Error with WIndows Update

[coolingwater]

Hello everyone,

Thanks for taking the time to read my issue regarding Malwarebytes and Windows Update.

Recently this week, I am facing an issue with installing a microsoft update (Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.401.587.0) - Current Channel (Broad)) but I keep getting an install error message  0x80070643. I have read through some of the previous threads here which suggest that some people were successful in updating when they disable Malwarebytes on startup. I have tried the aforementioned method but still am facing the same issue. Please see attached.

I am not sure if this is a Malwarebytes related issue or not, but I was hoping i could get some help from some kind souls here.

On a side note, this issue has caused my windows security virus and threat protection to turn off and i am unable to restart it. Sometimes i get a message:
"Page not available, your IT administrator has limited access to some area of this app...",
Although I am very sure there my account is not connected to either, I have also checked this in my accounts settings. I am unsure if they are related.

Thank you and appreciate any help you may provide.

[Porthos]

8 minutes ago, coolingwater said:

I am not sure if this is a Malwarebytes related issue or not, but I was hoping i could get some help from some kind souls here.

Please do the following so that we may take a closer look at your system.

Do these 2 steps so that ALL folders & Files are set to SHOW, plus also, Turn OFF Windows Fast start.
Show-Hidden-Folders-Files-Extensions
https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

Disable-Fast-Startup
https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

Then please restart the computer and do the following.

WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Desktop or on the hidden Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply
  
   

Thank you

Edited November 14, 2023 by Porthos

[coolingwater]

Hi @Porthos,

Thank for for your time.

Please find the requested log attached.

Cheers.

mbst-grab-results.zip

[Maurice Naggar]

Hello @coolingwater My name is Maurice. I will guide and help you going forward. Allow me some bit of time to review your report. I will be providing you with a custom script to alleviate the sistuation of failed Windows Update. The fail code is all too common. It is not related to anything from or with Malwarebytes. It is an all too common "glitch", seen frequently. The one kicker here is 

Quote

windows security virus and threat protection to turn off and i am unable to restart i

I will review your report and get back to you. Have patience. Thanks.

[coolingwater]

Hi @Maurice Naggar, appreciate your help very much and thank you for the response.

Yea. the windows security threat protection not restarting is worrying but I assumed it was because the updates hasn't installed.

Hope it isn't something malicious.

Thank you and regards.

[Maurice Naggar]

Here is one aspect of the situation. System errors:
=============
Error: (11/14/2023 05:15:28 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Microsoft Defender Antivirus Service service terminated with the following error: 
General access denied error

There is also another different issue. A rogue scheduled task that has a rogue 'updater' executable for Chrome.
 
I have below two ( 2) things for you to do.
 

Please run the following custom script. Read all of this before you start. The meaning of the "Fix button" operation here is just to run a custom script just for this particular machine.

NOTE-1:  This custom fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It clears the work area for MS Windows Update. It will attempt to get MS Defender updated.It will attempt to a Quick scan with Microsoft Defender antivirus. It will attempt to clear Cache files of web browsers.  It will attempt to clear temporary file areas. It rebuilds the Winsock. Depending on the speed of your computer this fix may take 50-55 minutes or more.

Please Close all open work before you actually do begin this run.

FRSTENGLISH,exe program location:   Downloads folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to Downloads

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

(  2   )

I need you to run 2 new reports. Temporarily disable Microsoft SmartScreen to download the next software below

( A ) 

Download   Farbar's Service Scanner utility

and Save to your Desktop.

Right-Click on fss.exe and select Run As Administrator.

Answer Yes to ok when prompted.

If your firewall then puts out a prompt, again, allow it to run.

Once FSS is on-screen, be sure the following items are check-marked:

• Internet Services
  Windows Firewall
  System Restore
  Security Center/Action Center
  Windows Update
  Windows Defender
  Other services

  

Click on "Scan".

It will create a log (FSS.txt) in the same directory the tool is run.   Please attach that file.  

( B ) 

I would recommend getting a readout report as to update status of some key apps.
Download SecurityCheck by glax24 from here

and save the tool on the desktop.

                   If Windows's  SmartScreen block that with a message-window, then
                         Click on the MORE INFO spot and over-ride that and allow it to proceed.

                             This tool is safe.   Smartscreen is overly sensitive.

Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

When all done, you may go back to turn ON the EDGE Smartscreen protection.

Edited November 14, 2023 by Maurice Naggar

[coolingwater]

Thanks you for taking your time out to assist me @Maurice Naggar

I have attached the logs as requested.

You mentioned that there is a "A rogue scheduled task that has a rogue 'updater' executable for Chrome."

Is this due to malware?

Cheers.

Fixlog.txt FSS.txt SecurityCheck.txt

[Maurice Naggar]

The custom-fix run is good. It removed 1 rogue updater.exe & removed the scheduled task that was related to it. Please look on your Desktop for a file 14.11.2023_21.00.02.zip. Kindly attach it on a new reply.

I would like you to do a visual look on Microsoft Defender. 

From the Windows Start menu,
Go to Settings > Update and Security > Virus & threat protection.

Under Virus & threat protection settings select Manage settings. Once there, can you get me a screenshot.

With that window in the foreground, press & hold ALT key on keyboard and tap PRTSCRN  ( printscreen)

Launch MSPAINT. Paste the image there. Name and Save the image file. Attach image file next reply.

 

Please do the following actions, so that Microsoft Defender antivirus runs side-by-side along with Malwarebytes.
Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

Close Malwarebytes.

>

I would highly suggest to insure that this pc is all up-to-date with security updates & cumulative updates on Windows. select the Windows Start  button, and then go to Settings  > Update & Security  > Windows Update . and click Check for Updates.
Have much patience.

 

[coolingwater]

I've attached a screenshot as you requested, hopefully this is correct (Untitled.png). 

Also attached is the zip file you requested.

Finally I also made sure ""Always register Malwarebytes in the Windows Security Center" is set to off.

I tried updating windows update, I am still getting the same error as before (Install error - 0x80070643).

14.11.2023_21.00.02.zip

[coolingwater]

Sorry for double posting but due to the install error on windows update, i am unable to check for updates.

[coolingwater]

This is the error shown when i tried to directly update via Windows Security.

[Maurice Naggar]

Your Windows 11 system is -missing- the Windows SENSE service ( a critical auxiliary service for MS Defender antivirus). Please run the following custom script. Read all of this before you start. The meaning of the "Fix button" operation here is just to run a custom script just for this particular machine.

This should run fairly quickly.

Please Close all open work before you actually do begin this run.

FRSTENGLISH,exe program location:   Downloads folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to Downloads

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

>

I would highly suggest to insure that this pc is all up-to-date with security updates & cumulative updates on Windows. select the Windows Start  button, and then go to Settings  > Update & Security  > Windows Update . and click Check for Updates.
Have much patience.

[coolingwater]

Please find the attached fixlog as requested in your previous post.

Fixlog.txt

[Maurice Naggar]

Thank you. I am sending a new script, and we will run it in Safe mode.

Please Close all open work before you actually do begin this run.

Please download the attached fixlist.txt file and save it to Downloads

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Now, we want to get Windows into SAFE mode. You may begin to do this from the Windows-sign-in-screen. See   this Microsoft support how-to-article

FRSTENGLISH,exe program location:   Downloads folder. The tool is already on system. That is what we will use.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

[coolingwater]

Here is the fixlog as requested.

Thank you!

Fixlog.txt

[Maurice Naggar]

Thank you.

I would highly suggest to insure that this pc is all up-to-date with security updates & cumulative updates on Windows. select the Windows Start  button, and then go to Settings  > Update & Security  > Windows Update . and click Check for Updates.
Have much patience.

[coolingwater]

 I tried updating windows update again. The installation of "Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.401.587.0) - Current Channel (Broad)" stucked at 66% for a good minute but failed eventually. I guess this is an improvement from earlier which failed seconds into the installation process.

[Maurice Naggar]

Please do this.

===================================================

SFCFix Scan

--------------------

• Download SFCFix and save it to your Desktop
• Right click on the icon and select Run as administrator
• When prompted Press any key to continue . . . 3 times
• Allow the process to complete, which can take as long as 15 minutes
• When completed press Enter and a report will appear on your Desktop
• Please attach SFCFIX.txt

Edited November 14, 2023 by AdvancedSetup
Corrected font issue

[coolingwater]

Here is the file as requested. Thank you

SFCFix.txt

[Maurice Naggar]

Thank you for the report from SFCFix. Thank you for your patience. What follows is a very special run to do some inquiries, plus also try to help and alleviate the issue of failing updates of Windows Update \Intelligence definitions updates. ( hopefully ) 😄

Please Close all open work before you actually do begin this run.

Please download the attached fixlist.txt file and save it to Downloads

Fixlist.txt <- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

FRSTENGLISH,exe program location:   Downloads folder. The tool is already on system. That is what we will use.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Downloads folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply. ALSO, look on the folder "C:\Users\public" for a file named RUNLOG.txt. Attach that also. Thank you.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

[coolingwater]

Hello, thank you for patience with assisting me with this problem. Sorry for taking up your time. Please find the requested file attached.

Fixlog.txt runlog.txt

[Maurice Naggar]

Thank you for the reports. Alas, the Microsoft Defender antivirus is not currently actively "running", Plus it still appears as if the Windows service "SENSE" is missing / a.w.o.l.

Tell me please, did this Windows machine ever have a NON-Microsoft antivirus at any recent time ?  anything like McAfee, Norton Symantec Lifelock, AVG, Avast, BitDefender, Avira, or some other brand ??

[coolingwater]

No, I only ever had Malwarebytes on this computer running along side Windows. This sounds like a more serious issue. Do you think I should reinstall windows?

[Maurice Naggar]

Only IF you reach the end of possible smaller scale potential fixes. Which we have not yet reached. and before that, a windows-repair-IN-Place is a potential future option. ( as to Malwarebytes, please know that it is not a typical 'antivirus'.)

I would like you to do what follows.

Please do the following actions, so that Microsoft Defender antivirus runs side-by-side along with Malwarebytes.
Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

Close Malwarebytes.

>

Now we go about a new way to get the Microsoft Sense service for this Windows 11 Home Version 23H2

Save this zip file to the Downloads folder ( or else, the Desktop). Just be sure to Save it to folder.

sense.zip    <<<<< - - - -

Once saved, Extract the content, which will be Sense.reg

Go to that location using File Explorer. Do a right-click on Sense.reg amd select 

MERGE

and allow it to proceed. There should be a confirmation at completion of merge. Then Restart Windows. wait for it to settle back. Then check on Windows Settings >> Virus and Threat protection.

[coolingwater]

Thank you for the response. I have done as requested, there's some improvement as I am able to enter the virus and threat protection window (see attached), issue is i cant click on scan. It does nothing. I also tried updating by clicking "Protection Update" but received an error code 800106ba (The programs service has stopped).

I check regedit and searched for "Sense" in Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense, the service seems to started, i think. Please refer to second screenshot.