[Webinar] Streamline your web hosting managementRegister Today

x
?
Solved

Windows XP cannot install SP2 due to services.exe in use error

Posted on 2010-03-23
13
Medium Priority
?
404 Views
Last Modified: 2012-06-21
I have been trying for over a week to upgrade my Windows XP (home edition) from SP1 to SP2.
I have downloaded the SP2 to my destop and when I run it I get the same erro every timer:
c:\windows\system32\services.exe in use open or busy by another application.

Today I tried following the fix in this article:
http://support.microsoft.com/default.aspx?scid=kb;%5bLN%5d;873148

I tried to locate the registry key error by putting the setupapi.log in verbose mode as recommended. But after the install fialed and I searched the log I did not find any lines with
Error 5: Access is denied

I then proceeded to reset the registry permissions :
Method 2: Reset your operating system back to the default settings
To reset your operating system back to original installation default security settings, follow these steps:
I used this MS fix to do that:
http://support.microsoft.com/kb/313222/

I then tried the install again but was still unsuccessful.
I rebooted in Safe Mode but the install failed again with the same error.

Unfortunately I cannot install my antivirues software until I upgrade to SP2 but I cannot upgrade to SP2.

I also tried running Process Explorer and kiling everything tied to services.exe except what was needed to keep the pc up, like rpc service and lass.
I would appreciate any assistance that can be provided, thank you.


0
Comment
Question by:wds620
  • 5
  • 3
  • 2
  • +3
13 Comments
 
LVL 6

Expert Comment

by:Ituser
ID: 28400454
This should help you with that

http://aumha.net/viewtopic.php?t=8125

Keep me posted.

Ituser
0
 

Author Comment

by:wds620
ID: 28405530
I tried those suggestions but it was unsuccessful. The same error occured duing SP2  installation again.
c:\windows\system32\services.exe in use open or busy by another application.

(I had to manually create the "windows resource kits\tools" folder.
Te reset.cmd file ran quite a while about 15 minutes. )

I think this is the worse pc problem I have ever encountered.
0
 
LVL 6

Expert Comment

by:Ituser
ID: 28409031
Try this

Click Start, Run, type in the following:
regsvr32 licdll.dll
Click OK, then OK again when the confirmation window pops up.
Reboot and retry the service pack install.

Ituser
0
The 14th Annual Expert Award Winners

The results are in! Meet the top members of our 2017 Expert Awards. Congratulations to all who qualified!

 
LVL 12

Expert Comment

by:acl-puzz
ID: 28411912
Hi

there can be an alternative solution for this and its first of all copy all of yours important data from this drive suppose C:\  drive to another drive and now make an slipstreamed CD which will contain downloaded SP2 now just reinstall this system with this newly made CD and you have windows XP with service pack 2 installed here is the easy step by step process mentioned

http://www.brighthub.com/computing/smb-security/articles/52706.aspx



Cheers
0
 
LVL 2

Expert Comment

by:jatremillo
ID: 28420035
Download a utility called Dial a fix.  This will cure a lot of XP errors related to Windows Updates.  Go to this link and download it there:  http://www.lunarsoft.net/downloads/cat_view/40-tech-utilities

This will unregister dll files taht you would normally have to do through command line one at a time.  Will clear out any uncompleted windows updates.  Give it a try.  At this point you have nothing to lose.
0
 
LVL 22

Accepted Solution

by:
optoma earned 2000 total points
ID: 28431267
Have you ran any scanners in case its virus/malware related?

If not run these to rule that out:
1>Hitmanpro
http://www.surfright.nl/en/hitmanpro

2>Malwarebytes (quick scan)
http://www.malwarebytes.org/mbam-download.php
0
 

Expert Comment

by:codvc
ID: 28449795
Have you tried installing sp3?
0
 

Author Comment

by:wds620
ID: 28457837
Hello all. I will try your suggesstions starting with ITuser when I get home tonight.
I did purchase a registry cleaner and ran that last week, it fixed a lot of problems. I also run SpyHunter almost daily to kill adware junk. I do not have an anit-virus program right now though, becuase I was in the process of installing the latest Norton version. The first thing it did was uninstall old software and but then new version would not install becuase I am not on SP2. So have to get to SP 2 first.
I will update after I try these latest suggesstions. Thank you very much.
0
 

Author Comment

by:wds620
ID: 28500782
I think I am out of the woods.

Here is what happened.
1. I tried this but it was unsuccessful, same error:
Click Start, Run, type in the following:
regsvr32 licdll.dll
Click OK, then OK again when the confirmation window pops up.
Reboot and retry the service pack install.

2. I did not try the slipstream CD, I was saving that for later resort.
   I did not try to install SP 3 yet either.

3. I tried dial a fix, I ran the SSL/HTTPS/Crtography and Fix Windows Installer options.
  I then tried to install SP2 but same error.
  I then rebooted in safe mode but got same error.

4. I Hitman Pro. This told me that svchost.exe, fibnl.dll, lsass.exe, and spoolsv.exe were trojans and that services.exe was a virus. I had it delete the fibnl.dll. I was skeptical about the others being bad so I did not remove them.
The above were all found to be in c:\windows\system32.

I then ran the Maleware software. This found about 19 errors. ( I will post the log of the errors it found).
After I had this clean up the errors I then did the SP2 install. The install ran for a good 45 minutes or more. Made it all the way to Performing Clean Up and then crashed.
I check the My Computer properties and it still was set to SP1.
I then rebooted in Safe Mode and ran SP2 install. This time it ran much faster, maybe only about 15 minutes. It crasehd at Performaing Clean Up again. Created a log file named
c:\windows\temp\wat16e.tmp

I rebooted back to normal mode. This time the SP 2 install was successful!!!
I checked the My Computer and it reported SP 2 !!

Post mortem: I think I only have 1 minor issue.
When I reboot in normal mode now when I get to the login screen I see 3 accounts to choose from:
ASP.NET Machine Account
SQLDebugger account
WALT  (this is my mornal account)

Previously I used to see either
Administrator
Walt
(which are what i see when rebooting in Safe Mode).

Is there a way I can correct this so that when I reboot I can choose from
Administrator
WALT

and not have the ASP.Net and SQLDebugger to choose from?

P.S. - You exprerts are great, I have been working on this for over a week!!!
0
 

Author Comment

by:wds620
ID: 28500880
P.S. here is the maleware lo, I had it clean up all the errors it found.
Malwarebytes' Anti-Malware 1.44
Database version: 3910
Windows 5.1.2600 Service Pack 1
Internet Explorer 6.0.2800.1106

3/24/2010 8:12:18 PM
mbam-log-2010-03-24 (20-11-48).txt

Scan type: Quick Scan
Objects scanned: 144270
Time elapsed: 15 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 12
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\timesink, inc. (AdWare.TimeSink) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\rhcgpnj0e1cv (Rogue.AntiVirusXP) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rhcgpnj0e1cv (Rogue.AntiVirusXP) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun\HKCU (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun\HKLM (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\BrowserObjects (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Packages (Rogue.Multiple) -> No action taken.
C:\WINDOWS\Common (Trojan.Agent) -> No action taken.

Files Infected:
C:\WINDOWS\SYSTEM32\dmusic32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\tmp99882171.bat (Malware.Trace) -> No action taken.
0
 
LVL 22

Expert Comment

by:optoma
ID: 28524468
If Hitmanpro flagged them as bad then they are infected :(

run process explorer.
In it ,hit options and select "verify image signatures"
Then hit view,select columns and check "verified signer"
Hit options again and select "difference highlight duration" and set it to nine seconds
Get a screen shot of process and attach images
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx



0
 

Author Comment

by:wds620
ID: 28556537
Optoma I will do what you suggest tonight.

Here is what I am wondering. I have a machine at work that is running Windows XP SP2.
Can I just copy the services.exe, svchost.exe, lsass.exe, and spoolsv.exe from that machine and let it overwrite the ones on my home machine?
0
 
LVL 22

Expert Comment

by:optoma
ID: 28557671
It probably won't let you as they(legimate exe's) would be in use.

It's possible that what Hitmanpro detected are viruses and are masquerading as critical processess.

If the legimate processess are actually infected then you have a nasty file infector :(

On that machine go into folder options and "show hidden files and folders" and uncheck to "hide protected operating system files" and hit apply.

Go to system32 folder and how many services.exe, svchost.exe etc.. is there.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
Step by step guide to Clean and Sort your windows registry! Introduction: Always remember: A Clean registry = Better performance = Save your invaluable time In this article we're going to clear our registry manually! Yes, manually! The e…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
With just a little bit of  SQL and VBA, many doors open to cool things like synchronize a list box to display data relevant to other information on a form.  If you have never written code or looked at an SQL statement before, no problem! ...  give i…
Suggested Courses
Course of the Month10 days, 1 hour left to enroll

591 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question