Sign in
Microsoft.com
 
Microsoft
 
 
 

locked
OneCare Unresponsive - Uninstall Failing - SOLUTION RRS feed

 > 

  • General discussion

  • Discussion
    Sign in to vote
    0
    Sign in to vote

    Updated 7/19/10 14:45 EDT

    Modified certificate deletion to include all certificates in Winss\personal
    Added step to delete hidden folder

    UPDATED 7/16/10 14:00 EDT

    The main solution steps, written below, are also published to a KB article here: http://support.microsoft.com/kb/2284591

    UPDATED 7/14/10 13:15 EDT

    The instructions below will allow you to continue to use OneCare after the fix *and* not worry about the date. The problem is not related to .Net Framework 4.0. I'm not sure that I understand the problem completely, but you now have a few options. Follow the steps below if you wish to use OneCare through your subscription's end, use the steps further down in this post to remove OneCare and install MSE or another security solution, or contact Support for help with the steps below.

    _________________________SOLUTION________________________

    Step 1:Boot into Safe Mode

    =================

    1. Restart your computer and start pressing the F8 key on your keyboard. On a computer that is configured for booting to multiple operating systems, you can press the F8 key when you see the boot menu.

    2. When the Windows Advanced Options menu appears, select Safe Mode, and then press Enter.

    3. Log onto Windows by using the Administrator account or any user account with the Administrator privileges.

     

    NOTE: In Safe Mode, your system display and Desktop will look and perform differently than in Normal Mode. This is only temporary. To return the system back to Normal Mode, we can simply restart the computer.

     

     

    Step 2: Change System Date to 7/7/2010

    ============================

    1. Click Start, type "TIMEDATE.CPL" (without quotation marks) in the "Start Search" box and then press Enter

    2. Change the System Date to 7/7/2010

     

     

    Step 3: return the system back to Normal Mode

    ==============================

    Please simply restart the computer, to return the system back to Normal Mode.

     

     

    Step 4: Manually delete the OneCare certificate(s)

    =============================

    1. Click "Start" -> Type "MMC" under "start search" and press "enter"

    2. Click "Continue" if User Account Control pops up

    3. Click "File” -> Go to "Add/Remove Snap-in"

     

    4. Click "Certificate" -> Click "Add"

    5. Choose "Service account" and click "Next"

    6. Choose "Local computer", click "Next"

    7. Choose "Windows Live OneCare", and click "Finish", then click "OK".

     

    8. Under "Name", double-click "Certificates - Service (Windows Live OneCare) on Local Computer"

    9. Double-click the first (top) folder (winss\Personal), and then double-click "Certificates"

    10. Right-click on the certificate shown in the window, select "Delete", and click "Yes"
    (Note - the certificates do not need to be expired. Delete any listed certificates in that folder!)

     

     

    Step 5: Readjust System Date to correct date

    ============================

    Please readjust System Date to the current time, and then restart the computer again to see if the issue is resolved.

     

    Note: If the issue is resolved, please do not forget to re-activate OneCare again to ensure your computer is under protection.

    If the steps above do not work, delete 1 additional certificate as follows:

     

    1.       Open Start-> Run->mmc

    2.       From Available Snap-ins, select Certificates
    Click Add, Select >Computer Account and click Next
    Select     "Local computer", click "Finish", then click "OK".

    3.     Open Personal > Certificates and remove all expired certs were issued by “Client Issuing CA”

    * If there are only expired certificates, remove all

    4.       Reboot

    ___________________________________

    Note: On 7/16/10, Anish Mohan provided additional information to follow in the event that the problem is still not resolved after the Certificates have been deleted and OneCare has been removed from the PC.

    Change the system date back to a date prior to 7/11/10
    Go to the options in Windows Explorer and set folder options to display hidden files and folders.
    Look for this folder and delete it - c:\Program Data\Microsoft\OneCare Protection
    As far as I know, that is on a Vista machine. In XP, the folder is probably located in \Documents and Settings\%user%\Application Data\Microsoft or \Documents and Setting%user%\Local Settings\Application Data\Microsoft.
    If you cannot delete the folder when logged into Windows in normal mode, boot into Safe Mode.
    Once the folder has been deleted, change the system date back to the current date/time and reboot.
    ______________________________________

    The primary discussion for this issue is here: http://social.microsoft.com/Forums/en-US/onecaregeneral/thread/d58206f4-d23a-49d2-b1ba-fb36f9bce5c1

    Below are workarounds that allow you to remove OneCare from the machine.

    _____________________

    Update 7/14/10 10:15 EDT: Yesterday, Fisherman77 posted what may well be the simplest solution for the problem to the above thread. It does not fix the problem, but gets your PC working once again by removing OneCare and installing Microsoft Security Essentials. I've added some detail, but otherwise it is the steps as posted by Fisherman77.

    1. In Safe mode changed date to June 13 2010. How to Boot into Safe Mode

    2. Restarted in Normal mode and then uninstalled windows live onecare. (Be sure to download and run the cleanup tool as explained in the link)

    3. Restarted in Normal mode and then installed microsoft security essentials.

    4. Restarted in Normal mode and then changed date back to today's date.

    5. Restarted in Normal mode and then updated windows and updated microsoft security essentials. (open Microsoft Security Essentials and click the Update button)

    6. Restarted in Normal mode.

    Note: Microsoft Security Essentials is one possible solution and a good one, in my opinion. It does generally require that you download and run the OneCare Cleanup Tool before installing MSE. 

    If you used OneCare for backups, you'll still be able to restore from old backups if you use the OneCare Restore tool - http://social.microsoft.com/Forums/en-US/onecarebackupandrestore/thread/e5d686c8-762b-4b22-bc08-bfb93f911e57, but you'll need to seek an alternative backup solution.

    ___________________

    UPDATE 7/13 15:15 EDT: JLandau posted that booting into Safe Mode (see below for how to do this) and simply changing the system date and time (right click the clock and select change date/time) to a date before July 11th seems to resolve the problem. Note that this will cause other issues *and* if the problem is not resolved by Microsoft, when the PC once again thinks it is July 11th, you may be in the same position...

    ___________________

    Two possible solutions have been posted and I'm copying them here for clarity and will lock this post. Please refer discussions to the above thread.

    The first is from Styx Shi:

    Step 1: Boot into Safe Mode with Networking

    ===================================

    1. Restart your computer and start pressing the F8 key on your keyboard. On a computer that is configured for booting to multiple operating systems, you can press the F8 key when you see the boot menu.

    2. When the Windows Advanced Options menu appears, select Safe Mode with Networking, and then press Enter.

    3. Log onto Windows by using the Administrator account or any user account with the Administrator privileges.

     

    NOTE: In Safe Mode, your system display and Desktop will look and perform differently than in Normal Mode. This is only temporary. To return the system back to Normal Mode, we can simply restart the computer.

     

    Step 2: Start Windows Installer service

    ===============================

    1. Click the Start Button, type CMD in the Start Search box and press Enter.

    2. Type the following command and press Enter.

     

    Note: I suggest we copy and paste the command above instead of typing it. Please select and copy the command. Then, in the command window, right click and choose Paste. The command will be pasted to the command line. Press Enter to run the command.

        (note, do not press enter until all of the following text is entered at the command prompt!)

    REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer" /VE /T REG_SZ /F /D "Service"

     

    Press <enter> to execute the command.

     

    4. Type the following command and press Enter

     

    net start msiserver

     

    You will receive a message stating the service is successfully started.

     

    Step 3: Run OneCare Cleanup tool

    ===========================

    1. Please download the tool from the following link and save it onto your hard disk:

     

    http://download.microsoft.com/download/4/c/b/4cb845e7-1076-437b-852a-7842a8ab13c8/OneCareCleanUp.exe

     

    2. Double-click the downloaded "OneCareCleanup" file and then click "Continue".

    3. Choose "I accept the terms of End-User Licensing Agreement" and click "Continue".

    4. Click the "Clean" button, and the tool will begin to remove OneCare.

    5. After the process finishes, please click to restart the computer.

     

    The second possible solution is from Omni737 and also darksun26:

     

    "1.) In Safe Mode with Networking - Did System Restore to date before .NET framework was installed (6-24-2010).

    2.) Reboot to Safe Mode with Networking.

    3.) Again, in Safe Mode with Networking - Ran the OneCare Clean Utility and changed computer date to 6-24-2010.

    4.) Rebooted to normal mode and now everything is currently working."

    Note that omni737 has not changed the PC clock back to the current date as of this posting. In darksun26's post, the steps were simpler.

    "I made a system restore to a point prior to sunday. then I changed the system date to a day before sunday and rebooted in safe mode with network support. after that, I had success, running the onecare cleanup tool. after rebootin in regular mode, onecare is deinstalled."

    Note that once you have removed OneCare and rebooted, the PC is not protected. You must install protection ASAP. I recommend using Microsoft Security Essentials:

     http://www.microsoft.com/security_essentials/resources.aspx 

    If you used OneCare for backups, you'll still be able to restore from old backups if you use the OneCare Restore tool - http://social.microsoft.com/Forums/en-US/onecarebackupandrestore/thread/e5d686c8-762b-4b22-bc08-bfb93f911e57, but you'll need to seek an alternative backup solution. However, I suggest *not* installing the OneCare Restore Tool until after Microsoft confirms the root cause of this issue. If the problem is specific to the virus definitions, the Restore Tool should install fine. If it is .Net Framework 4.0 and OneCare core functionality, that needs to be addressed or the same issue could be encountered.

     

    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Tuesday, July 13, 2010 12:25 PM
    Moderator