updef Posted August 31, 2023 ID:1586199 Share Posted August 31, 2023 Good Day! I tried updating my Windows 10 but it won't update and gave me an error code (0x80070424). Tried every steps that I could find online but no help. The wuauserv registry is missing and deleting and merging a new registry file does no help at all. I also noticed that my Windows Defender is disabled. I can't re-enable it to work as well. Looks like a bug or a malware is preventing me to do so. I tried a Windows reset but the problem still exist. I tried running Microsoft Safety Scanner and the result is attached. Hope someone can help me out. Thank you msert.log Link to post Share on other sites More sharing options...
1PW Posted August 31, 2023 ID:1586217 Share Posted August 31, 2023 Hello @updef and : While you are waiting for the next qualified/approved malware removal expert helper to weigh in on your topic, and even though you may have run the following Malwarebytes utility, or its subsets, please carefully follow these instructions: Download the Malwarebytes Support Tool. In your Downloads folder, open the mb-support-x.x.x.xxx.exe file. In the User Account Control (UAC) pop-up window, click Yes to continue the installation. Run the MBST Support Tool. In the left navigation pane of the Malwarebytes Support Tool, click Advanced. In the Advanced Options, click only Gather Logs. A status diagram displays the tool is Getting logs from your computer. WARNING: Do Not click the Repair System under Advanced unless requested to by a Malwarebytes support agent or authorized helper. A zip file named mbst-grab-results.zip will be saved to the Public desktop, please attach that file in your next reply to this topic. Please do NOT copy and paste. For the short time between when you post the diagnostic logs, and when your helper weighs in, please take no further self-directed remedial actions that will invalidate the diagnostic logs you will have posted. Thank you. 1 Link to post Share on other sites More sharing options...
Maurice Naggar Posted August 31, 2023 ID:1586229 Share Posted August 31, 2023 (edited) Hello @updef My name is Maurice. I will guide you going forward. Please do provide the MBST_GRAB zip file as per the above. Then do the following first suggestions. Show-Hidden-Folders-Files-Extensionshttps://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/ Disable-Fast-Startuphttps://forums.malwarebytes.com/topic/299350-disable-fast-startup/ I need you to run 2 new reports. Temporarily disable Microsoft SmartScreen to download the next software below ( 3 ) Download Farbar's Service Scanner utility and Save to your Desktop. Right-Click on fss.exe and select Run As Administrator. Answer Yes to ok when prompted. If your firewall then puts out a prompt, again, allow it to run. Once FSS is on-screen, be sure the following items are check-marked: Internet Services Windows Firewall System Restore Security Center/Action Center Windows Update Windows Defender Other services Click on "Scan". It will create a log (FSS.txt) in the same directory the tool is run. Please attach that file. ( 4 ) I would recommend getting a readout report as to update status of some key apps. Download SecurityCheck by glax24 from here and save the tool on the desktop. If Windows's SmartScreen block that with a message-window, then Click on the MORE INFO spot and over-ride that and allow it to proceed. This tool is safe. Smartscreen is overly sensitive. Right-click with your mouse on the Securitycheck.exe and select "Run as administrator" and reply YES to allow to run & go forward Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file. Attach it with your next reply. You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt NOTES: Do not "self-medicate" on your own, making fixes / changes / tweaks by yourself. I will guide you. If you have a question or issue, Stop and ask me first, and wait for my guidance. Lets keep these principles as we go along. Please don't run any other scans, download, install or uninstall any programs while I'm working with you. Only run the tools I guide you to. Do not run online games while case is on-going. Do not do any free-wheeling web-surfing. The removal of malware isn't instantaneous, please be patient. Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure. Please stick with me until I give you the "all clear". If your system is running Discord, please be sure to Exit out of it while this case is on-going. Edited August 31, 2023 by Maurice Naggar amended 1 Link to post Share on other sites More sharing options...
updef Posted September 1, 2023 Author ID:1586301 Share Posted September 1, 2023 Good Day Maurice! I appreciate your detailed response. I followed your instructions step by step and attached are the files and screenshots. I also read and understand the principle guide at the end of your response. I'll abide by it. Thank you mbst-grab-results.zip FSS.txt SecurityCheck.txt Link to post Share on other sites More sharing options...
updef Posted September 1, 2023 Author ID:1586367 Share Posted September 1, 2023 Hello @Maurice Naggar May I know what is the next step? Thanks Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 1, 2023 ID:1586397 Share Posted September 1, 2023 I am studying the reports. Will be formulating a special run. Patience please. I am doing help here on my personal time, as available. But in the meantime: Request to not do any changes or tweaks on your own. I am curious as to just where these were obtainined ? C:\Users\dgpam\Downloads\Fix-WUS.zip C:\Users\dgpam\Downloads\wuauserv.reg C:\Users\dgpam\Downloads\BITS.reg C:\Users\dgpam\Downloads\Windows_Update.zip C:\Users\dgpam\Downloads\Windows_Update.reg Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 1, 2023 ID:1586404 Share Posted September 1, 2023 This here is part #1. We need to do more after this run! This Windows has 3 services AWOL plus 1 disabled. seems missing SecurityHealthService, wscsvc + WinDefend ;; wuauserv is disabled. Please run the following custom script. Read all of this before you start. NOTE-1: This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It attempts to put back missing services. It clears the disablement on WUAUSERV. It will attempt to run a scan with Microsoft Defender antivirus. Depending on the speed of your computer this fix may take 50-55 minutes or more. Please Close all open work before you actually do begin this run. Farbar FRSTENGLISH program location: Downloads folder. The tool is already on system. That is what we will use. Please download the attached fixlist.txt file and save it to Downloads Fixlist.txt <- < - - - - NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work. Right-click with your mouse on FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important. next, press the Fix button just once and wait. You will see a green-color scroll display while FRST is running. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply. NOTICE: For potential outside readers, This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm. Link to post Share on other sites More sharing options...
updef Posted September 1, 2023 Author ID:1586407 Share Posted September 1, 2023 Hello @Maurice Naggar Good Day! My apologies if I seem impatient, it wont happen again. Please take your time and just respond whenever you're available. I will not do any changes on my computer. As matter of fact, I refrained from using it until the issue has been resolved. The files that you've mentioned has been downloaded a couple of days ago while I am trying to find a solution in this problem of mine. I found an article from various webpages (ex. technipages, minitool, tenforums and microsoft) that provided steps to fix the issue but to no avail. I haven't downloaded any more files nor programs into the computer since yesterday after I have read your response. Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 1, 2023 ID:1586410 Share Posted September 1, 2023 I posted a Custom-fix-script in my last reply ( above). Tenforums & Microsoft are fine but you gotta always be sure it is the proper O S version & build. Please run the custom-fix. There is yet more to do. Link to post Share on other sites More sharing options...
updef Posted September 1, 2023 Author ID:1586419 Share Posted September 1, 2023 Here is the FIXLOG. Fixlog.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 1, 2023 ID:1586427 Share Posted September 1, 2023 Round #2. Please download the attached fixlist.txt file and save it to Downloads This run will do a Windows RESTART. Fixlist.txt <- < - - - - NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work. Right-click with your mouse on FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important. next, press the Fix button just once and wait. You will see a green-color scroll display while FRST is running. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply. Link to post Share on other sites More sharing options...
updef Posted September 1, 2023 Author ID:1586433 Share Posted September 1, 2023 Attached is the Round 2 FIXLOG. Fixlog.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 1, 2023 ID:1586445 Share Posted September 1, 2023 Round #3. Please download the attached fixlist.txt file and save it to Downloads This run will do a Windows RESTART. Fixlist.txt <- < - - - - NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work. Right-click with your mouse on FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important. next, press the Fix button just once and wait. You will see a green-color scroll display while FRST is running. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply. ( 2 ): Find FSS.exe Right-Click on fss.exe and select Run As Administrator. Answer Yes to ok when prompted. If your firewall then puts out a prompt, again, allow it to run. Once FSS is on-screen, be sure the following items are check-marked: Internet Services Windows Firewall System Restore Security Center/Action Center Windows Update Windows Defender Other services Click on "Scan". It will create a log (FSS.txt) in the same directory the tool is run. Please attach that file. ( 3 ) I would highly suggest to insure that this pc is all up-to-date with security updates & cumulative updates on Windows. select the Windows Start button, and then go to Settings > Update & Security > Windows Update . and click Check for Updates. Have much patience. Link to post Share on other sites More sharing options...
updef Posted September 2, 2023 Author ID:1586546 Share Posted September 2, 2023 Round 3 Fixlog and FSS file. Fixlog.txt FSS.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 2, 2023 ID:1586649 Share Posted September 2, 2023 (edited) It appears there are still 4 missing Windows services for this Windows 10 system. They are wscsvc, Wuauserv, sense, + securityhealthservice I have attached here 1 zip file that has the registry entries for those services, plus also a new custom Fix-script. Here is the plan of approach. Download and save the zip file to a special folder on your system. It is important to remember the folder-name obviously. FOR_UPDEF.zip Then EXTRACT all content to that folder. You should see 4 .REG files Do not do anything with them yet. Please download the attached fixlist.txt file and save it to Downloads folder Fixlist.txt we need to be sure to place Windows into SAFE mode (before we do the run). You may begin to do this from the Windows-sign-in-screen. See this Microsoft support how-to-article]/url] Only when is SAFE mode,[/u] for each one of the 4 .REG files, do a RIGHT-click on the .REG file and select MERGE. And allow it to proceed to merge the content of each. That is, do that for each one. Once that has finished,. Do the custom-fix-run. Right-click with your mouse on FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important. next, press the Fix button just once and wait. You will see a green-color scroll display while FRST is running.When completed, it will do a Windows RESTART.The tool will make a log on the Downloads folder (Fixlog.txt) . The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply. Edited September 2, 2023 by Maurice Naggar Link to post Share on other sites More sharing options...
updef Posted September 2, 2023 Author ID:1586653 Share Posted September 2, 2023 Here is the Fixlog. Thanks Fixlog.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 2, 2023 ID:1586656 Share Posted September 2, 2023 Doing better. Now just Windefend registry for that service needs to be put in place. I have here 1 new zip file which needs the same sequence & procedure as used last time. And I think this time, we may do it while in normal Windows mode. Download and save the zip file to the same special folder as before on your system. FOR_UPDEF_2.zip Then EXTRACT all content to that folder. You should see windefend.REG file. do a RIGHT-click on the windefend.REG file and select MERGE. And allow it to proceed to merge. If there is some failure, stop and let me know. Do a MS Defender update & Quick scan with Microsoft Defender Antivirus Just want to do a visual check in Windows Security to see (visually) that Microsoft Defender is on , and to do a Custom scan. From the Windows Start menu, select Settings, then select Update and Security. Next, look at the left-side menu & select Windows Security Next, In Windows Security section: Click on the grey button Open Windows Security Now, click on the shield Virus and threat protection Look to see that Microsoft Defender is shown & available for use. On the next display, look at all the options. Look down the list and see "Check for Updates" . You should click on that to have the system check for updates for Windows Defender. Watch & wait for that to complete. Please also note that the Scan options (all) can be displayed by clicking on Scan options. Click that & select QUICK scan & have it go forward. Once it has started the scan phase, you can go take a long break. Let me know the results. Link to post Share on other sites More sharing options...
updef Posted September 2, 2023 Author ID:1586660 Share Posted September 2, 2023 I already Merge the windefend.reg in Normal Mode. Followed your step to check MS Defender Update, right after I click "Open Windows Security" the it shows a screen with Security at a Glance on top and nothing else. There is no Virus and Threat Protection or Check for Updates that I can click. Please see attached screenshot. Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 2, 2023 ID:1586664 Share Posted September 2, 2023 Lets do this. Do a Windows Restart. Then after it is settled down, do what follows. Select the Windows Start button, and then go to Settings > Update & Security > Windows Update . and click Check for Updates. Have much patience. Link to post Share on other sites More sharing options...
updef Posted September 2, 2023 Author ID:1586666 Share Posted September 2, 2023 Hi there, Did a Windows Restart and then proceeded to Check for Updates. Here is the screenshot Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 2, 2023 ID:1586669 Share Posted September 2, 2023 Close the Windows Update screen ( if still open), Then Restart Windows. Then we need to do a couple of scans, and then a new report. Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed. It will not take much time, First download & save itguide & download link Then be sure to close all web browsers after the download & before launching the tool. Then go to where the EXE file is saved. Start Adwcleaner. Then do a scan with Adwcleaner Guide article [ 2 ] Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center Click the Security Tab. Scroll down to "Windows Security Center" Click the selection to the left for the line "Always register Malwarebytes in the Windows Security Center". { We want that to be set as Off .... be sure that line's radio-button selection is all the way to the Left. thanks. } This will not affect any real-time protection of the Malwarebytes for Windows 😃. now Click the General tab. Under Application updates, click the Check for updates button. When it shows a new version available, Accept it and let it proceed forward. Be sure it succeeds. If prompted to do a Restart, just please follow all directions. Let me know how that goes. Next, the Malwarebytes scan Next, click the small x on the Settings line to go to the main Malwarebytes Window. Next click the blue button marked Scan. When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical. >>>>>> 👉 You can actually click the topmost left check-box on the very top line to get ALL lines ticked ( all selected). <<<< 💢 Please double verify you have that TOP check-box tick marked. and that then, all lines have a tick-mark Then click on Quarantine button. [ 3 ] Find and then launch mb-support-1.9.2.982.exe Once you start it click Advanced >>> then Gather Logs Have patience till the run has finished. It will take several minutes to generate a report set. Attach the mbst-grab-results.zip from the Desktop to your reply.. Link to post Share on other sites More sharing options...
updef Posted September 2, 2023 Author ID:1586673 Share Posted September 2, 2023 The adwcleaner and malwarebytes scan results is attached. Plus the zip file of mbst-grab. mbst-grab-results.zip Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 2, 2023 ID:1586684 Share Posted September 2, 2023 There is still some very pesky "restriction" on MS Defender, and, the Windefend service is AWOL missing. new Round #5. Please download the attached fixlist.txt file and save it to Downloads This run will do a Windows RESTART. Fixlist.txt <- < - - - - NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work. We can do this run from normal Windows-mode. Right-click with your mouse on FRSTENGLISH and select "Run as Administraor" and reply Yes and allow it to proceed when prompted. That is important. next, press the Fix button just once and wait. You will see a green-color scroll display while FRST is running. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply. Link to post Share on other sites More sharing options...
updef Posted September 2, 2023 Author ID:1586707 Share Posted September 2, 2023 Very pesky indeed. But I am confident you can eliminate this restriction and restore it in order. We just need some more time. Attached is the Round 5 Fixlog. Fixlog.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 3, 2023 ID:1586716 Share Posted September 3, 2023 Got it. Thanks. Still unsure what-all is the source of corruption. Create an Autoruns Log: Please download Sysinternals Autoruns from here: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns Save Autoruns.zip to your computer. Then locate it and extract it to a new folder where you can find and run it. Once it starts you may not be able to easily stop the scan but you can try to press the Escape key on your keyboard. Once scanning is stopped, click on the Options menu at the top of the program and select Scan Options... Then place a check mark on the following items Verify Code Signatures, Check VirusTotal.com, and Submit Unknown Images Then click the Rescan button. Agree to the VirusTotal EULA Once the new scan has been completed, please click on the File button at the top of the program and select Save, or use the Save icon, and save the Autoruns.arn file to your desktop and close Autoruns. Right-click on the Autoruns.arn file (it will typically be the name of your computer) on your desktop or where you save it, and hover your mouse over Send To and select Compressed (zipped) Folder Attach the Autoruns.zip folder (your computer name.zip) you just created to your next reply. Link to post Share on other sites More sharing options...
Recommended Posts