Solved computer has Lanman\Workstation on it

[Layback Bear]

Noel I have found this. Could this be part of the problem.

Thelma take no action on this information without Noels guidance first.

http://www.bleepingcomputer.com/startups/RpcSs.exe-14544.html

Name: Remote Procedure Call (RPC) Service Filename: RpcSs.exe Command: C:\Windows\System32\RpcSs.exe Description:
Added by the W32/Cuebot-J worm and IRC backdoor.
File Location: %System%

 

[NoelDP]

That looks like you're not using an Elevated (Administrator) command prompt - which means that the uninstall will fail for that reason...

To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.

@Bear - nice catch, but I'm not certain that it's relevant? I'll have to check it tomorrow as it's past my bedtime now.

 

[Layback Bear]

Happy dreams. Don't forget a night cap or two.

 

[thelma]

I am quite sure I did the elevated Command Prompt, but I can be wrong so I will now do it again, I know, you run it as administrator.

I'll do it now : You were right of coarse, now it was the usual

C:\windows 32 line.

Any way, the result was the same,

no stand alone installer kb 3004394 on this computer.

I still get this page popping up saying that Windows is not Genuien,

Will try to upload those update now .......

 

[thelma]

been trying to upload those updates several times yesterday morning, than I had to Leave.

Perhaps I should persist and keep trying ? It seams that many others have problems with Windows updates, looks almost as normal. But then I keep getting this stupid popup about Windows not being genuine ?

 

[thelma]

No way, cannot download those windows updates and Windows is not genuine welcomes me every time I start.

 

[NoelDP]

Looking back at the event logs, it's obvious that a number of services have been altered in terms of their startup behaviour.

I think (hope) that resetting them to the default may make things a little simpler...

*
I've uploaded a file - w7hpsvcs_def.zip - to my OneDrive at Noel's OneDrive
Please download and save it to your desktop.
Right-click on the saved file and select Extract all...
Save it to the default location
This should create a file w7hpsvcs_def.reg
*
*right-click on the file, and select Merge
Accept the warnings, - you should then get a 'Success' message.
Close all windows, and reboot.
*
Run another MGADiag report, and post the results.

 

[thelma]

Thanks Noel,

I did it and it was successful !

MGA Diag report:


Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
Windows Product ID: 00359-OEM-8992687-00095
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {6FAD2D6F-2136-44F5-9A25-6B681F664F0D}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150715-0600
TTS Error: T:20150518111512711-
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{6FAD2D6F-2136-44F5-9A25-6B681F664F0D}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-RMV82</PKey><PID>00359-OEM-8992687-00095</PID><PIDType>2</PIDType><SID>S-1-5-21-2693414740-4022384018-3331022292</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron M5010</Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A12</Version><SMBIOSVersion major="2" minor="6"/><Date>20110719000000.000000+000</Date></BIOS><HWID>AD693507018400F4</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Romance Standard Time(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL </OEMID><OEMTableID>WN09 </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: U1BMRwEAAAAAAQAACAAAAMY+AAAAAAAAYWECAAAAAABpnj0lS5HQAROJf9ybj7SsIEe8hMh9DOGvzGBAnzBHSBB7hVwHtXjT05LJ+konLW63FmLmJZVpSQcEhJLoLtXa7QLUDAXvDFMzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAx4dZsxs/sxaQSZh6DCEuBHzWZj0kmaRrqn7BfAT/muFqBVj3bCUyYhfOYNdn7PK8czkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800095-02-2057-7600.0000-1382015
Installation ID: 009746800964695216209912239346979442986532581920005374
Processor Certificate URL: SpcService Web Service
Machine Certificate URL: RacService Web Service
Use License URL: UseLicenseService Web Service
Product Key Certificate URL: PkcService Web Service
Partial Product Key: RMV82
License Status: Licensed
Remaining Windows rearm count: 5
Trusted time: 9/18/2015 9:39:21 AM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 9:18:2015 09:31
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: KgAAAAEAAQABAAEAAAACAAAAAAABAAEA6GF83dqbBMO+rqKF6kWetxh5

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC DELL WN09
FACP DELL WN09
HPET DELL WN09
MCFG DELL WN09
SLIC DELL WN09
SSDT AMD POWERNOW
OSFR DELL M08

 

[thelma]

I think that went OK ?

And I have just managed to download 6 updates again, only 4 to go .

When I shut down and restart ( after successfully downloaded ) during shut down it says " shutting down, downloading updates 30% " and than it stops and closes.

When it reboots again it says " preparing to download, do not turn off your computer " and then it went to 100% ".

 

[NoelDP]

GREAT!
The MGADiag report is now fine.

- now all I have to do is work out exactly which service was affected for any future sufferers!

Could you please upload your Application and Event logs for me?
C:\windows\System32\winevt\Applications.evtx
C:\windows\System32\winevt\System.evtx

You'll have to copy them to the desktop before zipping them for upload.

 

[thelma]

Noel, your are the GREATEST !

Thanks, so much for your time, thinking, effort and specially PATIENCE !!!!!!

You are a brilliant tutor on Seven forums and they can be proud of you'r input.

I hope my mistakes can help others through your guidance.

Fingers crossed I can do what you asked for, my dyslectic brain has been stretched to the limit here !!!

Fingers crossed;

Appevt - Shortcut

 

[NoelDP]

Nah - you used 'Send to Desktop' (create shortcut) rather than Copy and Paste - so all I got were shortcuts
Please try again.

 

[thelma]

and ;
View attachment System - Shortcut.zip

 

[thelma]

Hi Noel,

Are those last two what you asked for ?