Microsoft KB Archive/925267

= The installation process stops responding, or you receive an error message when you try to install the .NET Framework 2.0, the .NET Framework 1.1, or the .NET Framework 1.0 =

Article ID: 925267

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft .NET Framework 2.0
 * Microsoft .NET Framework 1.1
 * Microsoft .NET Framework 1.0

-



SYMPTOMS
When you try to install the Microsoft .NET Framework 2.0, the .NET Framework 1.1, or the .NET Framework 1.0, you may experience the following problems:  The installation process stops responding. You receive an error message that resembles the following:

.NET Framework 1.1 Setup has ended prematurely



Note The .NET Framework installation process fails when it tries to register the System.EnterpriseServices.dll file.



CAUSE
This problem occurs if the computer is infected with a variant of the HaxDoor virus.



RESOLUTION
To resolve this problem, follow these steps:  Open your browser to Windows Live OneCare. To do this, visit the following Microsoft Web site:

http://onecare.live.com/site/en-us/default.htm

 Click Full Service Scan, read the service agreement, and then click Accept. You must accept the terms of the service agreement to continue. On the Install the scanner page, click Install Now. Click Install in the dialog box that appears. As soon as the installation is complete, click Launch Scanner.</li> Select the Complete scan (recommended) option, and then click Next.</li> When the scan is complete, try to install the .NET Framework.</li></ol>

If you still cannot install the .NET Framework, follow these steps:
 * 1) Open the %WinDir%\System32 folder. To do this, click Start, click Run, type %windir%\system32, and then click OK.
 * 2) Try to locate one of the following files:
 * 3) * Avload32.dll
 * 4) * Logon16x.dll
 * 5) * Yvsvga.dll
 * 6) * Lanh64.sys
 * 7) If you see one of the files that is listed in step 2, right-click the file, and then click Delete.

If you cannot delete the file, you will have to restart the computer in safe mode. To do this, follow these steps:
 * 1) Click Start, click Run, type msconfig, and then click OK.
 * 2) Click the BOOT.INI tab, click to select the /SAFEBOOT check box, and then click OK.
 * 3) In the System Configuration dialog box, click Restart.
 * 4) In safe mode, open the %WinDir%\System32 folder, right-click the file that you want to delete, and then click Delete.

If you still cannot delete the file, follow these steps:
 * 1) Right-click the file, and then click Properties.
 * 2) Click the Security tab, and then click Administrators under Group or user names.
 * 3) In the Permissions for Administrators area, click to select the Deny check box for all available permissions.
 * 4) Under Group or user names, click SYSTEM.
 * 5) In the Permissions for SYSTEM area, click to select the Deny check box for all available permissions.
 * 6) Click OK to close the Properties dialog box.
 * 7) Try to delete the file again.

If you still cannot delete the file, follow these steps:
 * 1) Try to rename the file.
 * 2) Restart the computer.
 * 3) Open the %WinDir%\System32 folder, right-click the file that you want to delete, and then click Delete.

You can now restart the computer in normal mode. To do this, follow these steps: <ol style="list-style-type: lower-alpha;"> Click Start, click Run, type msconfig, and then click OK.</li> Click the BOOT.INI tab, click to clear the /SAFEBOOT check box, and then click OK.</li> In the System Configuration dialog box, click Restart.</li></ol>

You should now be able to install the .NET Framework.

Note Regardless of whether you can install the .NET Framework, we recommend that you visit the Windows Live OneCare Web site and perform a complete virus scan.

<div class="moreinformation_section">

MORE INFORMATION
The HaxDoor virus creates a hidden process. Additionally, the virus hides files and registry keys. The executable file name of the HaxDoor virus may vary. But the file name is frequently Mszx23.exe. Many variants of this virus put a driver that is named Vdmt16.sys or Vdnt32.sys on the computer. This driver is used to hide the virus process. The HaxDoor virus variants can restore these files if you delete them.

Additional query words: HaxDoor

Keywords: kberrmsg kbtshoot kbprb kbmsnpartnerportal kbmsnqwestportal KB925267

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.