Windows installer trying to install unknown program

[deborahfrance]

Hi

 

Everytime I switch on my computer Windows Installer tries to install something (presumably something that was only semi-installed at some point in the past?). Eventually it fails, and then it tries again. Once it has failed for a second time I can use my PC normally. I was just wondering if there was any way I could stop Windows Installer from doing this?

 

Thanks

 

Deborahfrance

[Seth]

Welcome to Extreme Tech Support - Free PC Help Deborah.

 

Is there any indication of what program the installer is trying to install?

 

If not, go here and download the HijackThis Installer. It's a program needed so we can see what programs are automatically starting up when your computer starts. Run the program and choose "Scan and Save A Log File". Please post that log in your next reply.

[deborahfrance]

No, it doesn't say what it is trying to install. Here is my hijack this log:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:14:04, on 05/08/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\VIA Technologies, Inc\Audio Deck\ADeck.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Club-Internet\Lanceur\lanceur.exe

C:\Program Files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe

C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe

C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\VIA Technologies, Inc\Audio Deck\ADeck.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Spyware Doctor\swdoctor.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program Files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-internet.fr

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = pop ups free game travel at derbiz.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [FSWebServer] C:\Program Files\Easy File Sharing Web Server\fsws.exe

O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIA Technologies, Inc\Audio Deck\ADeck.exe

O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [workflow] D:\install\workflow.exe

O4 - HKLM\..\Run: [workflow(1)] E:\install\workflow.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"

O4 - HKCU\..\Run: [spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-21-1390067357-308236825-839522115-1004\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Deborah')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - S-1-5-21-1390067357-308236825-839522115-1004 Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe (User 'Deborah')

O4 - S-1-5-21-1390067357-308236825-839522115-1004 User Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe (User 'Deborah')

O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

O4 - Global Startup: hpoddt01.exe.lnk = ?

O4 - Global Startup: LE COMPAGNON CLUB.lnk = C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.1837online.com/downloads/windows/DjVuControl_en_US.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1111188880984

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1132495611421

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

 

--

End of file - 10088 bytes

 

 

Thank you!

[Dalo Harkin]

Is your version of Norton paid for or is it free/trial

Norton is not a very strong AV/Firewall program and is prone to attacks - if it is free/trial I would recommend NOD32 or AVIRA - if it is paid for be aware that it is not that good and be extremely careful when on the net.

 

Could be real player or Quicktime trying to update.....do you still have the programs?

Edited August 5, 2008 by Dalo Harkin

[danzil]

if you can find the program name that is trying to install.

then you can go to start>run type in "installer" then look at the details of the installers in there.......once you have found the culprit you can fully uninstall it from there.

i have had this issue with a botch attempt of installing office 2007 and this worked excellent for me, along with numerous symantec products.

 

have you let the installaer run its course a little to see if it tells you the program name.

 

also maybe worth checking msconfig startup options to see if it is in there.

regards

danzil

[deborahfrance]

Both Quicktime and Realplayer are installed, but I can uninstall both of these programs if you think it would help.

 

The Norton package I am using is paid for :0( I know better for next time.

 

The installer gives no clue as to what it is trying to install. I did look in the installer file but I don't know what I am looking for. There are 6 temp files in there, 3 of which relate to Sun Microsystems: SE runtime environment 6 (twice) and SE runtime environment 5. The others do not specify what they relate to. Does this mean anything?!

[maynardvdm]

If i am not mistaken they relate to Java.

 

Make sure you have the latest version installed and then uninstall all the older versions.

 

Update Java Runtime

 

You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, and also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 7.

• Go to Java SE Downloads
  
• Go to Java Runtime Environment (JRE) 6 Update 7 and click on Download button.
  
• In Platform box choose Windows.
  
• Check the box to Accept License Agreement and click Continue.
  
• Click on Windows Offline Installation, click on the link under it which says "jre-6u7-windows-i586-p.exe" and save the downloaded file to your desktop.
  
• Go to Start => Control Panel => Add or Remove Programs
  
• Uninstall all old versions of Java (Java 3 Runtime Environment, JRE or JSE)
  
• Install the new version by running the newly-downloaded file with the java icon which will be at your desktop, and follow the on-screen instructions.
  
• Reboot your computer
  

[danzil]

when in the install directry if you go to view then choose details.

in there tick subject and auhoer and in the width box enter 300 or 350.doesnt matter.

then click ok now go to view then click details....you should now see the company vendor who made the programs.

this will help when we ascertain what the installer is trying to install.

have you gone to start>run type in msconfig list everything that is ticked in startup.

just incase its in there. but not usually

regards

danzil

[Seth]

O4 - HKLM\..\Run: [workflow] D:\install\workflow.exe

O4 - HKLM\..\Run: [workflow(1)] E:\install\workflow.exe

 

Those entries look like the culprits. Do you know of the program called "Workflow"?

 

Run HijackThis again and choose "Scan Only". Place a check mark on only the above two entries, then click on "Fix Checked". Restart the computer and the problem should be gone.

[danzil]

for future ref,,if its in hklm>run then it is most likely in the startup in msconfig......saves possible time downloading programs etc....

 

has seth sorted your problem now.

regards

danzil:)

[deborahfrance]

The plot thickens...

 

Windows Installer is still trying to install an unknown program and I now have a volume bar in the middle of the screen that I can't get rid of.

 

I deleted the 2 entries on hijackthis, I have updated Java and removed all earlier versions, I have installed and run Ccleaner, and I have removed various things off the desktop that weren't being used.

 

I tried to go into installer and follow instructions but only got as far as selecting 'details', after which point I couldn't find the right things to click on.

[Dalo Harkin]

Is the volume bar there from startup or after??

you can type in MSCONFIG into command and look at the start up items - but I would only do this if you have an understanding of whats on the PC

[Seth]

The two entries I pointed out should be causing the problem. However, they may also need to be disabled through msconfig.

 

Start>Run, type in msconfig and press Ok. Click on the Startup tab. Scroll through the list, and post back with all the entries under the "Startup Item" heading that have a checkmark on them.

[Goku]

Hello and Welcome to FPCH Deborah.

 

Please download the Windows Installer CleanUp Utility from the following link and use it to remove any previous installations that might have been corrupted or improperly installed.

 

Description of the Windows Installer CleanUp Utility

 

Read the following article if you need some instructions on using the utility.

 

Windows Installer runs on every reboot - why?

 

Let us know if it helps or not. Good Luck. :)

 

-- Goku

[Seth]

Well that was wonderful Goku.

 

I just logged in after a coouple of service calls and my first order of business was to request running the installer clean up utility if msconfig didn't help.

 

Good stuff:)

[Goku]

Thanks Seth. What I want to see is if it works for Deborah too or not? Isn't it strange that Microsoft first invents the bugs and then puts up different utilities to cope with them?

 

http://community.eqo.com/files/smiley-grin.gif

 

-- Goku

[AdvancedSetup]

Once the installer fails it should say what it's trying to install. Without knowing what then using the Windows Cleanup utility will be dangerous and impossible to properly use.

 

There are also many potential causes depending on what software is trying to re-install. Often MS Office xp/2000 are the culprit but there are many others that can cause it too.

 

 

.