Link to home
Start Free TrialLog in
Avatar of wds620
wds620

asked on

Windows XP cannot install SP2 due to services.exe in use error

I have been trying for over a week to upgrade my Windows XP (home edition) from SP1 to SP2.
I have downloaded the SP2 to my destop and when I run it I get the same erro every timer:
c:\windows\system32\services.exe in use open or busy by another application.

Today I tried following the fix in this article:
http://support.microsoft.com/default.aspx?scid=kb;%5bLN%5d;873148

I tried to locate the registry key error by putting the setupapi.log in verbose mode as recommended. But after the install fialed and I searched the log I did not find any lines with
Error 5: Access is denied

I then proceeded to reset the registry permissions :
Method 2: Reset your operating system back to the default settings
To reset your operating system back to original installation default security settings, follow these steps:
I used this MS fix to do that:
http://support.microsoft.com/kb/313222/

I then tried the install again but was still unsuccessful.
I rebooted in Safe Mode but the install failed again with the same error.

Unfortunately I cannot install my antivirues software until I upgrade to SP2 but I cannot upgrade to SP2.

I also tried running Process Explorer and kiling everything tied to services.exe except what was needed to keep the pc up, like rpc service and lass.
I would appreciate any assistance that can be provided, thank you.


Avatar of Ituser
Ituser
Flag of United States of America image

This should help you with that

http://aumha.net/viewtopic.php?t=8125

Keep me posted.

Ituser
Avatar of wds620
wds620

ASKER

I tried those suggestions but it was unsuccessful. The same error occured duing SP2  installation again.
c:\windows\system32\services.exe in use open or busy by another application.

(I had to manually create the "windows resource kits\tools" folder.
Te reset.cmd file ran quite a while about 15 minutes. )

I think this is the worse pc problem I have ever encountered.
Try this

Click Start, Run, type in the following:
regsvr32 licdll.dll
Click OK, then OK again when the confirmation window pops up.
Reboot and retry the service pack install.

Ituser
Hi

there can be an alternative solution for this and its first of all copy all of yours important data from this drive suppose C:\  drive to another drive and now make an slipstreamed CD which will contain downloaded SP2 now just reinstall this system with this newly made CD and you have windows XP with service pack 2 installed here is the easy step by step process mentioned

http://www.brighthub.com/computing/smb-security/articles/52706.aspx



Cheers
Download a utility called Dial a fix.  This will cure a lot of XP errors related to Windows Updates.  Go to this link and download it there:  http://www.lunarsoft.net/downloads/cat_view/40-tech-utilities

This will unregister dll files taht you would normally have to do through command line one at a time.  Will clear out any uncompleted windows updates.  Give it a try.  At this point you have nothing to lose.
ASKER CERTIFIED SOLUTION
Avatar of optoma
optoma
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Have you tried installing sp3?
Avatar of wds620

ASKER

Hello all. I will try your suggesstions starting with ITuser when I get home tonight.
I did purchase a registry cleaner and ran that last week, it fixed a lot of problems. I also run SpyHunter almost daily to kill adware junk. I do not have an anit-virus program right now though, becuase I was in the process of installing the latest Norton version. The first thing it did was uninstall old software and but then new version would not install becuase I am not on SP2. So have to get to SP 2 first.
I will update after I try these latest suggesstions. Thank you very much.
Avatar of wds620

ASKER

I think I am out of the woods.

Here is what happened.
1. I tried this but it was unsuccessful, same error:
Click Start, Run, type in the following:
regsvr32 licdll.dll
Click OK, then OK again when the confirmation window pops up.
Reboot and retry the service pack install.

2. I did not try the slipstream CD, I was saving that for later resort.
   I did not try to install SP 3 yet either.

3. I tried dial a fix, I ran the SSL/HTTPS/Crtography and Fix Windows Installer options.
  I then tried to install SP2 but same error.
  I then rebooted in safe mode but got same error.

4. I Hitman Pro. This told me that svchost.exe, fibnl.dll, lsass.exe, and spoolsv.exe were trojans and that services.exe was a virus. I had it delete the fibnl.dll. I was skeptical about the others being bad so I did not remove them.
The above were all found to be in c:\windows\system32.

I then ran the Maleware software. This found about 19 errors. ( I will post the log of the errors it found).
After I had this clean up the errors I then did the SP2 install. The install ran for a good 45 minutes or more. Made it all the way to Performing Clean Up and then crashed.
I check the My Computer properties and it still was set to SP1.
I then rebooted in Safe Mode and ran SP2 install. This time it ran much faster, maybe only about 15 minutes. It crasehd at Performaing Clean Up again. Created a log file named
c:\windows\temp\wat16e.tmp

I rebooted back to normal mode. This time the SP 2 install was successful!!!
I checked the My Computer and it reported SP 2 !!

Post mortem: I think I only have 1 minor issue.
When I reboot in normal mode now when I get to the login screen I see 3 accounts to choose from:
ASP.NET Machine Account
SQLDebugger account
WALT  (this is my mornal account)

Previously I used to see either
Administrator
Walt
(which are what i see when rebooting in Safe Mode).

Is there a way I can correct this so that when I reboot I can choose from
Administrator
WALT

and not have the ASP.Net and SQLDebugger to choose from?

P.S. - You exprerts are great, I have been working on this for over a week!!!
Avatar of wds620

ASKER

P.S. here is the maleware lo, I had it clean up all the errors it found.
Malwarebytes' Anti-Malware 1.44
Database version: 3910
Windows 5.1.2600 Service Pack 1
Internet Explorer 6.0.2800.1106

3/24/2010 8:12:18 PM
mbam-log-2010-03-24 (20-11-48).txt

Scan type: Quick Scan
Objects scanned: 144270
Time elapsed: 15 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 12
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\timesink, inc. (AdWare.TimeSink) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\rhcgpnj0e1cv (Rogue.AntiVirusXP) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rhcgpnj0e1cv (Rogue.AntiVirusXP) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun\HKCU (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun\HKLM (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\BrowserObjects (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\Walt\Application Data\rhcgpnj0e1cv\Quarantine\Packages (Rogue.Multiple) -> No action taken.
C:\WINDOWS\Common (Trojan.Agent) -> No action taken.

Files Infected:
C:\WINDOWS\SYSTEM32\dmusic32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\tmp99882171.bat (Malware.Trace) -> No action taken.
If Hitmanpro flagged them as bad then they are infected :(

run process explorer.
In it ,hit options and select "verify image signatures"
Then hit view,select columns and check "verified signer"
Hit options again and select "difference highlight duration" and set it to nine seconds
Get a screen shot of process and attach images
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx



Avatar of wds620

ASKER

Optoma I will do what you suggest tonight.

Here is what I am wondering. I have a machine at work that is running Windows XP SP2.
Can I just copy the services.exe, svchost.exe, lsass.exe, and spoolsv.exe from that machine and let it overwrite the ones on my home machine?
It probably won't let you as they(legimate exe's) would be in use.

It's possible that what Hitmanpro detected are viruses and are masquerading as critical processess.

If the legimate processess are actually infected then you have a nasty file infector :(

On that machine go into folder options and "show hidden files and folders" and uncheck to "hide protected operating system files" and hit apply.

Go to system32 folder and how many services.exe, svchost.exe etc.. is there.