6002.2.2.0.768.3
Locale ID: 18441

Source: MpTelemetry problem - Microsoft Community

 

[albertz]

Ok, I'll need to go over the issues and possible remedies you have suggested.

Can't remember the website was listed as a MSE 4.8 installer "mseinstall.exe" after installation MSE shows Animalware Version 4.8.xxx

I'll need to look closer at your suggestions with the MSE 4.9 Admin. function and disabling ShellHWDetection service, while in safe mode. I just spent the entire night and morning upgrading Vista so I'm a bit tired as I never got any sleep, since Sunday night. It's currently Tuesday approx. noon, in my time zone.

In safe mode you deselect the Admin. "Turn on this app" essentially turning OFF the Spyware detection of MSE 4.9?

 

[Vistaar]

Let's say an MSE user running Vista who was affected by "black screen" in February revisits this thread to see if any solution has been found that would allow them to use the latest version of MSE. Do you think such a user would be fascinated by History of Vista installs and updates include two different Hard Drives? I think the chances that anyone will ever read this entire thread grow smaller with each post. (The answer dear MSE user is "no": Some Vista systems were affected, others were not, and we still haven't established what the difference was.)

My guess is that "version 4.8.xxx" is the prelease version from April 2015 that was never removed. Good luck with that!

 

[albertz]

Let's say an MSE user running Vista who was affected by "black screen" in February revisits this thread to see if any solution has been found that would allow them to use the latest version of MSE. Do you think such a user would be fascinated by History of Vista installs and updates include two different Hard Drives? I think the chances that anyone will ever read this entire thread grow smaller with each post. (The answer dear MSE user is "no": Some Vista systems were affected, others were not, and we still don't really know what the difference was.)

My guess is that "version 4.8.xxx" is the prelease version from April 2015 that Microsoft never removed. Good luck with that!

In my lifetime computers and computer science was at one time liken to Astrology and considered to be esoteric in nature and not really considered to be a science.

I agree with you, SP1 and SP2 installations aren't really relevant to MSE 4.9. I'll go back and re-edit and simplify my posts to be more relevant. It's sometimes becomes difficult to be both reasonable & scientific and human as well.
____________

Your post about the Admin option to disable or enable spyware detection as well as the ShellHWDetection service is to the point and probably one of the most relevant posts in this thread. Perhaps we should start here and make a list, perhaps a short list, of what we know of MSE 4.9. This would be more of a scientific approach to solve the problems some are having after installing the MSE 4.9 update.

Partial MSE 4.9 problems list:

_ Admin Option to enable or disable spyware detection
_ ShellHWDetection service (what is it and how to disable)
_ Uninstalling MSE 4.9 in safe mode
_ MSE's installer exe file /U (uninstall switch)
_ Version of the MSE installer (e.g. is the installer a true 4.8 version, is it 32 or 64 bit, etc.)
_ What is the true nature of the black screen, why does it exist and become stuck after installing MSE 4.9 (possibly it happens because spyware detection is enabled and/or because of the ShellHWDetection service.
_ why does MSE 4.9 black screen problem only occur on some PC's?
____________________________

I'm unable to find the MSE 4.8 download links I had previously used. Some sites will show a MSE 4.8 link which is actually downloads MSE 4.9.

My guess is that "version 4.8.xxx" is the prelease version from April 2015 that was never removed. Good luck with that!

Quite possibly, here's the info displayed from my MSE "About"

Antimalware Client Version: 4.8.204.0
Engine Version: 1.1.12902.0
Antivirus definition: 1.225.1863.0
Antispyware definition: 1.225.1863.0
Network Inspection System Engine Version: 2.1.12706.0
Network Inspection System Definition Version: 116.12.0.0
___________________________________________________
Information I have on the Pre-release Version
Version: 4.8.0203.0
File Name: MSEPrereleaseInstallx64.exe & MSEPrereleaseInstallx86.exe
Date Published:14/04/2015
File Sizes: 11.0 MB & 13.6 MB

Was your "fresh install" actually from an old image that included MSE 4.4? (I don't see why Windows Update would give you 4.4 when 4.9 supports SP1 - not that I would suggest installing MSE via Windows Update these days - or did your installation disk or image not include SP1 to begin with?)

No, it was an actual KBxxxxx download (no description) listed under Windows Update, below it was another download selection for MSE 4.9 (with "MSE 4.9.xxx" included as part of the selection). After installing the first version and clicking on Help>About, displayed Animalware version 4.4. - I then downloaded and installed from WU the MSE 4.9.
_____________________________

Here are a few supposedly MSE 4.8.204.0 download links. I'm unable to find other links I had previously used to download MSE 4.8. Perhaps some are being deleted with the advent of MSE 4.9

https://microsoft-security-essentials.en.uptodown.com/windows/download/306825
https://microsoft-security-essentials.en.uptodown.com/windows
Microsoft Security Essentials - Download

 

[albertz]

ShellHWDetection service

After installing MSE 4.9, disabling the ShellHWDetection service. I rebooted where there was a lengthy delay of several mins. With a message "configuring your desktop".

Eventually I was able to login to a desktop with no color, no icons, using a grey background. There was a Start Menu, however none of the items from the start menu would run. No method to access services.msc, control panel, etc. No method that I could find to run a program or command prompt.

During login there was an error message box that stated to the effect that Windows was unable to find a device which could be any sort of device including a Hard drive.

The error message listed the path: "C:\Windows\System32\config\systemprofile\desktop", could not be found.

After a normal boot, when I go to C:\Windows\System32\config\systemprofile there is no "desktop" folder.
___________

MSE 4.9 Administrator "Turn on this App" option.

After rebooting to Safe Mode I renabled the ShellHWDetection service (automatic).

Then went into MSE 4.9 and enabled the Administrator "Turn on this App" option.

After a reboot to Windows Desktop there was a message MSE was not running. Trying to open MSE produced an error message. I was eventually able to get MSE 4.9 running through the control panel's Security Centers Malware options settings.

I hope this helps some MSE users that are having difficulties running MSE 4.9. The only disadvantage I can see is MSE 4.9 will need to be manually started and the malware enabled sometime after login, through the Security Center. Unless of course someone has come up with some sort of fix or work around.

 

[Vistaar]

Your post about the Admin option to disable or enable spyware detection as well as the ShellHWDetection service is to the point and probably one of the most relevant posts in this thread...[There was a previous 4.4 version that had been removed.] No, it was an actual KBxxxxx download (no description) listed under Windows Update, below it was another download selection for MSE 4.9 (with "MSE 4.9.xxx" included as part of the selection). After installing the first version and clicking on Help>About, displayed Animalware version 4.4. - I then downloaded and installed from WU the MSE 4.9.

Why thank you! That's why I pointed out the new Administrator setting in post #24 (i.e. nobody has to uninstall MSE 4.9 in safe mode), and why I mentioned a report regarding ShellHWDetection in post #38.

MSE 4.4.304.0 was the last version to support XP. I'm having a hard time believing that Windows Update gave you that version in 2016. (When I reinstalled Vista in March 2015, the first MSE version installed was 4.7.205.0, which was current at the time.) However if Windows Update now offers Vista a choice of MSE versions to install, that might be construed as an acknowledgment by Microsoft that MSE 4.9 causes problems on many Vista systems. A better choice would be between 4.8 and 4.9, since earlier versions performed very poorly in tests by independent labs; so I wouldn't recommend using 4.4.

I will have to give your next post more consideration before replying to it.

 

[albertz]

I remember seeing Animalware version 4.4 from the Help>About. What I think happened is Windows Update was an older SP1 version and eventually upgraded itself several times to the latest version. One of the older WU versions such as prior to or after a SP1 update, may have listed some older updates such as the MSE 4.4 update.

Another thing to remember when installing MSE 4.9 on a PC with the black screen problem.

If your PC is restarted such as from Windows Update you need to remember to deselect MSE Administrator setting "Turn On this app" as the black screen problem will occur after a reboot if MSE is turned (Turning On MSE enables Virus and Malware monitoring and protection)

I normally use Sleep mode, but may forget about MSE when restarting. If MSE is turned on after restarting you would need to go back into Safe Mode and set MSE to off.
__________

Problems and reports lists an "Animalware Service Executable"

Details show:

Problem signature
Problem Event Name: MpTelemetry
Problem Signature 01: unspecified
Problem Signature 02: HardeningTelemetry
Problem Signature 03: HardeningTelemetryDisableAS
Problem Signature 04: 4.9.218.0
Problem Signature 05: unspecified
Problem Signature 06: unspecified
Problem Signature 07: unspecified
OS Version: 6.0.6002.2.2.0.256.1
Locale ID: 1033

Files that help describe the problem
client_manifest.xml

 

[Vistaar]

So disabling the ShellHWDetection service had a noticeable positive effect, but was far from a solution. I would say there is definitely a conflict involving services.

Thanks for noting how to turn MSE 4.9 back on. (Others typically uninstalled it at that point.)

Problem signature
Problem Event Name: MpTelemetry
Problem Signature 01: unspecified
Problem Signature 02: HardeningTelemetry
Problem Signature 03: HardeningTelemetryDisableAS
Problem Signature 04: 4.9.218.0
Problem Signature 05: unspecified
Problem Signature 06: unspecified
Problem Signature 07: unspecified
OS Version: 6.0.6002.2.2.0.256.1
Locale ID: 1033

Files that help describe the problem
client_manifest.xml

Thank you so much for sharing that problem report albertz! After searching for other problem reports containing "HardeningTelemetryDisableAS," it appears to confirm something that I have suspected for quite some time.

Here's a thread from 2013 showing similar symptoms, involving Windows Defender after upgrading to Windows 8.1: http://answers.microsoft.com/en-us/...f-errors/db4c4b76-e2fb-4501-94cb-3a828d22f6cd. For the benefit of those who prefer to read as little as possible, post #1 includes this:

Problem signature:
P1: unspecified
P2: HardeningTelemetry
P3: HardeningTelemetryDisableAS
P4: 4.3.9600.16384
P5: unspecified
P6: unspecified
P7: unspecified

Post #2 contains an astute reply: "By any chance, are you using Avast antivirus on your computer? If yes, try uninstalling and reinstalling the antivirus." In the third and final post, the OP confirms "I do run Avast..."

Here's another thread started by an Avast user. If you scroll to the very bottom of the data provided in his post #4, you will find the telltale problem signature: New computer lagging - Tech Support Forum.

As I already pointed out in post #61, the best evidence I could find anywhere regarding this "black screen" issue strongly suggests that it affects those who have both Avast and MSE installed for no good reason I am aware of. They way this discussion is going, I better post a link to post #61: http://www.vistax64.com/windows-upd...ntials-4-9-218-0-kb3140527-7.html#post1407283.

Of course Avast isn't the only possibility. Here's a similar thread, unfortunately in another language - but the replies clearly discuss "McAfee": http://answers.microsoft.com/pl-pl/...elemetry/3857d3dd-62eb-4d1d-a186-fc760c31b51b.

If the only remaining question is, "How can I use both Antivirus X and MSE 4.9 like I did previously with 4.8?" then I don't really know or care. You might try keeping MSE 4.9 disabled except when Antivirus X is disabled, or simply stay with 4.8. If you don't completely trust Antivirus X and want to double-check by occasionally scanning with a Microsoft product, then I would suggest Microsoft Safety Scanner: https://www.microsoft.com/security/scanner/en-us/default.aspx.

I have used MSE 4.9 on my Vista PC (which has no third-party antivirus installed) for four months now, and I have not seen any black screens or HardeningTelemetry problem reports whatsoever!

 

[albertz]

S
I have used MSE 4.9 on my Vista PC (which has no third-party antivirus installed) for four months now, and I have not seen any black screens or HardeningTelemetry problem reports whatsoever!

I don't run any 3rd party firewall or antivirus either. On XP systems yes, have run 3rd party firewalls and antivirus applications.

I don't think it's currently necessary for my PC, to replace MSE and Windows Firewall with 3rd party for Vista, Windows 8 & 10 when they are currently supported with security updates and antivirus/malware definitions.

When I purchased my Thinkcentre new back in 07 it came with it's own OEM Symantec firewall and antivirus. When the definition updates eventually stopped I switched to another 3rd party antivirus and eventually another 3rd party firewall.

I have used various Microsoft anti-virus softwares. IIRC, MS originally offered or included Windows Defender AKA Microsoft AntiSpyware. Which is still installed by default on different versions of Windows including Vista.

One MS app I've not used is MS's stand-a-alone virus offline scanner. The name of the files that can be downloaded from Microsoft are mssstool64.exe for 64-bit systems and mssstool32.exe for 32-bit systems. I've seen it for download from MS site and referred to as MSE stand alone offline scanner, appears to be the same as Windows Defender off-line scanner. Cannot be run under windows, must be installed and run from either flash or cd/dvd drive. This scanner will perform a scan for difficult to detect virus and malware undetectable by MSE running under Windows.
____________________________

I'm not certain why some are having a black screen problem and others are not. My Vista is a virgin fresh install without any 3rd party software installed.

I thought perhaps there was a conflict with hardware or video drivers? Installing different video drivers from Microsoft, Lenovo and Intel, didn't make any difference.

Characteristics of this problem seems to be related to the desktop loading and Desktop Window Manager while logging in.

Note: I don't know if it should make any difference. When installing MSE 4.9 any important updates for SP1 had already been downloaded and installed.

 

[albertz]

Update for Microsoft Security Essentials - 4.9.218.0 to version 4.10.205.0

It seems that the latest MSE update to MSE version 4.10.205.0 has fixed my logon problem(s). At least under my Windows Vista 64-Bit installation.

A MSE 4.10.205.0 update showed up via Windows Update. I'm currently experiencing no login problems as with MSE ver. 4.9.

Update for Microsoft Security Essentials - 4.10.205.0 (KB3193414)

10/2/2016 Virus and Spyware definitions: 1.229.709.0

 

[Vistaar]

It seems that the latest MSE update to MSE version 4.10.205.0 has fixed my logon problem

Glad to hear it! Personally, I'm still using MSE version 4.9.218.0 on my Vista PC, and I've hidden the latest upgrade. I've still never seen your "logon problem" myself; however while you were away from the forums, another Avast user belatedly upgraded his MSE with the usual result: http://www.vistax64.com/crashes-debugging/304672-cant-boot-windows-anything-but-safe-mode.html.

I'm sticking with MSE 4.9 for the time being not only because it has a proven track record of not causing any problems on my Vista PC, but because it has performed quite well in tests by independent labs. Just as you once wondered whether MSE 4.9 was any more effective than 4.8, I now wonder the same thing about 4.10. Here's an AV-Test link that shows their entire testing history of MSE on Windows 7 from version 1.0 in June 2010 (bottom) to version 4.9 in August 2016 (top): https://www.av-test.org/en/antivirus/home-windows/manufacturer/microsoft/.

AV-Comparatives is still conducting Real-World Protection Tests on Windows 7 this year. Here's a table showing protection rates for three products since version 4.9 was introduced:

Month	Avast	MSE 4.9	McAfee
May	98.6%	97.7%	95.4%
June	98.0%	97.4%	98.4%
July	99.7%	97.5%	96.9%
August	99.1%	96.2%	98.8%
Average	98.8%	97.2%	97.4%

Source: https://www.av-comparatives.org/dynamic-tests/

I included McAfee mainly to show that paying money for an antivirus doesn't necessarily get you much better protection. The best paid antivirus products consistently score very close to 100%, but McAfee obviously isn't one of the best. If truth be told, McAfee ended support for Vista a year ago, to which I say "good riddance!" Some may wonder why I prefer MSE when Avast Free appears to offer somewhat better protection. If Avast is anything like other "free" third-party antivirus products I have tried in the past, it would incessantly nag me to upgrade to a paid version, whereas MSE has no agenda.

Speaking of nagging, the latest MSE 4.10 might possibly be programmed to nag us regarding the impending end of support for Windows Vista, just as MSE 4.5 did for XP: Microsoft Security Essentials to nag Windows XP users | ZDNet.

There have already been issues reported with 4.10: https://answers.microsoft.com/en-us...vailable/a1f4ba69-4735-4618-9b23-82acf3701247.

 

[albertz]

Speaking of nagging, the latest MSE 4.10 might possibly be programmed to nag us regarding the impending end of support for Windows Vista, just as MSE 4.5 did for XP: Microsoft Security Essentials to nag Windows XP users | ZDNet.

There have already been issues reported with 4.10: https://answers.microsoft.com/en-us...vailable/a1f4ba69-4735-4618-9b23-82acf3701247.

I haven't experienced any sort of nag with MSE 4.10.

MSE 4.10 doesn't appear to have any right-click option to scan files. Though I seem to remember it being there, I don't remember ever using a right-click scan file option under version 4.9.

The Admin setting feature of ver. 4.9 is gone under ver. 4.10. Was most likely removed as it's no longer needed.

What I'm satisfied about with ver. 4.10 is I'm now able to login without first going into Safe Mode and turning the Admin setting to off. I would often forget to change the admin setting before a restart, then need to reboot again into safe mode each time to turn the admin setting to off.

 

[erpster4]

I haven't experienced any sort of nag with MSE 4.10.

MSE 4.10 doesn't appear to have any right-click option to scan files. Though I seem to remember it being there, I don't remember ever using a right-click scan file option under version 4.9.

The Admin setting feature of ver. 4.9 is gone under ver. 4.10. Was most likely removed as it's no longer needed.

What I'm satisfied about with ver. 4.10 is I'm now able to login without first going into Safe Mode and turning the Admin setting to off. I would often forget to change the admin setting before a restart, then need to reboot again into safe mode each time to turn the admin setting to off.

Version 4.10.209 of MSE was officially released recently on November 29, 2016:
https://www.microsoft.com/en-us/download/details.aspx?id=5201
This version fixed the missing "right-click" option problem that v4.10.205 had but the Admin setting option is still gone from the Settings tab.

By the way version 4.8 of MSE can be found at these Filehippo links - 32bit / 64bit
Also, MSE silently installs the KB981889 hotfix on Vista SP2 & Win7 RTM to ensure MSE runs properly on those versions of Windows