After uninstalling Microsoft OneCare (beta) some users are reporting error
messages in the Application log of Event Viewer similar to the following:
"Event provider attempted to register query "SELECT * FROM
__InstanceCreationEvent WHERE TargetInstance ISA "MPSSVC_Agent" " whose
target class "MPSSVC_Agent" does not exist. The query will be ignored. "

The following procedure should do away with these error messages.

- go to Start|Run.

- Type "services.msc" (without quotes).

- Look for this service : Windows Management Instrumentation

- Right-click on it and choose Stop.

- Windows will warn you that Security Center and Windows Firewall will
also be stopped. Say YES.

- Using "Windows Explorer" or "My Computer" navigate to the
C:\Windows\System32\Wbem folder.

- Delete the REPOSITORY subfolder that you will find in there.

- Windows will rebuild a new one after reboot.

- Restart the WMI service and any other services which you stopped above by
right clicking on it and choosing Start.

- After one minute restart your PC and test.

- The three error messages should no longer be there.


--
~john aka: jopa


I don't have access to the Newsgroups for this beta App. and perhaps they
have already addressed this issue. Possibly Carey Frisch or PA Bear or
someone would forward this on...?? It may be useful information.

From: "jopa66" <jopa66-nospam@hotmail.com>

| After uninstalling Microsoft OneCare (beta) some users are reporting error
| messages in the Application log of Event Viewer similar to the following:
| "Event provider attempted to register query "SELECT * FROM
| __InstanceCreationEvent WHERE TargetInstance ISA "MPSSVC_Agent" " whose
| target class "MPSSVC_Agent" does not exist. The query will be ignored. "
|
| The following procedure should do away with these error messages.
|
| - go to Start|Run.
|
| - Type "services.msc" (without quotes).
|
| - Look for this service : Windows Management Instrumentation
|
| - Right-click on it and choose Stop.
|
| - Windows will warn you that Security Center and Windows Firewall will
| also be stopped. Say YES.
|
| - Using "Windows Explorer" or "My Computer" navigate to the
| C:\Windows\System32\Wbem folder.
|
| - Delete the REPOSITORY subfolder that you will find in there.
|
| - Windows will rebuild a new one after reboot.
|
| - Restart the WMI service and any other services which you stopped above by
| right clicking on it and choosing Start.
|
| - After one minute restart your PC and test.
|
| - The three error messages should no longer be there.
|

Since it is one of the worst if not the worst anti virus solutions availbale OneCare (a
Beta) should just be removed !

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:eBcykUBEGHA.2648@TK2MSFTNGP11.phx.gbl...
> From: "jopa66" <jopa66-nospam@hotmail.com>
>
>
> Since it is one of the worst if not the worst anti virus solutions
> availbale OneCare (a
> Beta) should just be removed !
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>

I agree. But the uninstall is not clean. Some junk is left behind and even
cleaning up the registry does not eliminate those errors in the Application
Log. The procedure outlined above will get rid of the errors. (or one could
always re-install Windows, I guess.)


--
~john aka: jopa

From: "jopa66" <jopa66-nospam@hotmail.com>


| I agree. But the uninstall is not clean. Some junk is left behind and even
| cleaning up the registry does not eliminate those errors in the Application
| Log. The procedure outlined above will get rid of the errors. (or one could
| always re-install Windows, I guess.)
|

I just tested their so-called anti virus software against a Backdoor.Haxdoor Trojan variant
that is being installed by systems compromised by the Exploit-EMF. NADA -- No detection !

Sophos Report:

>>> Virus 'Troj/Haxdor-Fam' found in file c:\1\qz.dll
>>> Virus 'Troj/Haxdor-Fam' found in file c:\1\avpe32.dll
>>> Virus 'Troj/Haxdor-Gen' found in file c:\1\avpe64.sys
>>> Virus 'Troj/Haxdor-Gen' found in file c:\1\qz.sys

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:%23lR%236eBEGHA.984@tk2msftngp13.phx.gbl...
> From: "jopa66" <jopa66-nospam@hotmail.com>
>
>
> | I agree. But the uninstall is not clean. Some junk is left behind and
> even
> | cleaning up the registry does not eliminate those errors in the
> Application
> | Log. The procedure outlined above will get rid of the errors. (or one
> could
> | always re-install Windows, I guess.)
> |
>
> I just tested their so-called anti virus software against a
> Backdoor.Haxdoor Trojan variant
> that is being installed by systems compromised by the Exploit-EMF.
> NADA -- No detection !
>
> Sophos Report:
>
>>>> Virus 'Troj/Haxdor-Fam' found in file c:\1\qz.dll
>>>> Virus 'Troj/Haxdor-Fam' found in file c:\1\avpe32.dll
>>>> Virus 'Troj/Haxdor-Gen' found in file c:\1\avpe64.sys
>>>> Virus 'Troj/Haxdor-Gen' found in file c:\1\qz.sys
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>

I didn't even test it that far. It slowed my machine so badly that I
promptly uninstalled it. That was a couple weeks ago and I've been plagued
with those EV error messages ever since. Couldn't find a solution on the Web
but, I did find something similar and adapted the procedure. And now I'm a
happy camper.


--
~john aka: jopa

From: "jopa66" <jopa66-nospam@hotmail.com>


| I didn't even test it that far. It slowed my machine so badly that I
| promptly uninstalled it. That was a couple weeks ago and I've been plagued
| with those EV error messages ever since. Couldn't find a solution on the Web
| but, I did find something similar and adapted the procedure. And now I'm a
| happy camper.
|

I use the the web site. Same engine and signatures but web based.

I recently tested a zoo. 22% catch rate !

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm