Solved Windows 7 Ultimate N 32-bit Update service not running.

[Nymphonomicon]

Windows Update stopped functioning a few months back. Prior to that, I was having problems with a certain security update that Window Update insisted was important, but the update always failed to install.

I ran SURT, it tried to install Hot Fix for Windows (kb947821) and failed. I am currently running it a second time as I write this post, but it has been running for roughly half an hour with no result.
SFC Scan was cancelled at 49% by Windows Resource Protection.

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc0000022
Windows Product Key: *****-*****-2P8CD-9FVB9-D4HJ9
Windows Product Key Hash: qmND3ISYRsZQSuWpNWAI4ycZ52I=
Windows Product ID: 00432-077-0072291-86057
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.028
ID: {B6F28625-ABA0-4118-9C7E-ADA67DA8417C}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate N
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.130104-1431
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office  Diagnostics:  025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office  Details:  <GenuineResults><MachineData><UGUID>{B6F28625-ABA0-4118-9C7E-ADA67DA8417C}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.028</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-D4HJ9</PKey><PID>00432-077-0072291-86057</PID><PIDType>5</PIDType><SID>S-1-5-21-292295029-4026666195-3804644012</SID><SYSTEM><Manufacturer>Gigabyte  Technology Co., Ltd.</Manufacturer><Model>To be filled by  O.E.M.</Model></SYSTEM><BIOS><Manufacturer>American  Megatrends  Inc.</Manufacturer><Version>F2</Version><SMBIOSVersion  major="2"  minor="7"/><Date>20120309000000.000000+000</Date></BIOS><HWID>31C23807018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern  Standard  Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>   

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
Error: 0x80070426 

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0001000000000000
Event Time Stamp: 5:18:2013 23:19
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppsvc


HWID Data-->
HWID Hash Current: MAAAAAEABAABAAEAAAABAAAAAQABAAEA6GEQSf4LFlKUlnS4YBqKq4R39AFey5Zj

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            ALASKA        A M I
  FACP            ALASKA        A M I
  HPET            ALASKA        A M I
  MCFG            ALASKA        A M I
  SSDT            IdeRef        IdeTable
  SSDT            IdeRef        IdeTable
  SSDT            IdeRef        IdeTable
  BGRT            ALASKA        A M I

Code c0000022

 

[Golden]

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0001000000000000
Event Time Stamp: 5:18:2013 23:19
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
[B]Tampered Service: sppsvc[/B]

Usually, an sfc /scannow is able to fix this issue, but I see you have tried that and it won't complete. Another possibility is a malware infection.

On a known clean computer, create a bootable version of Windows Defender Offline (WDO), then on this problem computer boot from the DVD/USB on which you created WDO, and then scan the system using it.

http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

 

[Nymphonomicon]

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0001000000000000
Event Time Stamp: 5:18:2013 23:19
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
[B]Tampered Service: sppsvc[/B]

Usually, an sfc /scannow is able to fix this issue, but I see you have tried that and it won't complete. Another possibility is a malware infection.

On a known clean computer, create a bootable version of Windows Defender Offline (WDO), then on this problem computer boot from the DVD/USB on which you created WDO, and then scan the system using it.

http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

Would I be able to use a laptop to create the bootable WDO?

 

[Golden]

Yes, no problem.

 

[VistaKing]

Nymphonomicon

Download the tool below

Farbar Service Scanner

Click here :ar: Farbar Service Scanner to DOWNLOAD

Place file into your desktop

Place a check mark next to the following options

• Internet Services
• Windows Firewall
• System Restore
• Security Center
• Windows Update
• Windows Defender

Press the Scan button

Farbar Service Scanner will create a log, called FSS.txt, on the Desktop. Upload the FSS.txt with your reply

How to Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

 

[Nymphonomicon]

Nymphonomicon

Download the tool below

Farbar Service Scanner

Click here :ar: Farbar Service Scanner to DOWNLOAD

Place file into your desktop

Place a check mark next to the following options

• Internet Services
• Windows Firewall
• System Restore
• Security Center
• Windows Update
• Windows Defender

Press the Scan button

Farbar Service Scanner will create a log, called FSS.txt, on the Desktop. Upload the FSS.txt with your reply

How to Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

How's this?
(I tried attaching my CBS.zip with the first post, but I don't think it attached properly.)

 

[VistaKing]

Not seeing any issues with Windows Update .

Run this tool

Run Farbar Recovery Scan Tool

32-bit Version OS Farbar Recovery Scan Tool <==== Download Link

Drag the FRST.exe from the Downloads folder to your Desktop

Right click on FRST.exe and choose

When the tool opens click Yes on the disclaimer window .
Press Scan button.


Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

 

[Nymphonomicon]

SURT's second attempt to install Hot Fix for Windows (kb947821) succeeded. Afterwards, I tried to run Windows Update and got this error code: 80080005

 

[VistaKing]

Open Notepad .

Inside Notepad . Paste the highlighted text below


start
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe
C:\Users\Jarrid\AppData\Local\Akamai\netsession_win.exe
HKLM\...\Run: [] - [x]
HKLM\...\Run: [SearchSettings] - "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe" [1302336 2013-06-07]
HKCU\...\Run: [Akamai NetSession Interface] - "C:\Users\Jarrid\AppData\Local\Akamai\netsession_win.exe" [4480768 2013-01-26] (Akamai Technologies, Inc.)
C:\ProgramData\Start Menu\Programs\Startup\Run Registration Tool.lnk
Toolbar: HKLM - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
R2 Application Updater; C:\Program Files\Application Updater\ApplicationUpdater.exe [806776 2013-06-07] (Spigot, Inc.)
C:\Windows\system32\Drivers\kmxzone.u2k7
C:\Windows\system32\Drivers\kmxzone.u2k6
C:\Windows\system32\Drivers\kmxzone.u2k5
C:\Windows\system32\Drivers\kmxzone.u2k4
C:\Windows\system32\Drivers\kmxzone.u2k3
C:\Windows\system32\Drivers\kmxzone.u2k2
C:\Windows\system32\Drivers\kmxzone.u2k1
C:\Windows\system32\Drivers\kmxzone.u2k0
C:\Windows\system32\Drivers\kmxcfg.u2k0
C:\Windows\system32\Drivers\kmxcfg.u2k7
C:\Windows\system32\Drivers\kmxcfg.u2k6
C:\Windows\system32\Drivers\kmxcfg.u2k5
C:\Windows\system32\Drivers\kmxcfg.u2k4
C:\Windows\system32\Drivers\kmxcfg.u2k3
C:\Windows\system32\Drivers\kmxcfg.u2k2
C:\Windows\system32\Drivers\kmxcfg.u2k1
C:\Windows\system32\Drivers\KmxAgent.asc
C:\Program Files\Common Files\Spigot
C:\ProgramData\hash.dat
end


Click File ==> Save As

File Name : Fixlist.txt
Save as type : All Types
Location of file to be saved to : Desktop

Click Save button

Open FRST.exe again and click on the [FIX] button. Once completed it will create a new log called FIXLOG.txt . Upload Fixlog.txt with your reply . Once that is done run the next tool

AdwCleaner

Click here AdwCleaner

:ar: Click on Download Now button

:ar: Save to the Desktop

:ar: Right-click on AdwCleaner.exe and choose

:ar: Click on Delete and confirm the prompt.

:ar: Your computer will be rebooted automatically. A text file will open after the restart.

Upload the log : The log file is at C:\AdwCleaner[Sn].txt


RogueKiller for 32bit <==== Download Link

RogueKiller for 64bit <==== Download Link

:ar: Click on one of the links above that goes with your Windows 7 bit versions

:ar: Save to the Desktop.

:ar: Close all windows and browsers

:ar: Right click on

and choose

:ar: Press: SCAN

:ar: provide the RKreport.txt (Mode: Scan) in your reply.

 

[Nymphonomicon]

Open Notepad .

Inside Notepad . Paste the highlighted text below


start
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe
C:\Users\Jarrid\AppData\Local\Akamai\netsession_win.exe
HKLM\...\Run: [] - [x]
HKLM\...\Run: [SearchSettings] - "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe" [1302336 2013-06-07]
HKCU\...\Run: [Akamai NetSession Interface] - "C:\Users\Jarrid\AppData\Local\Akamai\netsession_win.exe" [4480768 2013-01-26] (Akamai Technologies, Inc.)
C:\ProgramData\Start Menu\Programs\Startup\Run Registration Tool.lnk
Toolbar: HKLM - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
R2 Application Updater; C:\Program Files\Application Updater\ApplicationUpdater.exe [806776 2013-06-07] (Spigot, Inc.)
C:\Windows\system32\Drivers\kmxzone.u2k7
C:\Windows\system32\Drivers\kmxzone.u2k6
C:\Windows\system32\Drivers\kmxzone.u2k5
C:\Windows\system32\Drivers\kmxzone.u2k4
C:\Windows\system32\Drivers\kmxzone.u2k3
C:\Windows\system32\Drivers\kmxzone.u2k2
C:\Windows\system32\Drivers\kmxzone.u2k1
C:\Windows\system32\Drivers\kmxzone.u2k0
C:\Windows\system32\Drivers\kmxcfg.u2k0
C:\Windows\system32\Drivers\kmxcfg.u2k7
C:\Windows\system32\Drivers\kmxcfg.u2k6
C:\Windows\system32\Drivers\kmxcfg.u2k5
C:\Windows\system32\Drivers\kmxcfg.u2k4
C:\Windows\system32\Drivers\kmxcfg.u2k3
C:\Windows\system32\Drivers\kmxcfg.u2k2
C:\Windows\system32\Drivers\kmxcfg.u2k1
C:\Windows\system32\Drivers\KmxAgent.asc
C:\Program Files\Common Files\Spigot
C:\ProgramData\hash.dat
end


Click File ==> Save As

File Name : Fixlist.txt
Save as type : All Types
Location of file to be saved to : Desktop

Click Save button

Open FRST.exe again and click on the [FIX] button. Once completed it will create a new log called FIXLOG.txt . Upload Fixlog.txt with your reply . Once that is done run the next tool

Uploading Fixlog. I'll do the second part after this post.

 

[Nymphonomicon]

RogueKiller for 32bit <==== Download Link

RogueKiller for 64bit <==== Download Link

:ar: Click on one of the links above that goes with your Windows 7 bit versions

:ar: Save to the Desktop.

:ar: Close all windows and browsers

:ar: Right click on

and choose

:ar: Press: SCAN

:ar: provide the RKreport.txt (Mode: Scan) in your reply.

Here you go. Looks like Roguekiller found two suspicious registry keys that it wants me to delete.

 

[VistaKing]

The registry keys found belong to your desktop icons

{20D04FE0-3AEA-1069-A2D8-08002B30309D} - Computer

{59031a47-3f72-44a7-89c5-5595fe6b30ee} - Users

Run RK again choose Delete button .

After you run AdwCleaner run ESET online scanner

:ar: On

Hold down Control and click on ESET Online Scanner to open ESET OnlineScan in a new window
Click the

button
Check YES, I accept the Terms of Use.
Click the Start button.
Accept any security warnings from your browser.
Under scan settings, check "Scan Archives" and "Remove found threats"
Click Advanced settings and select the following:
° Scan potentially unwanted applications
° Scan for potentially unsafe applications
° Enable Anti-Stealth technology
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats
Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.

:ar: On

or

Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
Right click on

choose

on your desktop
Check YES, I accept the Terms of Use.
Click the Start button.
Accept any security warnings from your browser.
Under scan settings, check "Scan Archives" and "Remove found threats"
Click Advanced settings and select the following:
° Scan potentially unwanted applications
° Scan for potentially unsafe applications
° Enable Anti-Stealth technology
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats
Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.

 

[Nymphonomicon]

ESET is taking a rather long time and I think I forgot to click the Advanced settings so I'll have to start over after it finishes.
In the meantime, it seems some functionality has been restored to Windows Update. It used to only give me the "service not running" message, but now it actually searches for updates. Those searches always end in an error, but any progress is better than none.

 

[VistaKing]

Lets see what the ESET results are . If you get a chance run AdwCleaner after the ESET scan

 

[Nymphonomicon]

ESET finally finished.

 

[VistaKing]

Did you run AdwCleaner ?


Download Junkware Removal Tool Junkware Removal Tool Download

Drag the JRT.exe from the Downloads folder to your Desktop

Right click JRT.exe and choose

Once done upload the JRT.txt file

 

[Nymphonomicon]

I'm going to bed. Thank you for all the help so far.
We can continue tomorrow.

 

[Nymphonomicon]

I'm having a little trouble with JRT. When I try to move it to Desktop, I get a "Moving" progress bar, but it doesn't seem to actually be doing anything.
I ran Adwcleaner last night, but I missed the part about posting the txt. Here it is.

 

[VistaKing]

Try running JRT from the Downloads folder . Is the service running ?

 

[Nymphonomicon]

I think Windows Update might be functioning now, though I'm not sure if it's running properly or not. I got a message stating that it has scheduled itself to install some updates.

I got JRT to move to Desktop and ran it, here's the TXT.