Solved Windows could not check for updates automatically (Important) -V. Slow

[KennyT]

Hi,

I seem to be having some issues here which I believe are linked to a recent failure to run updates. There are two main issues.

1. I have the message in my Action centre - "Windows could not check for updates automatically (Important)" which is a red flag item.
2. My laptop is now so slow - as if something was completely consuming resources - that I cannot effectively run many of the solutions for self help.

Steps taken so far -

a) I`ve tried to run the system restore to the earliest point available - hasnt fixed it.
b) I`ve tried malware scanners - no result
c) I`ve run my Microsoft security essential basic scan - I dont have capacity to run a full scan at present
d) I tried samsung recovery centre software on my machine - it tried to run the updates x 2, the first was about 5 files which failed on each one, the send included about 52 files which all failed. they all had codes like 70012234 - not sure if these are windows update numbers?
e) Run scan disk, at start up and deleted any crap out my temp files etc.
f) Tried my windows recovery disk to reinstall windows 7 as an update - failed due to lack of resources
g) I found seven forums and now trying the follow as recommended -

1) DL'd SURT - run - didnt get past checking for installed update - I suspect due to lack of resources on my machine.
2) Run SFC/ Scan - got the following error - "Windows Resource Protection could not start the repairs service"
- I`ve tried to st\rt the windows module installer service but the following error came up - "error 126 - the specified module could not be found"
3) zipped CBS file its 80MB? erm whats the score here. cant upload it here due to file size.

I`ve also tried to avoid using exclamation marks and writing help but its a real struggle as I`m at the end of my tether!

Its worth noting that I did have a clear out after this failure to update happened and removed some programmes from the add/remove programs menu in the control panel, but I was sure that they were related to iTunes and other programmes I dont use anymore. I suspected that system restore would solve any issues with this if that has caused the problem.

Note - I`ve seen a few errors as I tried various things and one thats popped up a few times said something like ICACLS failed

 

[NoelDP]

It sounds to me as if you have very limited free space on your machine?
You say you ran CHKDSK - let's have a look at the result of that, (and a few other things)...

Open Event Viewer
click on the Windows logs entry in the left pane to expand it.
Now click on the Application entry - wait while it loads.
Click on 'File' in the menu bar and select Save...
Save the file as Appevt.evtx
Repeat for the System log
then zip both, and upload them.

 

[KennyT]

files as requested

Hi Noel, Thanks for the prompt reply.

My C drive is only 50% full. Not sure if thats what you mean in terms of the limited free space?

Files attached as requested. Thanks for your help in advance.

 

[NoelDP]

You appear to have severe problems with the WMI service (TrustedInstaller) - and have had for a couple of months at lest.

Please download the Farbar Service Scanner from

Farbar Service Scanner Download

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

 

[KennyT]

Farbar Service Scanner Version: 26-07-2015
Ran by CrisandKenny (administrator) on 06-09-2015 at 17:34:52
Running from "C:\Users\CrisandKenny\Downloads"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

 

[NoelDP]

That looks OK.

Let's see what asking directly reveals...

Open an Elevated Command Prompt, and run the following commands...

REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller /S
ICACLS C:\Windows\servicing\TrustedInstaller.exe
DIR C:\WIndows\winsxs\TrustedInstaller.exe /S
 
.

Post the results.
Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[KennyT]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\TrustedInst
aller /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustedInstaller
BlockTime REG_DWORD 0x2a30
BlockTimeIncrement REG_DWORD 0x384
PreshutdownTimeout REG_DWORD 0x36ee80
DisplayName REG_SZ @%SystemRoot%\servicing\TrustedInstaller.exe,-100
Group REG_SZ ProfSvc_Group
ImagePath REG_EXPAND_SZ %SystemRoot%\servicing\TrustedInstaller.exe
Description REG_SZ @%SystemRoot%\servicing\TrustedInstaller.exe,-101
ObjectName REG_SZ localSystem
ErrorControl REG_DWORD 0x1
Start REG_DWORD 0x3
Type REG_DWORD 0x10
ServiceSidType REG_DWORD 0x1
FailureActions REG_BINARY 84030000000000000000000003000000140000000100
0000C0D4010001000000E09304000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustedInstaller\Security
Security REG_BINARY 0100148090000000A000000014000000340000000200200001
00000002C0180000000C000102000000000005200000002002000002005C000400000000021400FF
010F0001010000000000051200000000001800FF0102000102000000000005200000002002000000
0014008D010200010100000000000504000000000014008D01020001010000000000050600000001
02000000000005200000002002000001020000000000052000000020020000


C:\windows\system32>

 

[KennyT]

ICACLS C:\Windows\servicing\TrustedInstaller.exe
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\TrustedInst
aller /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustedInstaller
BlockTime REG_DWORD 0x2a30
BlockTimeIncrement REG_DWORD 0x384
PreshutdownTimeout REG_DWORD 0x36ee80
DisplayName REG_SZ @%SystemRoot%\servicing\TrustedInstaller.exe,-100
Group REG_SZ ProfSvc_Group
ImagePath REG_EXPAND_SZ %SystemRoot%\servicing\TrustedInstaller.exe
Description REG_SZ @%SystemRoot%\servicing\TrustedInstaller.exe,-101
ObjectName REG_SZ localSystem
ErrorControl REG_DWORD 0x1
Start REG_DWORD 0x3
Type REG_DWORD 0x10
ServiceSidType REG_DWORD 0x1
FailureActions REG_BINARY 84030000000000000000000003000000140000000100
0000C0D4010001000000E09304000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustedInstaller\Security
Security REG_BINARY 0100148090000000A000000014000000340000000200200001
00000002C0180000000C000102000000000005200000002002000002005C000400000000021400FF
010F0001010000000000051200000000001800FF0102000102000000000005200000002002000000
0014008D010200010100000000000504000000000014008D01020001010000000000050600000001
02000000000005200000002002000001020000000000052000000020020000


C:\windows\system32>ICACLS C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe NT SERVICE\TrustedInstallerF)
BUILTIN\AdministratorsRX)
NT AUTHORITY\SYSTEMRX)
BUILTIN\UsersRX)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>

 

[KennyT]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\TrustedInst
aller /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustedInstaller
BlockTime REG_DWORD 0x2a30
BlockTimeIncrement REG_DWORD 0x384
PreshutdownTimeout REG_DWORD 0x36ee80
DisplayName REG_SZ @%SystemRoot%\servicing\TrustedInstaller.exe,-100
Group REG_SZ ProfSvc_Group
ImagePath REG_EXPAND_SZ %SystemRoot%\servicing\TrustedInstaller.exe
Description REG_SZ @%SystemRoot%\servicing\TrustedInstaller.exe,-101
ObjectName REG_SZ localSystem
ErrorControl REG_DWORD 0x1
Start REG_DWORD 0x3
Type REG_DWORD 0x10
ServiceSidType REG_DWORD 0x1
FailureActions REG_BINARY 84030000000000000000000003000000140000000100
0000C0D4010001000000E09304000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustedInstaller\Security
Security REG_BINARY 0100148090000000A000000014000000340000000200200001
00000002C0180000000C000102000000000005200000002002000002005C000400000000021400FF
010F0001010000000000051200000000001800FF0102000102000000000005200000002002000000
0014008D010200010100000000000504000000000014008D01020001010000000000050600000001
02000000000005200000002002000001020000000000052000000020020000


C:\windows\system32>ICACLS C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe NT SERVICE\TrustedInstallerF)
BUILTIN\AdministratorsRX)
NT AUTHORITY\SYSTEMRX)
BUILTIN\UsersRX)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>

 

[KennyT]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\TrustedInst
aller /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustedInstaller
BlockTime REG_DWORD 0x2a30
BlockTimeIncrement REG_DWORD 0x384
PreshutdownTimeout REG_DWORD 0x36ee80
DisplayName REG_SZ @%SystemRoot%\servicing\TrustedInstaller.exe,-100
Group REG_SZ ProfSvc_Group
ImagePath REG_EXPAND_SZ %SystemRoot%\servicing\TrustedInstaller.exe
Description REG_SZ @%SystemRoot%\servicing\TrustedInstaller.exe,-101
ObjectName REG_SZ localSystem
ErrorControl REG_DWORD 0x1
Start REG_DWORD 0x3
Type REG_DWORD 0x10
ServiceSidType REG_DWORD 0x1
FailureActions REG_BINARY 84030000000000000000000003000000140000000100
0000C0D4010001000000E09304000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustedInstaller\Security
Security REG_BINARY 0100148090000000A000000014000000340000000200200001
00000002C0180000000C000102000000000005200000002002000002005C000400000000021400FF
010F0001010000000000051200000000001800FF0102000102000000000005200000002002000000
0014008D010200010100000000000504000000000014008D01020001010000000000050600000001
02000000000005200000002002000001020000000000052000000020020000


C:\windows\system32>ICACLS C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe NT SERVICE\TrustedInstallerF)
BUILTIN\AdministratorsRX)
NT AUTHORITY\SYSTEMRX)
BUILTIN\UsersRX)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>DIR C:\WIndows\winsxs\TrustedInstaller.exe /S
Volume in drive C has no label.
Volume Serial Number is 503C-3A92

Directory of C:\WIndows\winsxs\amd64_microsoft-windows-trustedinstaller_31bf385
6ad364e35_6.1.7601.17514_none_ef3338f363c6403c

21/11/2010 04:24 194,048 TrustedInstaller.exe
1 File(s) 194,048 bytes

Total Files Listed:
1 File(s) 194,048 bytes
0 Dir(s) 636,846,645,248 bytes free

C:\windows\system32>

 

[NoelDP]

I can't see anything wrong there...

Open an Elevated Command prompt, and run the following command...

SC start TrustedInstaller

what result do you get?

what result do you get?

 

[KennyT]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\system32>SC start TrustedInstaller

SERVICE_NAME: TrustedInstaller
TYPE : 10 WIN32_OWN_PROCESS
STATE : 2 START_PENDING
(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x7d0
PID : 3652
FLAGS :

C:\windows\system32>

 

[NoelDP]

Hmmm - that's not good, as the TrustedInstaller service is normally running full-time.


Run these two commands...

SC start TruastedInstaller
SC QUERY TrustedInstaller
SC QUERYEX TrustedInstaller

post the results.

 

[KennyT]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\system32>SC QUERY TrustedInstaller

SERVICE_NAME: TrustedInstaller
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 126 (0x7e)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

C:\windows\system32>SC QUERY TrustedInstaller

SERVICE_NAME: TrustedInstaller
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 126 (0x7e)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

C:\windows\system32>

 

[KennyT]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\system32>SC QUERY TrustedInstaller

SERVICE_NAME: TrustedInstaller
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 126 (0x7e)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

C:\windows\system32>SC QUERY TrustedInstaller

SERVICE_NAME: TrustedInstaller
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 126 (0x7e)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

C:\windows\system32>SC QUERYEX TrustedInstaller

SERVICE_NAME: TrustedInstaller
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 126 (0x7e)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\windows\system32>

 

[NoelDP]

Most confusing!

What Anti-Virus is currently installed? what other AVs have EVER been installed?

 

[KennyT]

OK,
I`m currently using MS Security Essentials, and have done for years. The Samsung Laptop may have something free with it, but I never activated it at any time.

I use defender - although its not on just now
I`ve got trusteer rapport - at the banks insistence

 

[KennyT]

What date do you think this started happening? Is it on the logs?

I wonder if I can find out if I installed/uninstalled anything which might have done this...

I`ve not had a virus on this laptop for over a year, and then only one spyware thing I removed with a tool as it was redirecting my browser quite obviously.

Strange isnt it...

 

[NoelDP]

Hmmm - can you please provide a BSOD report according to this tutorial? http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html - just post the resulting file back to this thread.
It'll give me most of the data I need, I think.

 

[KennyT]

BSOD Report

As requested, hope it helps.

Another trinket of info - not sure of its relevance - I`ve got Win10 sitting in my tray waiting on my turn, not done anything with it yet other than the original reservation. Was planning on an upgrade at some point.