PC Tools OnDemand issued an "VERY HIGH" alert during .Net framework 3.5 installation

for MSIEXEC.EXE. I Quarantined it.

Internet Security won't let me restore it. Neither will System Resore.

Now Windows Installer won't work. The service cannot be re-enabled, access denied. The

service won't start up automatically.

I've disabled DCOM.

Any way of saving the Event Viewer Log also? I can place it here.

Edited May 29, 200818 yr by vaughancoveny

You should probably turn DCOM back on. A lot of programs require that to be running.

I did but it did not remedy the problem.

You may be getting confused with COM (ActiveX).

Security programs often allow you to Disable DCOM, like DCOMobulator which phased out

a few years ago, but there are other programs that do allow.

Distributed COM, Distributed Transaction Coordinator and Task Scheduler all occupy, transmit and

receive through port 135 and are dangerous. Unless you need prefetch functionality use Freebyte Task Scheduler instead or do things manually.

I'm not familiar with PC Tools OnDemand but I think you reacted to a false positive. You need to disable the PC Tools OnDemand and copy the missing msiexec.exe from %WinDir%\System32\dllcache. I admire your vigilence and care, but since you were in the process of installing an application from an assumed trusted source like Microsoft, you should have let it go and investigated the issue first. These apps are nice to help people out, but they are not 100% all the time. It probably picked up the installer as a false positive and now that you've Quarantined it, it isn't about to let it be restored.

Also, the installer service is normally stopped in Manual and only started when needed for an installation.

I'm not familiar with PC Tools OnDemand but I think you reacted to a false positive. You need to disable the PC Tools OnDemand and copy the missing msiexec.exe from %WinDir%\System32\dllcache. I admire your vigilence and care, but since you were in the process of installing an application from an assumed trusted source like Microsoft, you should have let it go and investigated the issue first. These apps are nice to help people out, but they are not 100% all the time. It probably picked up the installer as a false positive and now that you've Quarantined it, it isn't about to let it be restored.

Also, the installer service is normally stopped in Manual and only started when needed for an installation.

I have similar experiences with our corporate Anti-virus. It likes to detect my programming tools as 'trojans' and 'hack tools' and tries to erase them from my hard drive and our network drives. In my case, there doesn't seem to be an option to make it ignore those things...

It's a false positive.

Remove it from the quarantined state and mark it as safe.

As Jeremy mentioned it's a false positive. Unfortunately this is very common with PC Tools software (like SpywareDoctor).

You may also want to give Dial-a-fix a go.