sfc/scannow => wups2.dll = 0byte??

[gigaimage]

It all started with Windows Script Explorer for Powershell installer failing to install. Online forum suggestion was to ensuring all hot fix are in place. Well that lead to another issue finding that my windows update haven't ran for two months. I have been trying to fix windows auto update for few weeks on my Win7 Home Premium SP1 notebook but no success.

I have tried all 12 methods (Unable to install updates in Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2). First 11 didn't work (#2 fails too).

sfc /scannow (method #12) results in cbs.log shows the following findings. Well, that dll in %windir%\system32 is of 0 byte. It seems like a clear case of malware attack (through Hijackthis extra tool, which could not find the dll, but it exists if look up in explorer). So follow up efforts were running 3 anti-virus and two malware removal ( and no... Windows-KB890830-V4.14 installation errors out with non compatible OS, which is not correct, but at this point I don't want sideline distraction so moved on with other malware removal tool). In short none of them found any issue.

So now,
I would like to try out a replacement wups2.dll, but the issue is I can't delete this 0 byte wups2.dll. Neither I as an admin can set full control on this file, only trustedinstaller service could have full control.


Can I get some help?
Thanks!
ND

012-12-06 22:49:50, Info CSI 000002ee [SR] Cannot repair member file [l:18{9}]"wups2.dll" of Microsoft-Windows-WindowsUpdateClient-Core, Version = 7.6.7600.256, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-12-06 22:49:50, Info CSI 000002f0 [SR] Cannot repair member file [l:18{9}]"wups2.dll" of Microsoft-Windows-WindowsUpdateClient-Core, Version = 7.6.7600.256, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2012-12-06 22:49:50, Info CSI 000002f1 [SR] This component was referenced by [l:150{75}]"WUClient-SelfUpdate-Core-CoreComp~31bf3856ad364e35~amd64~~7.6.7600.256.Core"
2012-12-06 22:49:51, Info CSI 000002f4 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\windows\System32"\[l:18{9}]"wups2.dll"; source file in store is also corrupted
2012-12-06 22:49:51, Info CSI 000002f6 [SR] Repair complete
2012-12-06 22:49:51, Info CSI 000002f7 [SR] Committing transaction
2012-12-06 22:49:51, Info CSI 000002fb [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction have been successfully repaired

 

[ICIT2LOL]

Hello and welcome giga Mate if you are sure it is malware what scanners have you used please.

On another tack it might be an idea to download the update readiness tool as I found that helped a while ago when I had update problems.

Download System Update Readiness Tool for Windows 7 for x64-based Systems (KB947821) [November 2012] from Official Microsoft Download Center

Oops some system specs would be real handy too my friend

 

[NoelDP]

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Method 2)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and attach it to your reply

 

[gigaimage]

Thanks ICit and Noel,

I have already tried installing System Readiness Tool (or checkSUR) several times. I can't even get it to installed. Installation fails with Error.

As for the maleware tools I have tried malwarebytes and kaspersky. For AV I have scanned entire notbook using AVG (trial), Calmwin, Norton (trial).

For system specs, please tell me what else would you like to know. My notebook is Windows 7 SP1 Home Premium, pre-loaded came with the notebook, I didn't get any system restore on media.

There is no other method out there other than these 12, that could possibly fix this WU issue? Only option I see is to replacing a real (non zero byte) wups2.dll and after that try out all 12 methods and see if I can get windows update back to working.

 

[NoelDP]

Please post the full CBS.log file - there must be more going on here than this relatively minor error.

Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

CHKDSK C: /R

and hit the Enter key.
You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, and then reboot.

The CHKDSK will take a few hours depending on the size of the drive, so be patient!

After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -

Then look in Event Viewer Widnwos Logs\Application for teh Wininit event recording the CHKDSK result, and copy/paste it into your reply.