Noel I have found this. Could this be part of the problem.
Thelma take no action on this information without Noels guidance first.
http://www.bleepingcomputer.com/star...exe-14544.html
Name: Remote Procedure Call (RPC) Service Filename: RpcSs.exe Command: C:\Windows\System32\RpcSs.exe Description:
Added by the W32/Cuebot-J worm and IRC backdoor.
File Location: %System%
That looks like you're not using an Elevated (Administrator) command prompt - which means that the uninstall will fail for that reason...
To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
@Bear - nice catch, but I'm not certain that it's relevant? I'll have to check it tomorrow as it's past my bedtime now.
I am quite sure I did the elevated Command Prompt, but I can be wrong so I will now do it again, I know, you run it as administrator.
I'll do it now : You were right of coarse,now it was the usual
C:\windows 32 line.
Any way, the result was the same,
no stand alone installer kb 3004394 on this computer.
I still get this page popping up saying that Windows is not Genuien,
Will try to upload those update now .......
been trying to upload those updates several times yesterday morning, than I had to Leave.
Perhaps I should persist and keep trying ? It seams that many others have problems with Windows updates, looks almost as normal. But then I keep getting this stupid popup about Windows not being genuine ?
No way, cannot download those windows updates and Windows is not genuine welcomes me every time I start.
Looking back at the event logs, it's obvious that a number of services have been altered in terms of their startup behaviour.
I think (hope) that resetting them to the default may make things a little simpler...
*
I've uploaded a file - w7hpsvcs_def.zip - to my OneDrive at Noel's OneDrive
Please download and save it to your desktop.
Right-click on the saved file and select Extract all...
Save it to the default location
This should create a file w7hpsvcs_def.reg
*
*right-click on the file, and select Merge
Accept the warnings, - you should then get a 'Success' message.
Close all windows, and reboot.
*
Run another MGADiag report, and post the results.
Thanks Noel,
I did it and it was successful !
MGA Diag report:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
Windows Product ID: 00359-OEM-8992687-00095
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {6FAD2D6F-2136-44F5-9A25-6B681F664F0D}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150715-0600
TTS Error: T:20150518111512711-
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{6FAD2D6F-2136-44F5-9A25-6B681F664F0D}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-RMV82</PKey><PID>00359-OEM-8992687-00095</PID><PIDType>2</PIDType><SID>S-1-5-21-2693414740-4022384018-3331022292</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron M5010</Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A12</Version><SMBIOSVersion major="2" minor="6"/><Date>20110719000000.000000+000</Date></BIOS><HWID>AD693507018400F4</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Romance Standard Time(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL </OEMID><OEMTableID>WN09 </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: U1BMRwEAAAAAAQAACAAAAMY+AAAAAAAAYWECAAAAAABpnj0lS5HQAROJf9ybj7SsIEe8hMh9DOGvzGBAnzBHSBB7hVwHtXjT05LJ +konLW63FmLmJZVpSQcEhJLoLtXa7QLUDAXvDFMzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WN aAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3Ou rH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAx4dZsx s/sxaQSZh6DCEuBHzWZj0kmaRrqn7BfAT/muFqBVj3bCUyYhfOYNdn7PK8czkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc6 6sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1i fb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jW gM
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800095-02-2057-7600.0000-1382015
Installation ID: 009746800964695216209912239346979442986532581920005374
Processor Certificate URL: SpcService Web Service
Machine Certificate URL: RacService Web Service
Use License URL: UseLicenseService Web Service
Product Key Certificate URL: PkcService Web Service
Partial Product Key: RMV82
License Status: Licensed
Remaining Windows rearm count: 5
Trusted time: 9/18/2015 9:39:21 AM
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 9:18:2015 09:31
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
HWID Data-->
HWID Hash Current: KgAAAAEAAQABAAEAAAACAAAAAAABAAEA6GF83dqbBMO+rqKF6kWetxh5
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC DELL WN09
FACP DELL WN09
HPET DELL WN09
MCFG DELL WN09
SLIC DELL WN09
SSDT AMD POWERNOW
OSFR DELL M08
I think that went OK ?
And I have just managed to download 6 updates again, only 4 to go .
When I shut down and restart ( after successfully downloaded ) during shut down it says " shutting down, downloading updates 30% " and than it stops and closes.
When it reboots again it says " preparing to download, do not turn off your computer " and then it went to 100% ".
GREAT!
The MGADiag report is now fine.
- now all I have to do is work out exactly which service was affected for any future sufferers!
Could you please upload your Application and Event logs for me?
C:\windows\System32\winevt\Applications.evtx
C:\windows\System32\winevt\System.evtx
You'll have to copy them to the desktop before zipping them for upload.
Quote