eset firewall and windows security center

Hi all, I was wondering if someone can assist me on this problem. The windows security center displays the following message: eset firewall is not active but i'm not using eset av and never have installed nod 32 on my pc. i think that was because three or four months ago i launched a portable version of nod32. i tried revouninstall, nod32 remover tools, cclear, advanced system care, registry clean expert, argente registry cleaner and nothing happened. Can anyone help me on getting rid of that message ?

thanks

 

You can pause Windows Management Instrumentation and delete the repository folder then reboot and it will recreate itself. http://vista.blorge.com/2008/01/09/...from-reporting-missing-or-duplicate-programs/

It works the same for Vista and XP.

 

hi jhonnydollar, thanks for your reply.. i followed the steps in the link and i couldn't remove the repository folder, displayed the message: "you can not delete the repository folder. the file INDEX.BTR is being used by another person o program." I also Tried it in safe mode and neither worked. what do I do?

thanks

 

Did you pause or disable the WMI service first? You have to do that. If it still doesn't work even in safe mode then take ownership of the file and delete it. http://www.howtogeek.com/howto/wind...ership-to-explorer-right-click-menu-in-vista/

If that doesn't work try this http://lockhunter.com/

I assume your running Vista huh?

 

i disabled the service because i had not the pause option activated

that is for vista or windows 7, i'm using xp

i tried killbox and did not work, i'll try lockhunter.

thanks

 

You need to stop the Security Center service too.

 

Good call / good eye, not pause them STOP them both, should do the trick

 

Hi, i stopped both services and couldn´t delete de folder "repository". lockhunter displayed: svchost is using the file INDEX.BTR. and now?
thanks

 

do it from a bartPE / winPE or some type of rescue cd that lets you read the directories, or use an NTFS driver to mount the volume in dos and use some type of file manager to delete it.

 

the post is getting more complicated than i thought, i do not know how to use bartpe nor winpe. isn´t there an easiest solution?

thanks

 

Open a command line and try these commands one at a time to see if it will work.

Use this one first and see if it works: rundll32 wbemupgd, UpgradeRepository

If the above doesn't work then try these below:

net stop winmgmt

rd %systemroot%\system32\wbem\Repository

net start winmgmt

I don't know if it will or not but worth a try

edit: You may want to do the commands in safe mode.

 

displayed upgraderepository: input missing

displayed directory is not empty. (the file index.btr is there and i can´t delete it. see three threads below)

i did it that way.

thanks

 

I have never tried but, see if you can kill svchost.exe There may be several of them running.
Didn't it tell you earlier that svchost was using that file when you tried to delete it?

 

there are 5 of then running but which one should i kill?

yes, lockhunter showed me that.

thanks

 

Start killing each one at a time till you can delete the folder.

 

LOL ..... NO....

command prompt this quotes and everything as it appears:

tasklist /svc /FI "IMAGENAME eq svchost.exe"

then open task manager and the processes tab and click view at the top and select columns and select PID and match up the PID.

windows vista / 7 do this automatically when you right click a svchost process in the task manager, it brings you right to what each one is doing.

 

That lets you know what each svchost does but still doesn't tell you which one is using the repository folder. Or if does let me know I am curious. I would think that booting in safe and killing the process that is using it would be easier than downloading and burning a winpe or bartpe.

 

Why don't you do like ccomputertek says, open a command line and enter this:

tasklist /svc /FI "IMAGENAME eq svchost.exe"

Then upload a screenshot and let ccomputertek tell you which process you need to kill in order to delete the repository folder.

 

well, johnny moneybags, lets use your attached image as an example.wscsvc is the security center service unfriendly name, as it appears in the registry services. and winmgmt is obviously WMI which we discussed allready BOTH need to be stopped for this to take place.the PID's change after every reboot, they won't be the same numbers as before. just look for which svchost has wscsvc and winmgmt, usually 2 different ones and notice the PID, then follow the intructions I gave for what to do in task manager and you should have no problems.... if that doesn't work, as a last resort you can kill the svchost that is running rpcss

using your screenie as an example he would want to kill the PID's 396 and 332

 

Thank you, because I couldn't tell what every abbreviation was. What is rpcss?

edit: What is moneybags have to do with anything.

Just Kidding

 

kill it and find out

you quoted me before I got a chance to fix my spelling and grammar...... lol, I hate it when that happens

 

allright here goes

 

LMAO

 

LOL Well ajap posts 16-19 should take care of your problem let us know how it worked out.

 

If you go into administrative tools and services, and double click on any service, it gives you the unfriendly name on the general tab up top.Thats how they appear in the registry.

By the way, I just thought I would warn people after another one of my little experiments.

don't ever use " sc delete [service name] " on the client for microsoft networks or file and printing for microsoft networks in windows 7 or vista.I have NO clue why but they skimped on the INF's for those 2 services, and if you remove them or a virus or something corrumpts them, you can't reinstall them, like you could in win2000 and XP.Why does microsoft do such stupid things to cause problems ?

I knew it was going to happen, after I looked at the services inf's after the fact that I got error upon error trying to reinstall those 2.

I ended up having to install vista on another partition, just so I can go back into the registry that has these keys that the inf's usually install and export them out and keep them in a safe place.

Browser
Netlogon
lanmanserver
Lanmanworkstation


just a FYI, because I happened to do a google search and alot of people are having a problem with this and I never see them get a reply on how to fix it, because no one seemed to know