Windows Updates will not run - Win & professional 64bit

[Magikvw]

Windows Updates will not run - Win 7 Professional 64bit

Hello -

I am having a problem installing Windows Updates. When I go to Win Update and click "Check for Updates" I get error: 80070005 (see attached .jpg) .

I had a webhp infection and the folks at Malewarebytes forum helped me clean that up - they say I am clean of maleware and referred me to their computer support forum who then referred me here.

I have followed your instructions of what to do before I post here.
1. Installed SURT
2. Ran SFC Scan
3. Windows Update error code is attached
4. C:\windows\logs folder does not exist - I also searche CBS and could not find it

Some other oddities that may or may not be associated with my issue:
1. Cannot update Adobe Acrobat X Standard
2. Cannot reinstall Google Toolbar
3. Java updates will not complete

I am most concerned about the Windows Updates - I suspect the other issues are related but I am obviously not sure.

Any help you can provide is greatly appreciated.

Thanks!

 

[Magikvw]

SOrry - I forgot to mention that I have already tried:

1. Running Updates in Safe Mode
2. Running the WIndows Fixit tool for Windows Update issues

 

[Petey7]

Copy and paste the following into notepad and save it as flush.bat. Then right click the file and select "run as administrator."

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

 

[Magikvw]

Ok - I've done that.

 

[NoelDP]

Please follow the http://www.sevenforums.com/windows-...4840-windows-update-posting-instructions.html and post the requested information

Please also run the following commands in an Elevated Command Prompt window and post the results.

DIR C:\Windows\Logs
DIR C:\Windows\Logs\CBS
ICACLS C:\Windows\Logs\CBS


Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[Magikvw]

Ok - Thanks:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>DIR C:\Windows\Logs
Volume in drive C is OS
Volume Serial Number is 1C05-3DB7
Directory of C:\Windows\Logs
11/21/2012 09:19 AM <DIR> WindowsBackup
0 File(s) 0 bytes
1 Dir(s) 418,595,663,872 bytes free
C:\Windows\system32>DIR C:\Windows\Logs\CBS
Volume in drive C is OS
Volume Serial Number is 1C05-3DB7
Directory of C:\Windows\Logs\CBS
03/07/2013 12:05 PM 6,181,354 CBS.log
11/13/2012 02:39 PM 1,755,928 CbsPersist_20121113225038.cab
03/07/2013 10:43 AM 1,534 CheckSUR.log
03/07/2013 10:43 AM 1,537 CheckSUR.persist.log
4 File(s) 7,940,353 bytes
0 Dir(s) 418,595,663,872 bytes free
C:\Windows\system32>ICACLS C:\Windows\Logs\CBS
C:\Windows\Logs\CBS NT SERVICE\TrustedInstallerI)(F)
NT SERVICE\TrustedInstallerI)(CI)(IO)(F)
NT AUTHORITY\SYSTEMI)(F)
NT AUTHORITY\SYSTEMI)(OI)(CI)(IO)(F)
BUILTIN\AdministratorsI)(F)
BUILTIN\AdministratorsI)(OI)(CI)(IO)(F)
BUILTIN\UsersI)(RX)
BUILTIN\UsersI)(OI)(CI)(IO)(GR,GE)
CREATOR OWNERI)(OI)(CI)(IO)(F)
Successfully processed 1 files; Failed processing 0 files
C:\Windows\system32>

 

[Magikvw]

Sorry - Not sure how to turn those darn smilies off

 

[Magikvw]

I've already done the Windows Updates Posting Instructions.

Did I somehow get two seperate threads going when I corrected the heading on my original post?

 

[NoelDP]

Don't think so?

I can read Smiley, so don't worry about it

OK - the folders and files do exist, and they are visible if you ask Windows nicely

Open Windows Explorer
Click on Organize..
Click on Folder and Search options
Click on View
UNtick 'Hide extensions.....'
put the radio-button blob in 'Showhidden files, folders, and drives'

click Apply and OK

Now look for the CBS folder

 

[Magikvw]

I should have known that....hmmm

OK - here is the zipped folder

 

[NoelDP]

The CBS folder shouldn't actually be hidden (which it is, currently)

Navigate to the C:\Windows\Logs folder, and right-click on the CBS folder - select Properties
Clear the Hidden attribute in the options, and click OK - wait for it to complete, then click OK again
reset the View options back to normal and you should still be able to see the CBS folder.

CheckSUR found and fixed 4 problems - there's nothing amiss I can see in the CBS log.

Reboot, and then do a Check for Updates - see what happens, and just install the oldest offered update.

Does it work? If not, what is the (new) error message?

 

[Magikvw]

Ok - I will do this and let you know what happens.

 

[NoelDP]

There aren't two threads - and you've done everything right so far, as far as I can see

Just carry on with the instructions from my post #11

 

[Magikvw]

I see that now - sorry - I'm doing 15 things at once here and got all backwards.

OK, I followed what you said in post #11

When I went to WIndows Update and received the same error... hmm

 

[NoelDP]

OK



This can result from mistakenly setting the System32 folder and its contents to 'Read Only' status.


To correct this:-

Open Windows Explorer (Computer)
Navigate to the C:\Windows folder
Find the System32 sub-folder and right-click on it
select Properties

Clear the 'blob' from the 'Read-only (Only applies to files in folder)' box by clicking on it until it's plain white.
Click on Apply.

Make sure that the radio button for 'Apply changes to this folder, subfolders and files' is set, and click OK.

Accept the Administrator prompt. After a couple of seconds, you'll be told there is an error - click on the 'Ignore all' button.

Wait for it to finish - it could take a couple of minutes.

OK out, and exit Windows Explorer.

Reboot twice

Try Windows Update againt

 

[NoelDP]

Looking at your Filter list - what Anti-Virus are you currently using?
What other AV's have EVER been installed?

 

[Magikvw]

Ok - I reset the System 32 folder and I rebooted twice. I still get the same error.

As fo AV - I am currently running Symantec Endpoint 11.0 - my computer is running a client version on a Networked Endpoint system.

I have not run any other AV softwarte on this machine. I do run Malewarebytes and while tracking that webhp thing they had me run Combofix and a bunch of other scanners as well as their new rootkit application. However, any scanners they had me use have been removed (except Malwarebytes).

 

[NoelDP]

I was afraid you were going to say that
I wouldn't be at all surprised if Symantec is the root of the problem.
Can you uninstall it completely, run their cleanup tool (I think you have to ask Support for it?) and then reinstall it?
(testing WU while it's uninstalled would also be a good idea!)

The following 'Answer' may also help
windows update error 80070005

 

[Magikvw]

OK - I will try to uninstall Endpoint - I'll see if I can't get their clean up tool). I'll let you know how I'm doing once I'm able to get through this.

Thanks

 

[Magikvw]

Hey - should I remove their live update as well?