Windows 10: Unable to install Malwarebytes, or others

Scroll down to the bottom of the page to try the beta tool:

BSOD - Posting Instructions - Windows 10 Forums

log collector v2-beta06.zip



If the above does not work please post that into the thread.

Then open administrative command prompt and copy and paste this whole command:

Code: md "%USERPROFILE%\Desktop\CollectedFiles"&wmic /output:"%USERPROFILE%\Desktop\CollectedFiles\hotfix.txt" qfe list full /format:table&copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\CollectedFiles"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\CollectedFiles\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp"&findstr /v "Owner." "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp" > "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.txt"&del "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp"&driverquery /v > "%USERPROFILE%\Desktop\CollectedFiles\drivers.txt"&msinfo32 /nfo "%USERPROFILE%\Desktop\CollectedFiles\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\CollectedFiles\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\CollectedFiles\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\CollectedFile[/quote]

 

The beta was blocked as was the command line that I pasted.

C:\WINDOWS\system32>md "%USERPROFILE%\Desktop\CollectedFiles"&wmic /output:"%USERPROFILE%\Desktop\CollectedFiles\hotfix.txt" qfe list full /format:table&copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\CollectedFiles"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\CollectedFiles\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp"&findstr /v "Owner." "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp" > "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.txt"&del "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp"&driverquery /v > "%USERPROFILE%\Desktop\CollectedFiles\drivers.txt"&msinfo32 /nfo "%USERPROFILE%\Desktop\CollectedFiles\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\CollectedFiles\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\CollectedFiles\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\CollectedFile
The system cannot find the file specified.
Invalid file name.
C:\WINDOWS\minidump\*.dmp
The system cannot find the file specified.
0 file(s) copied.
The system cannot find the path specified.
The system cannot find the path specified.
The system cannot find the path specified.
The system cannot find the file specified.
The system cannot find the path specified.
The system cannot find the path specified.
ERROR: Unable to write to the file. There may be a disk or file system error.
ERROR: Unable to write to the file. There may be a disk or file system error.

 

Open administrative command prompt and copy and paste:
1) sfc /scannow
2) dism /online /cleanup-image /scanhealth
3) dism /online /cleanup-image /restorehealth
4) chkdsk /scan
5) When these have completed > right click on the top bar or title bar of the administrative command prompt box > left click on edit then select all > right click on the top bar again > left click on edit then copy > paste into the thread

 

Microsoft Windows [Version 10.0.16299.125]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\WINDOWS\system32>dism /online /cleanup-image /scanhealth

Deployment Image Servicing and Management tool
Version: 10.0.16299.15

Image Version: 10.0.16299.125

[==========================100.0%==========================] No component store corruption detected.
The operation completed successfully.

C:\WINDOWS\system32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.16299.15

Image Version: 10.0.16299.125

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

C:\WINDOWS\system32>chkdsk /scan
The type of the file system is NTFS.
Volume label is Local Disk.

Stage 1: Examining basic file system structure ...
473344 file records processed.
File verification completed.
6946 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
1706 reparse records processed.
594774 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered to lost and found.
1706 reparse records processed.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
60716 data files processed.
CHKDSK is verifying Usn Journal...
37096888 USN bytes processed.
Usn Journal verification completed.

Windows has scanned the file system and found no problems.
No further action is required.

498664447 KB total disk space.
137455604 KB in 235752 files.
166672 KB in 60717 indexes.
0 KB in bad sectors.
599539 KB in use by the system.
65536 KB occupied by the log file.
360442632 KB available on disk.

4096 bytes in each allocation unit.
124666111 total allocation units on disk.
90110658 allocation units available on disk.

C:\WINDOWS\system32>

 

See if you can modify Windows defender.
Then see if you can run the DM log collector options and/or the administrative command prompt commands to post logs into the thread.

BSOD - Posting Instructions - Windows 10 Forums

 

If Defender's Controlled Folder Access is turned you can get results like that, check and turn it off if necessary.

Change Windows Defender Controlled Folder Access Settings - Windows 10

 

Athough defender is turned off it still blocks anything from running

 

See if you can get any of these commands to generate files to post into the thread?

In the left lower corner search type:
1) dxdiag > open each tab > give it a few minutes to completely load > post a share link into the thread
2) msinfo32 > save as nfo > post a share link into the thread


3) Open administrative command prompt and copy and paste: Code: copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"[/quote] 4) Open administrative command prompt and copy and paste: Code: md "%USERPROFILE%\Desktop\CollectedFiles"&wmic /output:"%USERPROFILE%\Desktop\CollectedFiles\hotfix.txt" qfe list full /format:table&copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\CollectedFiles"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\CollectedFiles\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp"&findstr /v "Owner." "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp" > "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.txt"&del "%USERPROFILE%\Desktop\CollectedFiles\systeminfo.tmp"&driverquery /v > "%USERPROFILE%\Desktop\CollectedFiles\drivers.txt"&msinfo32 /nfo "%USERPROFILE%\Desktop\CollectedFiles\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\CollectedFiles\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\CollectedFiles\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\Collected[/quote] 5) open administrative powershell and type or copy and paste:
get-eventlog System > $env:homeDrive$env:homePath\Desktop\system.txt

6) Open administrative powershell and type or copy and paste:
Get-EventLog system | Format-List > $env:homeDrive$env:homePath\Desktop\system.txt

 

Attached are the dxd and nfo files but none of the rest would run even with defender OFF.
Just popped up with "Unauthorised changes blocked"
Looks like a soft reinstall

 

In post #3 the drivers for superantispyware were corrupt.
Were you able to uninstall this software?

 

Had you tried REVO uninstaller?
Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

First try the superantisypware uninstall assistant:
SUPERAntiSpyware FAQ - How do I uninstall SUPERAntiSpyware?

SUPERAntiSpyware Uninstaller Assistant (32-Bit)

SUPERAntiSpyware Uninstaller Assistant (64-Bit)


Also: SUPERAntiSpyware FREE Edition installer

 

OK its gone now, what next

 

Attempt to run the DM log collector again

Attempt the administrative command prompt commands again.

Run the Bitdefender uninstall tool:
Uninstall Bitdefender

Uninstall AdwCleaner

Uninstall Trend Micro:
Maximum Security Support - Home and Home Office Support | Trend Micro

 

bitdefender uninstall download is corrupted and wont run. ut see attachment

 

These are still displayed as problems devices:

Code: SASKUTIL ROOT\LEGACY_SASKUTIL\0000 Failure using the VxD loader.SASDIFSV ROOT\LEGACY_SASDIFSV\0000 Failure using the VxD loader.[/quote]
Code: Event[12684]: Log Name: System Source: Microsoft-Windows-Kernel-PnP Date: 2017-12-27T18:23:09.643 Event ID: 219 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: TheBook Description: The driver \Driver\SASKUTIL failed to load for the device ROOT\LEGACY_SASKUTIL\0000. Event[12685]: Log Name: System Source: Microsoft-Windows-Kernel-PnP Date: 2017-12-27T18:23:09.643 Event ID: 219 Task: N/A Level: Warning Opcode: Info Keyword: N/A User: S-1-5-18 User Name: NT AUTHORITY\SYSTEM Computer: TheBook Description: The driver \Driver\SASDIFSV failed to load for the device ROOT\LEGACY_SASDIFSV\0000.[/quote]