Solved Windows update and BITS missing

[naveen89]

Hi,
As the title suggests both these services are missing from my system.
Its a 64 bit win 7 sony vaio. Have tried the tutorial in this site, microsoft detection tool and various other methods available on the net in the last 8 hours.
Standalone installer fails saying the specified service doesn't exist as an installed service.
Fixit tool fails saying you don't have permissions to start BITS.

Have checked registry and registry entries exist for both BITS and update.
Read somewhere to create the service by using sc. On trying that got an error of CreateService Failed 5. Access is denied.
Am totally at my wits end now. Would appreciate any help.

Regards,

 

[ICIT2LOL]

Hello and welcome naveen try this mate and start at option 2 http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

then try a chkdsk http://www.sevenforums.com/tutorials/433-disk-check.html

Do these first and then we will go from there.

 

[naveen89]

Hi, Thanks for the reply,
I've already tried scannow and it shows no integrity issues found.
Should i try check disk with both file system errors and bad sectors option checked?

Regards,

 

[NoelDP]

Hopefully the fix will be simple
Please download http://kb.eset-la.com/library/ESET/KB%20Team%20Only/Malware/ServicesRepair.exe and save it to your desktop.
Double-click ServicesRepair.exe
If security notifications appear, click
Continue or Run and then click Yes when asked if you want to proceed.
Once the tool has finished, you will be prompted to restart your computer.
Click Yes to restart.

Then download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

 

[naveen89]

Hopefully the fix will be simple
Please download http://kb.eset-la.com/library/ESET/KB%20Team%20Only/Malware/ServicesRepair.exe and save it to your desktop.
Double-click ServicesRepair.exe
If security notifications appear, click
Continue or Run and then click Yes when asked if you want to proceed.
Once the tool has finished, you will be prompted to restart your computer.
Click Yes to restart.

Then download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

Done. Out below. Thanks!

Farbar Service Scanner Version: 16-06-2013
Ran by liji (administrator) on 26-06-2013 at 22:02:09
Running from "C:\Users\liji\Downloads"
Windows 7 Home Premium (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.

BITS Service is not running. Checking service configuration:
The start type of BITS service is set to Demand. The default start type is Auto.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll
[2012-06-14 08:27] - [2012-04-24 11:29] - 0182272 ____A (Microsoft Corporation) F02786B66375292E58C8777082D4396D

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

 

[naveen89]

Hi, Thanks for the reply,
I've already tried scannow and it shows no integrity issues found.
Should i try check disk with both file system errors and bad sectors option checked?

Regards,

Hi,
The checkdisk kept on failing at 5%. The system kept on restarting.
Finally i pressed a key, skipped the chkdsk and logged in.

Regards,

 

[NoelDP]

OK
Please open an Elevated Command Prompt window, and run the following commands...

SC CONFIG BITS start=Auto
NET START BITS
NET START WUAUSERV

post the results.

Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[NoelDP]

CHKDSK failing at the same point very time is not a good sign - it's likely either to mean a sophisticated rootkit, or a failing drive.

 

[naveen89]

Thanks for the prompt response.
Results for the commands below.
On the rootkit vs failing harddisk i suspect the former coz sometime back i purchased mcafee total protection and could not install the anti virus package at all. Other components installed fine but any attempt to install virus and spyware protection failed.

C:\Users\liji>SC CONFIG BITS start=Auto
DESCRIPTION:
Modifies a service entry in the registry and Service Database.
USAGE:
sc <server> config [service name] <option1> <option2>...

OPTIONS:
NOTE: The option name includes the equal sign.
A space is required between the equal sign and the value.
type= <own|share|interact|kernel|filesys|rec|adapt>
start= <boot|system|auto|demand|disabled|delayed-auto>
error= <normal|severe|critical|ignore>
binPath= <BinaryPathName>
group= <LoadOrderGroup>
tag= <yes|no>
depend= <Dependencies(separated by / (forward slash))>
obj= <AccountName|ObjectName>
DisplayName= <display name>
password= <password>

C:\Users\liji>




C:\Users\liji>NET START BITS
The service name is invalid.

More help is available by typing NET HELPMSG 2185.


C:\Users\liji>


C:\Users\liji>NET START WUAUSERV
The service name is invalid.

More help is available by typing NET HELPMSG 2185.


C:\Users\liji>

 

[naveen89]

Ran the first command with space, Output below.

C:\Users\liji>SC CONFIG BITS start= Auto
[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.


C:\Users\liji>

 

[NoelDP]

You would appear to still have a live infection
Download the Sirefef cleaner from here....
ESET :: Download :: Utilities :: Detail :: Sirefef Cleaner

run it, and see what it has to say

 

[naveen89]

It says
Threat not found.
You don't have Win64/Sirefef in your system.

 

[NoelDP]

That surprises me ...
We'll have to look for other malware, then..

Please download and install Malwarebytes Anti-malware (free version) from http://www.malwarebytes.org/products/malwarebytes_free/ - UNtick 'Enable free trial of MBAM PRO' at the end of the installation - and update it, then run a full scan in your main account, and Quick scans in any other user accounts.

Delete everything it finds

 

[naveen89]

That surprises me ...
We'll have to look for other malware, then..

Please download and install Malwarebytes Anti-malware (free version) from http://www.malwarebytes.org/products/malwarebytes_free/ - UNtick 'Enable free trial of MBAM PRO' at the end of the installation - and update it, then run a full scan in your main account, and Quick scans in any other user accounts.

Delete everything it finds

Doing that. Just to clarify the Siref scan was really quick. It just opened a window which said Threat not found.
Let me know if you want a screenshot.

 

[NoelDP]

Nah - I ran it on a clean machine before posting, to see what it did/said

 

[naveen89]

Thanks. Started the scan. Think its gonna take long.
Will post the results for all accounts by tomm.

Regards,

 

[Kaktussoft]

http://www.sevenforums.com/tutorials/682-command-prompt-startup.html

Then

dir  C:
dir D:
dir E:

Now you know the drive letter of win7 partition. check it with checkdisk

chkdsk/f  Y:

Replace Y with actual drive letter.
Maybe better you check C,D,E,F (if they exist and are not DVD)
Still problems with chkdsk?

 

[Kaktussoft]

Windows Repair (All In One)

Be sure to select "Restore Important Windows Services" and "Repair Windows Updates". Maybe select "Set Windows Services To Default Startup" as well.

 

[naveen89]

Results of malware bytes scan.
No threats found in any account.

Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free anti-malware download

Database version: v2013.06.26.04

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
liji :: LIJI-VAIO [administrator]

6/26/2013 10:56:26 PM
mbam-log-2013-06-26 (22-56-26).txt

Scan type: Full scan (C:\|Q:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 581390
Time elapsed: 1 hour(s), 28 minute(s), 16 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


------Second account------

Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free anti-malware download

Database version: v2013.06.26.04

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Administrator :: LIJI-VAIO [administrator]

6/27/2013 6:46:08 AM
mbam-log-2013-06-27 (06-46-08).txt

Scan type: Full scan (C:\|Q:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 581506
Time elapsed: 1 hour(s), 31 minute(s), 52 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

 

[naveen89]

http://www.sevenforums.com/tutorials/682-command-prompt-startup.html

Then

dir  C:
dir D:
dir E:

Now you know the drive letter of win7 partition. check it with checkdisk

chkdsk/f  Y:

Replace Y with actual drive letter.
Maybe better you check C,D,E,F (if they exist and are not DVD)
Still problems with chkdsk?

started safe mode with command prompt. Did dir c:. I only have one dir.
The did chkdsk.
Then restarted but chkdsk still failed at 5%.

Regards,