newly restored system, WU says service not running

[paleolith]

I did a Factory Restore on my sister's Toshiba Satellite C655-S5049 laptop due to presumed malware, or damage from malware, that I was unable to repair after many tries. She had not made recovery media, so I recovered from the recovery partition on the internal HD.

Of possible importance, though I'm not sure where, is that the internal HD was replaced about a year ago. There were regular "not genuine Windows" for a long time, but it was never clear to me whether these started with the HD replacement or were due to malware. (The running Windows is certainly what came with the computer, which she bought new at Best Buy.)

(Does any malware infect the recovery partition? I hope not, but it's protected only by software.)

The first bad sign was that Windows claimed the driver for the WiFi adapter was improperly signed. It still made that claim after uninstalling and reinstalling -- but then Windows accepted it.

Or maybe that was the second bad sign. I'm frequently getting messages "do you want to allow such-and-such program signed by Unknown to run". That's random programs like the Windows Installer.

Well, this reinstall came from a recovery partition created in 2010 (when she bought the computer). Obviously it's critical to load the Windows updates. I got the infamous "Windows Update cannot currently check for updates, because the service is not running. You may need to restart your computer".

Search. Do the "rename c:\windows\softwaredistribution" thing (including disabling and enabling the Win Update service), reboot a few times, no help.

I downloaded SURT and tried to run it but could not even install it: "Installer encountered an error:0xc8000247".

I was reluctant to let sfc do updates on a freshly installed system without further input, so I did sfc /verifyonly. The forum extraction instructions obviously missed critical data (the run said it found integrity violations, the extracted data did not), so I manually extracted all records during the time period of the sfc run. That's the file I've attached.

I did the oft-requested net start commands; results below.

What next?

Edward

C:\windows\system32>net start bfe
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


C:\windows\system32>net start bits
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


C:\windows\system32>net start wuauserv
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


C:\windows\system32>net start trustedinstaller
The Windows Modules Installer service is starting.
The Windows Modules Installer service was started successfully.


C:\windows\system32>

 

[NoelDP]

Let's have a closer look or two...
You mention non-genuine notifications...

Please follow this tutorial and post an MGADiag report - then we can see what the problem is.

http://www.sevenforums.com/windows-updates-activation/234159-windows-genuine-activation-issue-posting-instructions.html

Ignore errors produced when clicking on the Copy button - they simply mean that the tool could not create the backup files for some reason. The data is still copied to the clipboard for pasting to your response.

Please also state the Version and Edition of Windows quoted on your COA sticker (if you have one) on the case of your machine (or inside the battery compartment), but do NOT quote the Key on the sticker!
http://www.microsoft.com/en-us/howtotell/Hardware.aspx


As far as windows Update is concerned...

Please download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

ALSO

Please follow the Windows Update Posting Instructions and post the requested data
If the file is too large (8MB compressed), remove the older CBSPersist cab files until the final file is below the limit - you can always post them separately after zipping them. (the forum doesn't allow the upload of bare CAB files, for a number of reasons)