Windows Update service is not running

[deniarH]

Hi, I just got an old PC and I can't install malwarebytes because I have to update/install something first, and when I try to open the Windows Update service, I can't run it and I got this message

I tried to google how to fix it but most of the time I saw step that say I have to stop the Windows Update on Service, and the problem is, there's no Windows Update on my service list

[AdvancedSetup]

Hello @deniarH

Let me get some logs please to see what's going on

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

 

 

[deniarH]

Hello, this is the scan result

FRST.txt Addition.txt

[AdvancedSetup]

Thank you for the logs. Basically it looks like you probably need to try the following

How to obtain and install Windows 7 SP2
https://answers.microsoft.com/en-us/windows/forum/windows_7-update/how-to-obtain-and-install-windows-7-sp2/c2c7009f-3a10-4199-9c89-48e1e883051e

 

Update to enable TLS 1.1 and TLS 1.2 as default secure protocols in WinHTTP in Windows
https://support.microsoft.com/en-us/help/3140245/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-wi

 

If you run into issues getting those updates installed let me know

 

[deniarH]

Hello, I tried to install Windows 7 SP2, but I got this warning instead

 

[AdvancedSetup]

Please download the following tool

Farbar Service Scanner and run it on the computer with the issue
http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/

 

Make sure the following options are checked:

• Internet Services
• Windows Firewall
• System Restore
• Security Center/Action Center
• Windows Update
• Windows Defender

Click "Scan"

It will create a log (FSS.txt) in the same directory the tool is run.
Please attach the log to your next reply.

 

[deniarH]

This is the scan file

FSS.txt

[AdvancedSetup]

Thank you @deniarH

Please download the following REGISTRY file. Save it to your computer. Then double-click on it to import it into the Registry. When asked click Yes or OK to import it.

https://download.bleepingcomputer.com/win-services/7/wuauserv.reg

Then restart the computer and run the Farbar Service Scanner tool again and post back the new log.

 

[deniarH]

Hello, this is the new scan file

Addition.txt FRST.txt

[AdvancedSetup]

The computer is infected. Please run the following and we'll work on getting it cleaned up

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real time antivirus or security software before running this script. Once completed make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[deniarH]

This is the fix log

Fixlog.txt

[AdvancedSetup]

Good, the log looks pretty good.

Please run the following for me

 

[deniarH]

Hello, this is the scan result

system-log.txt mbar-log-2021-05-15 (08-03-11).txt

[AdvancedSetup]

Okay, please run FRST one more time and click on Scan and post back both new logs.

 

[deniarH]

This is the scan result

FRST.txt Addition.txt

[AdvancedSetup]

Please save the attached fixlist.txt file to the same location as FRST and then click the FIX button.

fixlist.txt

Then see if you can update Windows or not

 

 

How to obtain and install Windows 7 SP2
https://answers.microsoft.com/en-us/windows/forum/windows_7-update/how-to-obtain-and-install-windows-7-sp2/c2c7009f-3a10-4199-9c89-48e1e883051e

 

Update to enable TLS 1.1 and TLS 1.2 as default secure protocols in WinHTTP in Windows
https://support.microsoft.com/en-us/help/3140245/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-wi

 

[deniarH]

On 5/14/2021 at 8:29 AM, deniarH said:

Hello, I tried to install Windows 7 SP2, but I got this warning instead

 

Hi, I still get the same message like this

[AdvancedSetup]

Okay, please run the FSS (Farbar Service Scanner)

 

Please download the following tool

Farbar Service Scanner and run it on the computer with the issue
http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/

 

Make sure the following options are checked:

• Internet Services
• Windows Firewall
• System Restore
• Security Center/Action Center
• Windows Update
• Windows Defender

Click "Scan"

It will create a log (FSS.txt) in the same directory the tool is run.
Please attach the log to your next reply.

 

[deniarH]

This is the newest FSS

FSS.txt

[AdvancedSetup]

Please try this again.

Please download the following REGISTRY file. Save it to your computer. Then double-click on it to import it into the Registry. When asked click Yes or OK to import it.

https://download.bleepingcomputer.com/win-services/7/wuauserv.reg

Then restart the computer and run the Farbar Service Scanner tool again and post back the new log.

 

NEXT:

Please download and run the following Kaspersky antivirus scanner to remove any found threats

Kaspersky Virus Removal Tool

Let me know if it finds anything or not and if the import of the registry fix works now or not.

 

[deniarH]

Hello, I already did the last step you told me and Windows Update is working, literally a notification show up while it didn't before, currently downloading the update as I typing this. They are about 35 threats found by Kaspersky antivirus, I already delete everything, but I couldn't find any log from Kaspersky though

This is the new log before I used Kaspersky antivirus

FRST.txt Addition.txt

[AdvancedSetup]

Yes, the computer had a difficult to remove rootkit which is why we're having to repeat steps.

Please run the following for me. You will want to use the 64-bit version

 

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system.

The download links & the how-to-run-the tool are at this link at Microsoft

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

Please let me know the results of this scan.

The log is named MSERT.log 

the log will be at  %SYSTEMROOT%\debug\msert.log   which in most cases is

C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

 

[AdvancedSetup]

After you have completed the Microsoft Safety Scanner above please run the following fix.

 

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real time antivirus or security software before running this script. Once completed make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[deniarH]

Hello, this is the result with Microsoft Safety Scanner and I already did the last step above

 

msert.log

[AdvancedSetup]

No you did not run the script above before. That is a new script. Please run that script as requested and post back the new FIXLOG.txt file.

Thank you again