Windows Update Registry is Missing, Windows Defender Disabled

[updef]

Good Day!

I tried updating my Windows 10 but it won't update and gave me an error code (0x80070424). Tried every steps that I could find online but no help. The wuauserv registry is missing and deleting and merging a new registry file does no help at all. 

I also noticed that my Windows Defender is disabled. I can't re-enable it to work as well. Looks like a bug or a malware is preventing me to do so.

I tried a Windows reset but the problem still exist.

I tried running Microsoft Safety Scanner and the result is attached.

Hope someone can help me out. Thank you

msert.log

[1PW]

Hello @updef and :

While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run the following Malwarebytes utility, or its subsets, please carefully follow these instructions:

1. Download the Malwarebytes Support Tool.
2. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file.
3. In the User Account Control (UAC) pop-up window, click Yes to continue the installation.
4. Run the MBST Support Tool.
5. In the left navigation pane of the Malwarebytes Support Tool, click Advanced.
6. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer.  WARNING: Do Not click the Repair System under Advanced unless requested to by a Malwarebytes support agent or authorized helper.
7. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please attach that file in your next reply to this topic. Please do NOT copy and paste.

For the short time between when you post the diagnostic logs, and when your helper weighs in, please take no further self-directed remedial actions that will invalidate the diagnostic logs you will have posted.

Thank you.

[Maurice Naggar]

Hello @updef My name is Maurice. I will guide you going forward. Please do provide the MBST_GRAB zip file as per the above. Then 

do the following first suggestions.

Show-Hidden-Folders-Files-Extensions
https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

Disable-Fast-Startup
https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

I need you to run 2 new reports. Temporarily disable Microsoft SmartScreen to download the next software below

(  3 ) 

Download   Farbar's Service Scanner utility

and Save to your Desktop.

Right-Click on fss.exe and select Run As Administrator.

Answer Yes to ok when prompted.

If your firewall then puts out a prompt, again, allow it to run.

Once FSS is on-screen, be sure the following items are check-marked:

• Internet Services
  Windows Firewall
  System Restore
  Security Center/Action Center
  Windows Update
  Windows Defender
  Other services

  

Click on "Scan".

It will create a log (FSS.txt) in the same directory the tool is run.   Please attach that file.  

( 4 ) 

I would recommend getting a readout report as to update status of some key apps.
Download SecurityCheck by glax24 from here

and save the tool on the desktop.

                   If Windows's  SmartScreen block that with a message-window, then
                         Click on the MORE INFO spot and over-ride that and allow it to proceed.

                             This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

NOTES: Do not "self-medicate" on your own, making fixes / changes / tweaks by yourself.  I will guide you. If you have a question or issue, Stop and ask me first, and wait for my guidance.

 Lets keep these principles as we go along.

• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

Edited August 31, 2023 by Maurice Naggar
amended

[updef]

Good Day Maurice!

I appreciate your detailed response. I followed your instructions step by step and attached are the files and screenshots. I also read and understand the principle guide at the end of your response. I'll abide by it. Thank you

mbst-grab-results.zip FSS.txt SecurityCheck.txt

[updef]

Hello @Maurice Naggar May I know what is the next step? Thanks

[Maurice Naggar]

I am studying the reports. Will be formulating a special run. Patience please. I am doing help here on my personal time, as available. But in the meantime:
Request to not do any changes or tweaks on your own.
I am curious as to just where these were obtainined ?
C:\Users\dgpam\Downloads\Fix-WUS.zip
C:\Users\dgpam\Downloads\wuauserv.reg
C:\Users\dgpam\Downloads\BITS.reg
C:\Users\dgpam\Downloads\Windows_Update.zip
C:\Users\dgpam\Downloads\Windows_Update.reg

[Maurice Naggar]

This here is part #1. We need to do more after this run! This Windows has 3 services AWOL plus 1 disabled. seems missing SecurityHealthService, wscsvc + WinDefend ;; wuauserv is disabled. Please run the following custom script. Read all of this before you start. 

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It attempts to put back missing services. It clears the disablement on WUAUSERV. It will attempt to run a scan with Microsoft Defender antivirus.  Depending on the speed of your computer this fix may take 50-55 minutes or more.

Please Close all open work before you actually do begin this run.

Farbar  FRSTENGLISH program location:   Downloads folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to Downloads

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

[updef]

Hello @Maurice Naggar 

Good Day!

My apologies if I seem impatient, it wont happen again. Please take your time and just respond whenever you're available.
I will not do any changes on my computer. As matter of fact, I refrained from using it until the issue has been resolved.

The files that you've mentioned has been downloaded a couple of days ago while I am trying to find a solution in this problem of mine. I found an article from various webpages (ex. technipages, minitool, tenforums and microsoft) that provided steps to fix the issue but to no avail. I haven't downloaded any more files nor programs into the computer since yesterday after I have read your response.

[Maurice Naggar]

I posted a Custom-fix-script in my last reply ( above).  Tenforums & Microsoft are fine but you gotta always be sure it is the proper O S version & build. Please run the custom-fix. There is yet more to do.

[updef]

Here is the FIXLOG.

Fixlog.txt

[Maurice Naggar]

Round #2. Please download the attached fixlist.txt file and save it to Downloads This run will do a Windows RESTART.

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

[updef]

Attached is the Round 2 FIXLOG.

Fixlog.txt

[Maurice Naggar]

Round #3. Please download the attached fixlist.txt file and save it to Downloads This run will do a Windows RESTART.

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

( 2 ):  Find FSS.exe

Right-Click on fss.exe and select Run As Administrator.

Answer Yes to ok when prompted.

If your firewall then puts out a prompt, again, allow it to run.

Once FSS is on-screen, be sure the following items are check-marked:

• Internet Services
  Windows Firewall
  System Restore
  Security Center/Action Center
  Windows Update
  Windows Defender
  Other services

  

Click on "Scan".

It will create a log (FSS.txt) in the same directory the tool is run.   Please attach that file.  

( 3 ) 

I would highly suggest to insure that this pc is all up-to-date with security updates & cumulative updates on Windows. select the Windows Start  button, and then go to Settings  > Update & Security  > Windows Update . and click Check for Updates.
Have much patience.

[updef]

Round 3 Fixlog and FSS file.

Fixlog.txt FSS.txt

[Maurice Naggar]

It appears there are still 4 missing Windows services for this Windows 10 system. They are wscsvc, Wuauserv, sense, + securityhealthservice

I have attached here 1 zip file that has the registry entries for those services, plus also a new custom Fix-script. Here is the plan of approach.

Download and save the zip file to a special folder on your system. It is important to remember the folder-name obviously.

FOR_UPDEF.zip

Then EXTRACT all content to that folder. You should see 4 .REG files

Do not do anything with them yet.

Please download the attached  fixlist.txt  file and save it to Downloads folder

Fixlist.txt

we need to be sure to place Windows into SAFE mode  (before we do the run).

You may begin to do this from the Windows-sign-in-screen. See this Microsoft support how-to-article]/url]

Only when is SAFE mode,[/u]

for each one of the 4 .REG files, do a RIGHT-click on the .REG file and select MERGE. And allow it to proceed to merge the content of each. That is, do that for each one.

Once that has finished,. Do the custom-fix-run.

Right-click with your mouse on FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
When completed, it will do a Windows RESTART.
The tool will make a log on the Downloads folder (Fixlog.txt) .

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

Edited September 2, 2023 by Maurice Naggar

[updef]

Here is the Fixlog. Thanks

Fixlog.txt

[Maurice Naggar]

Doing better. Now just Windefend registry for that service needs to be put in place.
I have here 1 new zip file which needs the same sequence & procedure as used last time.
And I think this time, we may do it while in normal Windows mode.

Download and save the zip file to the same special folder as before on your system. 

FOR_UPDEF_2.zip

Then EXTRACT all content to that folder. You should see  windefend.REG file.

do a RIGHT-click on the windefend.REG file and select MERGE. And allow it to proceed to merge.

If there is some failure, stop and let me know.

Do a MS Defender update & Quick  scan with Microsoft Defender Antivirus 

Just want to do a visual check in Windows Security to see (visually) that Microsoft Defender is on , and to do a Custom scan.

From the Windows Start menu, select Settings, then select Update and Security.

Next, look at the left-side menu & select Windows Security

Next, In Windows Security section: Click on the grey button Open Windows Security

Now, click on the shield Virus and threat protection

Look to see that Microsoft Defender is shown & available for use.

On the next display, look at all the options.  Look down the list and see "Check for Updates" .

You should click on that to have the system check for updates for Windows Defender.  Watch & wait for that to complete.

Please also note that the Scan options (all) can be displayed by clicking on Scan options.   Click that & select QUICK scan  & have it go forward.

Once it has started the scan phase, you can go take a long break.   Let me know the results.

 

[updef]

I already Merge the windefend.reg in Normal Mode. 

Followed your step to check MS Defender Update, right after I click "Open Windows Security" the it shows a screen with Security at a Glance on top and nothing else. There is no Virus and Threat Protection or Check for Updates that I can click.

Please see attached screenshot.

[Maurice Naggar]

Lets do this. Do a Windows Restart. Then after it is settled down, do what follows. Select the Windows Start  button, and then go to Settings  > Update & Security  > Windows Update . and click Check for Updates.
Have much patience.

[updef]

Hi there, Did a Windows Restart and then proceeded to Check for Updates. Here is the screenshot 

[Maurice Naggar]

Close the Windows Update screen ( if still open),  Then Restart Windows. Then we need to do a couple of scans, and then a new report.

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it
guide & download link

Then be sure to close all web browsers after the download & before launching the tool.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

Guide article

[  2  ]

Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

• now Click the General tab.
• Under Application updates, click the Check for updates button.

When it shows a new version available, Accept it and let it proceed forward.  Be sure it succeeds.

If prompted to do a Restart, just please follow all directions.

Let me know how that goes.    Next, the Malwarebytes scan

Next, click the small x on the Settings line to go to the main Malwarebytes Window.   Next click the blue button marked Scan.

 

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

>>>>>>      👉      You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).         <<<<     💢

 

Please double verify you have that TOP  check-box tick marked.   and that then, all lines have a tick-mark

 

Then click on Quarantine  button.

[   3   ]

Find and then launch mb-support-1.9.2.982.exe
Once you start it click Advanced >>> then Gather Logs

Have patience till the run has finished. It will take several minutes to generate a report set.
Attach the mbst-grab-results.zip from the Desktop to your reply..

[updef]

The adwcleaner and malwarebytes scan results is attached. Plus the zip file of mbst-grab.

mbst-grab-results.zip

[Maurice Naggar]

There is still some very pesky "restriction" on MS Defender, and, the Windefend service is AWOL missing.

new Round #5. Please download the attached fixlist.txt file and save it to Downloads This run will do a Windows RESTART.

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work. We can do this run from normal Windows-mode.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

[updef]

Very pesky indeed. But I am confident you can eliminate this restriction and restore it in order. We just need some more time.

Attached is the Round 5 Fixlog.

Fixlog.txt

[Maurice Naggar]

Got it. Thanks. Still unsure what-all is the source of corruption. 

Create an Autoruns Log:

• Please download Sysinternals Autoruns from here:   https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
• Save Autoruns.zip to your computer. Then locate it and extract it to a new folder where you can find and run it.
• Once it starts you may not be able to easily stop the scan but you can try to press the Escape key on your keyboard.
• Once scanning is stopped, click on the Options menu at the top of the program and select Scan Options... 
• Then place a check mark on the following items Verify Code Signatures, Check VirusTotal.com, and Submit Unknown Images
• Then click the Rescan button. Agree to the VirusTotal EULA
• Once the new scan has been completed, please click on the File button at the top of the program and select Save, or use the Save icon, and save the Autoruns.arn file to your desktop and close Autoruns.
• Right-click on the Autoruns.arn file (it will typically be the name of your computer) on your desktop or where you save it, and hover your mouse over Send To and select Compressed (zipped) Folder
• Attach the Autoruns.zip folder (your computer name.zip) you just created to your next reply.