Solved Update for Microsoft Security Essentials - 4.9.218.0 (KB3140527)

[Vistaar]

If anyone would dare to try again...

I left out what might be the most important step: Before installing MSE 4.9, it might be a very good idea to run this: https://www.avast.com/uninstall-utility.

Granted, no affected user in the present thread ever mentioned using Avast, but I have searched far and wide for more information about this issue. (Never before have I spent so much time researching a computer issue that did not affect me.) Here's a thread posted nearly five years ago: Black Screen - Windows 7 Help Forums. In post #4 the original poster acknowledges using Avast on all three systems that were affected by an MSE upgrade.

Here's a March 4 post right here at Vista Forums: http://www.vistax64.com/general-dis...ck-after-i-enter-my-password.html#post1406294.

In post #39 of the present thread I posted a link to a Geeks to Go thread in which a Vista system stricken by "black screen after login" was subjected to intensive analysis. Here's a revealing excerpt:

Additional scan result of Farbar Recovery Scan Tool (x86) Version:05-03-2016 01

==================== Security Center ========================
 
AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

If either Avast or Microsoft has a support page recommending that both programs should be installed, that would certainly be news to me. Can anyone provide a link?

 

[townsbg]

If either Avast or Microsoft has a support page recommending that both programs should be installed, that would certainly be news to me. Can anyone provide a link?

I highly doubt that M$ is ever going to recommend any product that they don't own unless they are paid to. Generally it is a bad idea to put two actively scanning AV products on the same computer.

 

[Vistaar]

Generally it is a bad idea to put two actively scanning AV products on the same computer.

I quite agree. Did you see my previous post #60? MSE 4.9 scored an impressive 97.7% in AV-Comparatives real-world protection tests during May 2016. (Granted, Avast scored slightly better at 98.6%, and some of the best paid products achieved 100%.) MSE 4.8 got its best score in March (95.5%), but then slipped somewhat in April. So the 4.9 upgrade appears to have been an improvement.

 

[albertz]

I'm still running version 4.8. I'm not certain if 4.9 is any more secure than 4.8.

I don't have any additional security and other 3rd party software's running that should interfere with 4.9 working after a reboot. Possibly there could be an issue with video drivers?

My Window Update stopped working (possibly because of MS Windows Update server isn't available) So I'm unable to attempt another 4.9 update.

I think if MS isn't able to reproduce a bug the problem is de-prioritized until a bug can be reproduce by MS program developers.

 

[Vistaar]

I don't have any additional security and other 3rd party software's running that should interfere with 4.9 working after a reboot. Possibly there could be an issue with video drivers?

Thank you for returning to this discussion albertz! As you can see, the second half of your thread is mainly me trying to figure out what happened to others after the fact. In retrospect, I wish I had installed the upgrade in February because it does work on Vista; but posts here and elsewhere persuaded me to steer clear of it for a month.

Having read virtually every word that has been posted anywhere about this issue (at least in English; there were plenty of posts in other languages also), I must admit that you are not the first to say that no third-party security software was running; so perhaps it was just coincidental that some of those affected were Avast users who also had MSE installed for no good reason. If you wouldn't mind a couple of follow-up questions: Have you ever used Avast? And have you ever uninstalled any antivirus without using the vendor's removal tool?

Regarding video cards and drivers: I can tell you that the issue affected systems with both ATI and NVidia cards; and that I am using the most up-to-date driver that NVidia recommends for my specific card - which is definitely not the driver that Windows Update would have me use (that one can be found among my Hidden Updates along with Skype, Windows Live Essentials and every version of Silverlight). If you ever fill out your System Specs, be sure to include your graphics card.

MSE 4.9 might be the last client version to support Vista, and I would really like to definitively establish the cause of your issue. Did you save the 64-bit 4.8.204.0 installer? (Microsoft removed it in April.) I saved the 32-bit installer, and I also have an image made in March just before I installed the 4.9 upgrade just in case. (As you have recently found, a Macrium disc is a very handy thing to have.) I saw one report that this issue involves the ShellHWDetection service, which is related to AutoPlay. Have you had any problems with AutoPlay? And was any removable storage media inserted when the issue occurred? Oh, and feel free to give me the third degree in return.

 

[albertz]

Have you ever used Avast? And have you ever uninstalled any antivirus without using the vendor's removal tool?

No this installation I haven't installed any system wide 3rd party software that effects the OS at all, trying to keep the installation simple. I have several utilities installed but no major applications.

Regarding video cards and drivers: I can tell you that the issue affected systems with both ATI and NVidia cards; and that I am using the most up-to-date driver that NVidia recommends for my specific card - which is definitely not the driver that Windows Update would have me use (that one can be found among my Hidden Updates along with Skype, Windows Live Essentials and every version of Silverlight). If you ever fill out your System Specs, be sure to include your graphics card.

MSE 4.9 might be the last client version to support Vista, and I would really like to definitively establish the cause of your issue. Did you save the 64-bit 4.8.204.0 installer?

I may have saved installer somewhere, but I can't be certain without searching through over 600 Gigs of file backups, reference files, documents, etc.

My video adapter is an Intel Q965/Q963 Express Chipset Family (GMA 3000). Hardware and drivers haven't ever exhibited any problems or conflicts.

(Microsoft removed it in April.) I saved the 32-bit installer, and I also have an image made in March just before I installed the 4.9 upgrade just in case. (As you have recently found, a Macrium disc is a very handy thing to have.) I saw one report that this issue involves the ShellHWDetection service, which is related to AutoPlay. Have you had any problems with AutoPlay? And was any removable storage media inserted when the issue occurred? Oh, and feel free to give me the third degree in return.

No problems with AutoPlay.

Yes the Macrium Disk is very beneficial. It has many features and provides user control over disk backup and cloning.

 

[Vistaar]

No this installation I haven't installed any system wide 3rd party software that effects the OS at all...No problems with AutoPlay.

When I reinstalled Vista from a factory image in March 2015 (there was a Cyberlink suite in the software package that I was very attached to), there was a free trial of Norton - but of course I used Norton Removal Tool...

My other major theory was that the upgrade was improperly installed by Vista's very outdated Windows Update Agent (whereas Windows 7 has received recent updates in that regard). In hopes of eliminating that possibility, I used a very unusual method to install the upgrade (post #40) which presumably became obsolete when Microsoft posted the full MSEInstall.exe on April 14. Much as I would like to gloat over my success, I seriously doubt that this is the complete explanation. For one thing, there were other MSE users running Vista here and there who clearly did not suffer "black screen after login," and it seems unlikely that they used my installation method. (There's another active thread right now: http://www.vistax64.com/windows-updates/304555-consecutive-error-codes.html.) For another thing, I saw a couple of reports at Microsoft Answers that "black screen" occurred even after using the full MSEInstall.exe - however it's conceivable that they did not run the installer "as administrator," which Vista can be very picky about. Oh, one last thing: Do you have IE 9 installed? (I do - not that I use it much anymore, but it's the only supported version now.)

 

[Vistaar]

I'm still running version 4.8. I'm not certain if 4.9 is any more secure than 4.8.

AV-Comparatives posted their final report on Real-World Protection Test February - June 2016 today. Microsoft's protection rate of 94.4% for the entire testing period is still relatively low, but monthly results strongly suggest that MSE 4.9 is more effective than 4.8 (which itself was a drastic improvement over 4.7):

[TABLE="width: 350"]
[TR]
[TD]Month[/TD]
[TD="align: center"]Version[/TD]
[TD="align: center"]Protection Rate[/TD]
[/TR]
[TR]
[TD]February[/TD]
[TD="align: center"]4.8[/TD]
[TD="align: center"]91.4%[/TD]
[/TR]
[TR]
[TD]March[/TD]
[TD="align: center"]4.8[/TD]
[TD="align: center"]95.5%[/TD]
[/TR]
[TR]
[TD]April[/TD]
[TD="align: center"]4.8[/TD]
[TD="align: center"]90.8%[/TD]
[/TR]
[TR]
[TD]May[/TD]
[TD="align: center"]4.9[/TD]
[TD="align: center"]97.7%[/TD]
[/TR]
[TR]
[TD]June[/TD]
[TD="align: center"]4.9[/TD]
[TD="align: center"]97.4%[/TD]
[/TR]
[/TABLE]

Source: AV-Comparatives Real-World Protection Test - AV-Comparatives

 

[townsbg]

I still haven't had the nerve to install 4.9 although I can easily create a snapshot and revert back to it if there are problems. I got rid of my vista test VM just today so I can't test on that. It really wouldn't have been a good test environment anyway since I didn't have much installed at all.

 

[albertz]

I tried again to install 4.9 from Windows Update and it's the same as before with it hanging during the black screen.

I did find an additional process running after opening the task manager I thought may be causing a conflict. After uninstalling the hanging black screen still occurs.

I'm uncertain where the conflict is. I don't have enough information how MSE loads during boot-up and login. It's possibly there is some sort of conflict with another process or service running during login.

To trouble shoot further I would either need to uninstall programs, processes and services that load during boot-up & login or start with a fresh Vista installation and install MSE 4.9 after it appears in Windows Update.

 

[townsbg]

I am starting to think that I'll bypass 4.9. Do you know if 4.9 works on 7? I avoided installing it on that.

 

[Vistaar]

I am starting to think that I'll bypass 4.9. Do you know if 4.9 works on 7? I avoided installing it on that.

MSE 4.9 supports both Windows 7 and Vista.



I am only using it on Vista; but having researched this issue for months, I think you would have considerable difficulty finding MSE users running Windows 7 who have not upgraded to MSE 4.9. Did I mention that AV-Comparatives tested it on Windows 7 in May and June? Apparently it worked.

 

[albertz]

deleted

 

[Vistaar]

After a fresh install of Vista 64 (SP1) I was able to install MSE 4.9 and boot to the Vista desktop...I went to MS MSE site and downloaded the standalone file and MSE installed and works as it should.

Now that is noteworthy albertz! This is on the same hardware, right?

Since you are the original poster, I can't really complain if you want to discuss the merits of SP1 vs. SP2 here, although a new thread might be appropriate if this requires extensive discussion. Of course the primary objection to running SP1 in 2016 is that Microsoft ended support for it in 2011, so you would be passing up five years of those wonderful security updates that are playing "hard to get" these days. Internet Explorer 9 requires SP2, but who cares about IE9 these days? Firefox 43.0.1 (released in December 2015) should work fine on SP1, but updates released in the last 7 months require KB2763674, which in turn requires SP2 (see https://support.mozilla.org/en-US/kb/get-latest-version-firefox-windows-xp-vista - of course Chrome no longer supports Vista at all). Aside from MSE, Malwarebytes Free still claims to support SP1, but other security software (definitely including Avast) may require SP2.

Of course if you install SP2, you will immediately be confronted with http://www.vistax64.com/windows-updates/303992-windows-update-just-seems-hang-while-checking.html, but now we have Search for Windows Updates takes forever? - A possible solution. See numerous posts by Imacri in the mega-thread if further explanation is required. I have only tried the one-month version of that workaround, not having reinstalled Vista since before Windows updates became a major pain; but it sounds promising. One the whole, I would have to recommend SP2.

 

[albertz]

After installing Vista x64 SP2 I'm unable to logon because of the problem with MSE version 4.9 and a black screen. I was able to boot to Safe Mode and the SP2 update was able to finish.

I will need to go back to SP1 and uninstall MSE 4.9 and install MSE 4.8, which is what I should have probably done in the first place before installing SP2.
_____________

Wasn't able to go back to SP1 as the black screen problem occured. I tried system restore and Macrium SP1 restore from a backup image. I also tried rebooting after using msconfig, without any luck.

I'm back to my old SP2 with the network diagnostic and repair problem. Have completely removed MSE and will install a 64-bit version of MSE 4.8.
___

I may need to do another Vista installation and install the updates. This time making certain MSE 4.9 isn't installed at all.

I probably should have taken precautions but thought MSE 4.9 would be able to run under SP2. If not a system restore to SP1 should work, but not guaranteed.

At this point I'm thinking of installing Vista 64 SP1, download a few updates and then perform a standalone SP2 update. Instead of first installing 600+ mb of SP1 updates.

 

[Vistaar]

I probably should have taken precautions but thought MSE 4.9 would be able to run under SP2.

Well I am using MSE 4.9 under SP2, and so are others (probably more than we will ever know), and some of them are running Vista x64. It might have been interesting to see if disabling ShellHWDetection enabled you to log in normally; however the person who reported that clearly had a failed upgrade, whereas your install was apparently successful. We might never know why some systems are affected while others are not.

 

[albertz]

I might give it try at a later time i.e. a fresh SP1 install and then update to SP2. I read the SP2 standalone installer is suppose to include any necessary SP1 updates so I shouldn't first need to run Windows update for SP1. This would save some time as it took quite a long time to upgrade to SP2.

Another problem when installing MSE 4.9, is once it's installed on my PC at least, (an older Thinkcentre purchased new back in 07). is MSE 4.9 can't be uninstalled from Windows Safe Mode. Also any stand-alone updates are unable to run in safe mode, unless there is some sort of work-a-round.

What has me somewhat confused when I installed MSE 4.9 on SP1 I was at first able to login. However after upgrading to SP2 and then downgrading to SP1 using system restore I wasn't able to login. The same was true when performing a Macrium image file restore. I was't able to login under SP1 with MSE 4.9 installed.

Appears to be some sort of small glitch. When normally logging into Windows a black screen always appears for a short time then the screen goes to the desktop which is controlled by dwm.exe (Desktop Window Manager). There appears to be some sort of conflict that's preventing Windows Desktop to load the last step after the black screen appears.

Next time I'll first need to upgrade to SP2 and get everything working as expected with MSE 4.8 installed. Create a restore point and then install MSE 4.9.

 

[Vistaar]

...MSE 4.9 can't be uninstalled from Windows Safe Mode...Next time I'll first need to upgrade to SP2 and get everything working as expected with MSE 4.8 installed. Create a restore point and then install MSE 4.9.

Others have disabled MSE 4.9 in Safe Mode by deselecting the new Administrator > Turn on this app setting in the user interface, allowing them to log in normally. I've also seen a report that MSE can be uninstalled in Safe Mode using Revo.

Good luck finding the 64-bit MSE 4.8.204.0 installer because Microsoft removed it in April. Perhaps you should consider using a third-party antivirus? At this time, all products still claim to support Vista except those listed here: http://www.vistax64.com/system-security/304411-vista-no-longer-supported-some-security-software.html. I wouldn't wish AVG on my worst enemy, but I hear good things about Avast. When Microsoft ended support for XP, they gave XP users another year of MSE definition updates; but they won't necessarily do that for Vista. (However while researching your "black screen" issue, I came across threads in which XP users are still using older MSE client versions by manually downloading definition updates - which might be me in 9 months.)

 

[albertz]

I probably should have backed up the SP2 install. I have an image backup of SP1 which I can restore and then update to SP2.

I can boot into safe mode of SP1 and try your suggestions. I've used Revo but it was a while ago. I sometimes use iobit uninstall as it includes a cleaner to cleanup leftover files and registry entries. IIRC Revo has a similar cleanup function. I would need to be able to install either uninstall app while in safe mode.

As for MSE 4.8 64-bit I'm not certain if the current MSE 4.8 install is 32-bit as the installation file I think covers different types of Windows Installations including Vista and Windows 7. There is no mention of 64-bit so I suspect it must be 32-bit. I'm uncertain if there's a big difference between MSE 32 and 64 bit?

Here's a site that list both a 32 and 64 bit MSE 4.8 download.

Microsoft Security Essentials 4.8.204.0

After downloading and running the 64-bit version the installer displays a message that the program is an upgrade.

After installing MSE shows to be version 4.9. I'll need to uninstall and re-install 4.8.

 

[Vistaar]

Here's a site that list both a 32 and 64 bit MSE 4.8 download...After installing MSE shows to be version 4.9.

That link might say 4.8, but by hovering my mouse pointer over the download I can see it is 4.9. (If that doesn't work for some reason, right-click and select Properties > Details.) Obviously you can get 4.9 from Microsoft. Installing it after SP2 might be worth a try.