Wuauserv and BITS missing - re-install without OS reboot?

Gromit1710

Gamer / IT dude
Pro User
Local time
8:49 PM
Messages
162
Location
Arizona, USA
Hey everyone!

So.. I've got a machine on one of my networks that was victim to a nasty virus a few months back. I cleaned it and verified that it was healthy again and sent it on it's way.

Yesterday, our IP was blacklisted for spam suddenly. After checking the logs from the mail service and firewall.... the same little machine showed up as the culprit.

I pulled it into the shop and cleaned it again (different virus/trojan this time.. both times due to the user disabling the network AV) and decided to make sure this lil' guy was all up to date.

Windows update services are missing. Not only are they missing from Services.msc but also the associated files are missing. Wuauserv and BITS

I've read around and have seen people with similar problems of windows update not working. Not many have drilled down into these files being missing or described a fix for the problem.

Ordinarily, I'd just wipe the disk and re-install the OS but this particular machine has a few software applications for the company that are... um.. troublesome to re-install due to the manufacturer being a PITA about licensing and usage records. (It's all legitimate and paid for, they just register the CPU once on their servers and then tell you to go buy another copy if something happens to that machine)

I'd like to avoid a wipe/re-install if at all possible.

I've tried:

MS fixit for restarting Windows Update
Turning off automatic updates and then turning them back on again
CAT.exe tool (crisis aversion tool)

The usage of all those is what drilled me down to the fact that the files were missing out of system32 and not showing up in the services store.
 

My Computer My Computer

At a glance

Windows 7 Professional 64 Bit Service Pack 1Intel i7-2600K OC to 3.8GhzCorsair Vengence 16GB (X4 4GB)X2 EVGA GTX570 SLI
Computer Manufacturer/Model Number
Custom Build
OS
Windows 7 Professional 64 Bit Service Pack 1
CPU
Intel i7-2600K OC to 3.8Ghz
Motherboard
Asus TUF Sabertooth P67
Memory
Corsair Vengence 16GB (X4 4GB)
Graphics Card(s)
X2 EVGA GTX570 SLI
Sound Card
Creative Soundblaster X-FI TI
Monitor(s) Displays
Dual HP 2311 LED Displays
Screen Resolution
1920X1080 single / 3840X1080 desktop
Hard Drives
Crucial Force 3 SSD 120GB 6Gb/s ( OS Drive )
WD Caviar Black 2 TB 6 Gb/s (Data drive)
PSU
Kingwin Mach 1 1000w Modular 80+ Bronze
Case
AZZA solano 1000
Cooling
Zalmen 700 LED CPU, X2 240mm case fans , X3 120mm case fans
Keyboard
Razer Black Widow Mechanical
Mouse
Razer Mamba
Internet Speed
26.7 mb/s Down / 7.39 Up

My Computers My Computers

  • At a glance

    7 X64i5 84002x8gb 3200mhz
    Computer type
    PC/Desktop
    OS
    7 X64
    CPU
    i5 8400
    Motherboard
    gigabyte b365m ds3h
    Memory
    2x8gb 3200mhz
    Hard Drives
    various
    PSU
    pure power 11 400w cm
    Case
    Coolermaster
    Cooling
    cryorig m9i
  • At a glance

    7x64g54008gb ddr4 2400
    Computer type
    PC/Desktop
    OS
    7x64
    CPU
    g5400
    Motherboard
    ga b365m ds3h
    Memory
    8gb ddr4 2400
    PSU
    xfx pro 450w

My Computer My Computer

At a glance

Windows 7 Professional 64 Bit Service Pack 1Intel i7-2600K OC to 3.8GhzCorsair Vengence 16GB (X4 4GB)X2 EVGA GTX570 SLI
Computer Manufacturer/Model Number
Custom Build
OS
Windows 7 Professional 64 Bit Service Pack 1
CPU
Intel i7-2600K OC to 3.8Ghz
Motherboard
Asus TUF Sabertooth P67
Memory
Corsair Vengence 16GB (X4 4GB)
Graphics Card(s)
X2 EVGA GTX570 SLI
Sound Card
Creative Soundblaster X-FI TI
Monitor(s) Displays
Dual HP 2311 LED Displays
Screen Resolution
1920X1080 single / 3840X1080 desktop
Hard Drives
Crucial Force 3 SSD 120GB 6Gb/s ( OS Drive )
WD Caviar Black 2 TB 6 Gb/s (Data drive)
PSU
Kingwin Mach 1 1000w Modular 80+ Bronze
Case
AZZA solano 1000
Cooling
Zalmen 700 LED CPU, X2 240mm case fans , X3 120mm case fans
Keyboard
Razer Black Widow Mechanical
Mouse
Razer Mamba
Internet Speed
26.7 mb/s Down / 7.39 Up
Silly question - but why has the user got sufficient rights to disable the AV in the first place?
(not to mention, why are they still working there?)
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Silly question - but why has the user got sufficient rights to disable the AV in the first place?
(not to mention, why are they still working there?)
Haha.. I totally get that question.

Basically it boils down to the position within the company that they are in. . . If you catch my drift ;)

They are computer savvy enough to know what permission rights are, annoyed enough that they don't want to deal with AV, and in a position that I can't do much about it.

Except fix the machine...
 

My Computer My Computer

At a glance

Windows 7 Professional 64 Bit Service Pack 1Intel i7-2600K OC to 3.8GhzCorsair Vengence 16GB (X4 4GB)X2 EVGA GTX570 SLI
Computer Manufacturer/Model Number
Custom Build
OS
Windows 7 Professional 64 Bit Service Pack 1
CPU
Intel i7-2600K OC to 3.8Ghz
Motherboard
Asus TUF Sabertooth P67
Memory
Corsair Vengence 16GB (X4 4GB)
Graphics Card(s)
X2 EVGA GTX570 SLI
Sound Card
Creative Soundblaster X-FI TI
Monitor(s) Displays
Dual HP 2311 LED Displays
Screen Resolution
1920X1080 single / 3840X1080 desktop
Hard Drives
Crucial Force 3 SSD 120GB 6Gb/s ( OS Drive )
WD Caviar Black 2 TB 6 Gb/s (Data drive)
PSU
Kingwin Mach 1 1000w Modular 80+ Bronze
Case
AZZA solano 1000
Cooling
Zalmen 700 LED CPU, X2 240mm case fans , X3 120mm case fans
Keyboard
Razer Black Widow Mechanical
Mouse
Razer Mamba
Internet Speed
26.7 mb/s Down / 7.39 Up
Point out the costs involved to them - present them with a pro-forma invoice for the full cost every time you touch it, and include the time taken dealing with the spam-blocks
That usually grabs people's attention ;)
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Point out the costs involved to them - present them with a pro-forma invoice for the full cost every time you touch it, and include the time taken dealing with the spam-blocks
That usually grabs people's attention ;)
I hear ya. It's a big drama scene when I have to work on that computer in the first place.. Lots of grumbling and complaining that " That IT guy has my computer again and I can't get anything done!!" sorta stuff.

Not an enviable position to be in.. but that's the lot for us IT guys mostly anyways. .

"The only good IT guys are the IT guys no one knows exist" ~ Gromit1710
 

My Computer My Computer

At a glance

Windows 7 Professional 64 Bit Service Pack 1Intel i7-2600K OC to 3.8GhzCorsair Vengence 16GB (X4 4GB)X2 EVGA GTX570 SLI
Computer Manufacturer/Model Number
Custom Build
OS
Windows 7 Professional 64 Bit Service Pack 1
CPU
Intel i7-2600K OC to 3.8Ghz
Motherboard
Asus TUF Sabertooth P67
Memory
Corsair Vengence 16GB (X4 4GB)
Graphics Card(s)
X2 EVGA GTX570 SLI
Sound Card
Creative Soundblaster X-FI TI
Monitor(s) Displays
Dual HP 2311 LED Displays
Screen Resolution
1920X1080 single / 3840X1080 desktop
Hard Drives
Crucial Force 3 SSD 120GB 6Gb/s ( OS Drive )
WD Caviar Black 2 TB 6 Gb/s (Data drive)
PSU
Kingwin Mach 1 1000w Modular 80+ Bronze
Case
AZZA solano 1000
Cooling
Zalmen 700 LED CPU, X2 240mm case fans , X3 120mm case fans
Keyboard
Razer Black Widow Mechanical
Mouse
Razer Mamba
Internet Speed
26.7 mb/s Down / 7.39 Up
...so pin a copy of the invoice up on the company notice board, making sure it has EXACTLY why you had to take it away detailed :devil:
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Attach a copy of the invoice to that persons forehead gently.
 

My Computer My Computer

At a glance

Windows 10 Pro. 64/ version 1709 Windows 7 Pr...Intel i7-6800K @ 4.3Corsair Platinum 16 gig @2400EVGA GTX 1070 OC
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Home made Desktop
OS
Windows 10 Pro. 64/ version 1709 Windows 7 Pro/64
CPU
Intel i7-6800K @ 4.3
Motherboard
ASUS X-99 Deluxe II
Memory
Corsair Platinum 16 gig @2400
Graphics Card(s)
EVGA GTX 1070 OC
Monitor(s) Displays
Asus 27" LED LCD/VE278Q
Screen Resolution
1920-1080 or 1280-720 HDMI
Hard Drives
INTEL SSD 730-240 Gb Sata 3.0/
PSU
EVGA Platium 1200W
Case
Phanteks Luxe Tempered Glass 8 fans/ one radiator
Cooling
XSPC/ Water Cooled CPU
Keyboard
Das 4 Professional
Mouse
Logitech M705/MX Anywhere 2-S
Internet Speed
100 mbits
Antivirus
Microsoft Security Essentials/ Malwarebytes Premium 3.0/ SAS
Browser
I.E. 11 default/Firefox/ ISP Time Warner Cable/Spectrum
Other Info
LG BluRay Burner/
Sound system-KLipsch-THX/
Icy Dock ssd Hot Swap bays.
OK, I am not an IT person, and have no idea what you would know or not. So please don't laugh... :o

But you have run a System File Check?

The qmgr.dll is missing from your system?
 

My Computer My Computer

At a glance

Windows 7 x64i7-2600K8 GGTX 480
Computer Manufacturer/Model Number
Homebuilt
OS
Windows 7 x64
CPU
i7-2600K
Motherboard
Asus P8Z77-v Pro
Memory
8 G
Graphics Card(s)
GTX 480
Sound Card
Onboard
Monitor(s) Displays
LG W2753V
Screen Resolution
1920x1080
Hard Drives
Crucial M4 128 G SSD
Ok so Basically I have had the same problem as well.

There are a couple of options. If your system has Restore point back to before the virus hit your system, you can try that. However My solution was to reinsert the missing services back into the windows registry.

Yes, Running SFC /Scannow will fix the files issues, but with the registry entries your just spinning your wheels.

Here is the registry data that need to be reinserted into the registry:

Files are attached as well:

This is the Background Intelligent Transfer Service Entry for Windows 7 64bit SP1

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS]
"DisplayName"="@%SystemRoot%\\system32\\qmgr.dll,-1000"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"Description"="@%SystemRoot%\\system32\\qmgr.dll,-1001"
"ObjectName"="LocalSystem"
"ErrorControl"=dword:00000001
"Start"=dword:00000003
"DelayedAutoStart"=dword:00000001
"Type"=dword:00000020
"DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,45,00,76,00,65,00,\
6e,00,74,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,00,00
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,47,\
00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,\
67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,\
00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\
00,00,53,00,65,00,54,00,63,00,62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\
00,67,00,65,00,00,00,53,00,65,00,41,00,73,00,73,00,69,00,67,00,6e,00,50,00,\
72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,6e,00,\
63,00,72,00,65,00,61,00,73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,60,ea,00,00,01,00,00,00,c0,d4,01,00,00,00,00,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
71,00,6d,00,67,00,72,00,2e,00,64,00,6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS\Performance]
"Library"="bitsperf.dll"
"Open"="PerfMon_Open"
"Collect"="PerfMon_Collect"
"Close"="PerfMon_Close"
"InstallType"=dword:00000001
"PerfIniFile"="bitsctrs.ini"
"First Counter"=dword:0000086c
"Last Counter"=dword:0000087c
"First Help"=dword:0000086d
"Last Help"=dword:0000087d
"Object List"="2156"
"PerfMMFileName"="Global\\MMF_BITS_s"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS\Security]
"Security"=hex:01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,34,00,00,00,02,\
00,20,00,01,00,00,00,02,c0,18,00,00,00,0c,00,01,02,00,00,00,00,00,05,20,00,\
00,00,20,02,00,00,02,00,5c,00,04,00,00,00,00,02,14,00,ff,01,0f,00,01,01,00,\
00,00,00,00,05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,\
20,00,00,00,20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,\
00,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00

Here is the RPCSS Service that is usually also delete when attacked by this virus:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcSs]
"DisplayName"="@oleres.dll,-5010"
"Group"="COM Infrastructure"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,72,00,70,00,63,00,73,00,73,00,00,00
"Description"="@oleres.dll,-5011"
"ObjectName"="NT AUTHORITY\\NetworkService"
"ErrorControl"=dword:00000001
"Start"=dword:00000002
"Type"=dword:00000020
"DependOnService"=hex(7):52,00,70,00,63,00,45,00,70,00,74,00,4d,00,61,00,70,00,\
70,00,65,00,72,00,00,00,44,00,63,00,6f,00,6d,00,4c,00,61,00,75,00,6e,00,63,\
00,68,00,00,00,00,00
"FailureActions"=hex:00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,\
00,02,00,00,00,60,ea,00,00
"RequiredPrivileges"=hex(7):53,00,65,00,43,00,68,00,61,00,6e,00,67,00,65,00,4e,\
00,6f,00,74,00,69,00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,\
67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,47,00,6c,\
00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,\
65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,00,61,\
00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,\
00,00
"ServiceSidType"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcSs\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
72,00,70,00,63,00,73,00,73,00,2e,00,64,00,6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcSs\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,00,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,60,00,04,00,00,00,00,00,14,00,85,00,02,00,01,01,00,00,00,00,00,\
05,0b,00,00,00,00,00,14,00,ff,00,0e,00,01,01,00,00,00,00,00,05,12,00,00,00,\
00,00,18,00,fd,00,0e,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
00,18,00,85,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,21,02,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00


Im sure its a bit late but i thought i would post this so at least someone else may be able to use this information, I searched all over the internet and nobody was willing to investigate this repair.


SO here it IS!
 

My Computer My Computer

At a glance

Windows 7 32bit
OS
Windows 7 32bit
Back
Top