Windows 7 Update "Service is NOT running, Restart system"

[Darkkeep]

I've restarted the system several times. I get the same issue.

I ran these at elevated:

NET START BFE
NET START BITS
NET START WUAUSERV
NET START TRUSTEDINSTALLER

C:\windows\system32>NET START BFE
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

C:\windows\system32>NET START BITS
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

C:\windows\system32>NET START WUAUSERV
System error 1058 has occured.

The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

C:\windows\system32>NET START TRUSTEDINSTALLER
The Windows Modules Installer service is starting.
The Windows Modules Installer service was started successfully.

Any help with this is GREATLY appreciated

 

[NoelDP]

Please download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

 

[Darkkeep]

Sorry it's taken a while to repost...work and life. Got busy...

Windows Defender is disabled because I have MalwareBytes installed

Farbar Service Scanner Version: 17-01-2015
Ran by Rachael (administrator) on 17-04-2015 at 14:15:21
Running from "C:\Users\Rachael\Downloads"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============

wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is set to Disabled. The default start type is Auto.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Disabled. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

RpcSs Service is not running. Checking service configuration:
The start type of RpcSs service is OK.
The ImagePath of RpcSs service is OK.


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

 

[NoelDP]

OUCH!
To be honest, I'm surprised the machine is running at all...

RpcSs Service is not running.

I was under the vague impression that RPCSS was one of the few really essential services.

Why is the Firewall disabled?

wscsvc Service is not running....
The start type of wscsvc service is set to Disabled.

I think we need to try and see what's breaking RPCSS

The usual cause is a 'bad' registry key

Please open an Elevated Command Prompt, and run the following commands

REG QUERY HKLM\SYSTEM\[B]CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum\ROOT\LEGACY_RPCSS[/B]
REG QUERY HKLM\SYSTEM\CurrentControlSet\services\RpcSs
DIR C:\Windows\System32\rpcss.dll /s
ICACLS C:\Windows\System32\rpcss.dll

Post the results.

Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[Darkkeep]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Rachael>REG QUERY HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Curre
nt\System\CurrentControlSet\Enum\ROOT\LEGACY_RPCSS
ERROR: Invalid syntax.
Type "REG QUERY /?" for usage.

C:\Users\Rachael>REG QUERY HKLM\SYSTEM\CurrentControlSet\services\RpcSs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcSs
    DisplayName    REG_SZ    @oleres.dll,-5010
    Group    REG_SZ    COM Infrastructure
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k rpcss
    Description    REG_SZ    @oleres.dll,-5011
    ObjectName    REG_SZ    NT AUTHORITY\NetworkService
    ErrorControl    REG_DWORD    0x1
    Start    REG_DWORD    0x2
    Type    REG_DWORD    0x20
    DependOnService    REG_MULTI_SZ    RpcEptMapper\0DcomLaunch
    FailureActions    REG_BINARY    00000000000000000000000001000000000000000200
000060EA0000
    RequiredPrivileges    REG_MULTI_SZ    SeChangeNotifyPrivilege\0SeCreateGloba
lPrivilege\0SeImpersonatePrivilege
    ServiceSidType    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcSs\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcSs\Security

C:\Users\Rachael>DIR C:\Windows\System32\rpcss.dll /s
 Volume in drive C is TI105984W0B
 Volume Serial Number is 5026-2A6C

 Directory of C:\Windows\System32

11/20/2010  08:27 AM           512,000 rpcss.dll
               1 File(s)        512,000 bytes

     Total Files Listed:
               1 File(s)        512,000 bytes
               0 Dir(s)  219,379,412,992 bytes free

C:\Users\Rachael>ICACLS C:\Windows\System32\rpcss.dll
C:\Windows\System32\rpcss.dll NT SERVICE\TrustedInstaller:(F)
                              BUILTIN\Administrators:(RX)
                              NT AUTHORITY\SYSTEM:(RX)
                              BUILTIN\Users:(RX)

Successfully processed 1 files; Failed processing 0 files

 

[NoelDP]

Bother - I messed up the first command.

Please run this one instead..

REG QUERY "HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum\ROOT\LEGACY_RPCSS"
  
 .

 

[Layback Bear]

A little information. (wscsvc Service) It sure does interact with many things.

https://technet.microsoft.com/en-us/library/cc787851%28v=ws.10%29.aspx

I'm back to lurking.

 

[Darkkeep]

I'm suspecting that this laptop was infected with a nasty virus. Malware found 20 critical processes, keyloggers, tojans. That would make sense why so many services were disabled. I'll run the registry query and check in a minute...replying from my phone. I also found, believe it or not, something on micros website that fixed the update issue. I'll edit this comment and post the link. Granted the update issue is fixed, I'm certain the services issue is not.

This was the program I used:

https://support.microsoft.com/en-us/gp/windows-update-issues/en-us

Here's the query command:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\windows\system32>REG QUERY "HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\C
urrent\System\CurrentControlSet\Enum\ROOT\LEGACY_RPCSS"
ERROR: The system was unable to find the specified registry key or value.

I doubled checked the registry with regedit...ROOT doesn't exist. Should this exist in all windows 7 installations or only Pro and Ultimate?

 

[NoelDP]

the ROOT subkey should be present in all Windows versions - -from NT to Win10 Pro ...
The problem is that the key doesn't exist in the same place for all versions, and the one I posted was for XP

Try this one instead...

REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RPCSS"

That one should in theory come back with an error anyhow - so don't worry if that's the case.
If it comes back with anything else, then we need to see the results.

 

[Darkkeep]

It came back with an error, unable to find specified key or value