Showing posts with label Windows Vista. Show all posts
Showing posts with label Windows Vista. Show all posts

Wednesday, July 30, 2008

I Fix Things: Windows Defender Corrupt - 0x80070006

Windows Vista has actually managed to work pretty well for me thus far. With one or two exceptions, I'd say it's pretty solid, and in my experience with it, I haven't found it deserving of the "buggy mess" label a lot of folks seem to have pinned on it.

One thing I can't figure out, however, is why they decided to integrate Windows Defender into the operating system. Don't get me wrong, Defender is decent software (if a bit unremarkable, I use it more for detection that actual removal, since I haven't seen it remove all that many things that Spybot, Adaware, or HiJackThis weren't able to root out), but streamlining it into the system has the disastrous side effect of making it:

a) Impossible to remove, should you not want to use it
b) Extremely difficult to troubleshoot or repair, should there ever be a problem with it

I recently had to use System Restore, due to a poorly created MSI file I decided to test on my machine. Once the process had completed, Windows Defender has broken itself. Upon system startup, I would receive an error message reading "Application failed to initialize: 0x80070006. The Handle is invalid". Most of the methods of troubleshooting Defender that I've seen on the Internet require the user to be able to open Defender in the first place. The program files are all there, it seems as though Defender should work, but there's no 'Windows Defender' service listed under Windows services, and there's no way to open the program.

Luckily, after doing some research (and calling Microsoft, but that was an exercise in futility), I've found the answer to my problem.

The problem lies in corrupted registry settings for the program. If you have a similar problem to mine (Defender in Vista seemingly installed, but getting a "can't initialize" error), try the following (originally posted here by cdninja)

Step 1: Back up Registry ==================

1. Click Start, type "regedit" (without quotation marks) in the search bar and press Enter.

2. In the Registry Editor, click File menu, and click Export.

3. In the Save In list, select the folder where you want to save the backup. 4. In the File Name box, and type a name for your backup file, such as "Options" or "Backup".

5. Click Save.

Step 2: Create and Run the Registry File ==================

1. Click Start, type "notepad C:\register.reg" (without quotation marks) in the Search bar, and then click OK. Choose Yes when you are prompted to create a new file.

2. Copy the following texts between the star marks and then paste them into the opened Notepad window:

************************BEGIN**************************

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend]
"DisplayName"="@%ProgramFiles%\\Windows Defender\\MsMpRes.dll,-103"
"ErrorControl"=dword:00000001
"Group"="COM Infrastructure"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,73,00,65,00,63,00,73,00,76,00,63,00,73,00,00,00
"Start"=dword:00000002
"Type"=dword:00000020
"Description"="@%ProgramFiles%\\Windows Defender\\MsMpRes.dll,-3068"
"DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
"ObjectName"="LocalSystem"
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,\
00,6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,\
65,00,00,00,53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,\
74,00,6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\
00,00,00,53,00,65,00,44,00,65,00,62,00,75,00,67,00,50,00,72,00,69,00,76,00,\
69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,68,00,61,00,6e,00,67,\
00,65,00,4e,00,6f,00,74,00,69,00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,\
6c,00,65,00,67,00,65,00,00,00,53,00,65,00,53,00,65,00,63,00,75,00,72,00,69,\
00,74,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,\
00,00
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00,00,00,00,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Parameters]
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceDll"=hex(2):25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,\
00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,\
20,00,44,00,65,00,66,00,65,00,6e,00,64,00,65,00,72,00,5c,00,6d,00,70,00,73,\
00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Security]
"Security"=hex:01,00,14,80,04,01,00,00,10,01,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,d4,00,07,00,00,00,00,00,28,00,ff,01,0f,00,01,06,00,00,00,00,00,\
05,50,00,00,00,b5,89,fb,38,19,84,c2,cb,5c,6c,23,6d,57,00,77,6e,c0,02,64,87,\
00,0b,28,00,00,00,00,10,01,06,00,00,00,00,00,05,50,00,00,00,b5,89,fb,38,19,\
84,c2,cb,5c,6c,23,6d,57,00,77,6e,c0,02,64,87,00,00,14,00,fd,01,02,00,01,01,\
00,00,00,00,00,05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00,00,00,14,00,9d,01,02,00,01,01,00,00,00,00,00,05,\
04,00,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,\
00,28,00,15,00,00,00,01,06,00,00,00,00,00,05,50,00,00,00,49,59,9d,77,91,56,\
e5,55,dc,f4,e2,0e,a7,8b,eb,ca,7b,42,13,56,01,01,00,00,00,00,00,05,12,00,00,\
00,01,01,00,00,00,00,00,05,12,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Enum]
"0"="Root\\LEGACY_WINDEFEND\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

*************************END***************************

3. After you paste the above commands, please close the Notepad window. Choose Yes when you are prompted to save the file.

4. Save the file as a REG file of any type (defenderfix.reg was what I called the file, but any name will do, just make sure the file is a REG file, and not a TXT file)

5. next double click on the new file.

6. When you receive a message box asking "Are you sure you want to add the information in the REG file to the registry", choose "Yes"

7. You will receive another message box saying "Information in the REG file has been successfully entered into the registry", please click "OK" to confirm.

8. Restart the computer.

 

The process worked for me. Let me know if it works for you.