Unable to stop the agent at this time

[Chame]

I've been using Immunet for quite some time, but after a Windows 10 updated today, Immunet vanished from my computer. The Immunet Program Files folder is not there anymore, and I can't install it again because I keep getting this error: "Unable to stop the agent at this time. You will have to reboot your machine...".

After a quick check, I saw that Windows thinks Immunet's working (because Windows Antivirus can't be enabled), and there are services related to the program. I already tried restarting the computer, erasing all the Immunet files from the registry, all the processes, all of the drivers (In the System32\Drivers folder). But the problem persists.

The installer displays "Found Version 0. Upgrading to 6.3.0.10988", and some lines later it stops at "Added RunOnce Key". Is there any way to manually remove Immunet?, Am I missing something?

EDIT1: The uninstaller was not present after the Update too.

Thanks for taking the time to read

Edited June 20, 2019 by Chame

[ritchie58]

Wow! Something went wrong there! What Windows 10 Update file(s) are you referring to? KB???

To view these recent update files first click on Update and Security -> scroll down & select Windows Update -> click on Advanced Options -> click on View your update history.

We do take any conflict with any Windows Update files "very seriously!"

[Chame]

The update was Windows 10 1903 June 11, 2019 KB4503293 . But since my first post some computers here (with Immunet installed) have updated and are experiencing no problems. That makes me believe that something went wrong while updating the affected computer, and that's what caused the problem. I reported the problem to Microsoft.

Anyway, I'd like to know if there's a way to remove all of Immunet files as I can't reinstall Windows right now and I want to keep using Immunet in the PC.

Thanks.

[ritchie58]

Microsoft did make some significant changes with the KB4503293 update but why it affected Immunet like that remains a mystery.

If Immunet's built in uninstaller is not present might I suggest you use a good third-party uninstaller package like Revo Uninstaller.

The free version will work adequately if you have a 32bit system but I would suggest using the fully functional free trial of the Pro version if you have a 64bit system. The Pro version better supports 64bit systems. https://www.revouninstaller.com/revo-uninstaller-free-download/

Never used Revo before? Not to worry, there are some great tutorial videos on Youtube you can view before using the software. Just type in Revo Uninstaller in Youtube's search bar.

Also, it might not be a bad idea if you first enter Safe Mode ("without Networking") before using the uninstaller. You will have to install Revo first before entering Safe Mode of course. Here's a link to a Microsoft Knowledge Base article that explains how to enter Safe Mode with Win 10 if you're not sure how that's done. https://support.microsoft.com/en-us/help/12376/windows-10-start-your-pc-in-safe-mode

Regards, Ritchie...

[Chame]

Thanks for the help, but Revo Uninstaller didn't work. Immunet is not appearing in the list and I can't use the Hunter mode as there's no GUI left to scan. The only trace I can find of Immunet is in startup programs, "Ipnet" (but that file is not present in the system anymore).

And the same thing's happening in Safe Mode. I guess the only option left is to reinstall Windows, but if you have any more ideas, i'd love to try them.

Here's the installer log: https://pastebin.com/2v9YfEGp

Edited June 21, 2019 by Chame

[ritchie58]

Sorry to hear Revo wasn't much help to you Chame. Usually that software is great at dealing with uninstalling stubborn programs or finding left over files from a botched uninstall.

Since no other user, thus far, has reported the same issue I believe this to be an isolated, anomalous occurrence.

I think it really wasn't a good idea at all to just start manually deleting stuff, especially in the registry.

Do you use any type of system imaging or did you, by any chance, create a bootable Win 10 emergency recovery CD or USB device that will write over any corrupted Windows Operating System files or re-install any missing ones? If not, I'm at a loss as to what to try next. Maybe it might be that you'll have to re-format your OS unfortunately.

[Chame]

Problem solved.

I used Immunet installer (found in the \Temp folder) in a Windows 10 virtual machine, then I monitored the uninstaller process handlers while I used Revo Uninstaller. Then I erased (on my real, affected PC) all of the files the Uninstaller modified/erased (Cleanup agent included) and that Revo had to erase too (I used a Linux LiveCD as some files/registry entries were blocked). It looks like Immunet uses Cisco's AMP, (Self Protect, Policy files...) and all of those files are kind of hidden and well protected. After all that was done, Immunet installed correctly.

If someone's having this problem, please don't do as I did, as this process is very, very risky and Windows will most certainly get damaged. Just disable your antivirus before installing KB4503293 update. It seems like this problem could happen with any antivirus, but Immunet has no Removal Tool and so the only fix is to reinstall (a system restore point won't do the trick) Windows.

Anyway, this is a really unique problem so I don't think someone will ever run into this issue where Windows removes Immunet files (and uninstallers). Still, Cisco should offer a Removal Tool to avoid these situations.

Thanks for all the help you've given to me, ritchie58.

[ritchie58]

Hi Chame, Immunet's processes are hardened against outside sources being able to disable them easily. That is a security feature with the software.

I'm still perplexed as to why the installer recognized version 0 as previously installed & seemed to get stuck there. That's weird! Obviously there never has been a version 0. It's like the installer couldn't recognize what previous version was already installed. That leads me to believe that maybe some .dll scripts related to the history files got corrupted some how during the Windows update. A plausible extrapolation.

Your idea of creating a "Immunet Removal Tool", that would work with the newest 6 builds, to find and delete all Immunet files in case the normal uninstall goes wrong definitely has some merit! Great idea in my view actually! You should also add a new topic in the "Ideas" section of the forum regarding this. If you don't maybe I will but it's your idea so post in that section first if you so desire.

I'd like to also commend you on the rather unorthodox fix you were able to conjure up but if it worked that's the most important thing! Way to go, I'm impressed!

Best wishes, Ritchie...