My deep apologies.
The initial run produced no errors and 7 updates. I told it to install the updates. The machine immediately shut down and then was left with 4 updates and the same error as before.
Not your fault - obviously a bug in CheckSUR somewhere. It got it right this time
The problem seems to be with permissions somewhere - the first two errors in a boot sequence are both 'Access Denied' ones - for DNS Client, and DHCP Client.
Open Regedit, and navigate to the
HKLM\SYSTEM\CurrentControlSet\Services folder -
Look there for the entry for Dhcp
Right-click on it and select Permissions
Please list all the entries in the Security tab's top window - if SYSTEM is present, highlight it, and list the tcked entries in the bottom windows
repeat for the DNScache entry
Then close Regedit and post the results
Open an Elevated Command Prompt, and run the following commands:
REG QUERY HKLM\SYSTEM\CurrentControlSet\Services /S >> "%userprofile%\desktop\dhcpdns.txt"
REG QUERY HKLM\SYSTEM\CurrentControlSet\DNScache /S >> "%userprofile%\desktop\dhcpdns.txt"
This will put a file on your desktop - dhcpdns.txt - please upload it to your reply
Thank you again.
I opened regedit and the permissions for SYSTEM appear to be on.
REG QUERY for Services ran and I attach the file.
REG QUERY for DNS Cache said there was no key.
I attach screen shots of the message, the permissions and the presence of an Unknown user.
Thanks again, Jo
PS I had to zip the .txt file because it was too big - did I run it more than once perhaps?
Yeah - my mistake on the commands - but it contains the data we need, anyhow
back later when I get time to digest it!
The thread seems to have got tangled.
I am too out of my depth to know if this is relevant - but from the outset the dnsapi.dll has been missing and the firewall was quarantining a trojan that arrived with the updates.
The SFC scan doesn't show any problems about a missing dnsapi.dll - I suspect that it may have been part of your Trojan.
Are you getting the error at boot every time? What is the EXACT error message?
1. The Windows Activation / Windows is not genine / Get genuine now / Ask me later / 0x80070005
2. At bottom left: Windows 7 Build 7601 This copy of Windows is not genuine.
3. The next visible message is from Skype saying it cannot load then dnsapi.dll
4. Firefox crashes
5. Chrome and Opera hang.
6. Somewhere after a restore the internet connection got scribbled (could no longer ping). I attach a screen shot and the log file. I can see the problem is the connection to an unidentified public network but I can't find how to disconnect it.
Thanks - I hope this is not trying your patience too much. Jo
That unknown ssid 556 relates to the fact that the machine has been turned into a domain controller, which is further confirmed by the multiple networks screenshot.
This in turn has modified permissions on this comp.
Firewalls DO NOT quarintine they block, and i have never known of any MS update containing a virus.
What AV are you running, and what were the last results from its log files
Roy
Thanks Roy - I am afraid I am out of my depth here. I am hoping Noel still has the patience to guide me through this.
The history was that I was away for two weeks and the original problem emerged when I powered up. I use Microsoft Security Essentials.
Thanks for the pointer. I will read up DC to be a little less ignorant of what is happening.
Jo
I don't believe that it has anything to do with a Domain Controller?
Let's work on the basis that the dnsapi.dll is present - and check the permissions on it.
Open an Elevated Command Prompt, and run the following commands:
ICACLS C:\Windows\System32\dnsapi.dll /T
ICACLS C:\Windows\winsxs\dnsapi.dll /T
ICACLS C:\Windows\SysWOW64\dnsapi.dll /T
DIR C:\Windows\dnsapi.dll /S
(The last one will take a couple of minutes to complete - be patient!)
post the results...
Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.
Quote