Link to home
Create AccountLog in
Avatar of Unionblitz
UnionblitzFlag for United States of America

asked on

Hijackthis log - Win7 SP1 Issues

Good afternoon,

I am unable to upgrade to Windows 7 SP1- I get a C004F01F error.  I really would like to get SP1 on this machine, and remove anything malicious that might still be on it (without doing a system reinstall).

This machine is used for work, and it's imperative that work-related files/programs installed remain intact if I have to do a recovery/reinstall.

Some background:
1. The machine had a virus at some point.  A registry edit was able to "fix" the issue (I think).
2. I installed/ran Spybot, Symantec Antivirus, and Microsoft Security Essentials.  
3. I am unable to install Win7 SP1. I keep getting a C004F01F error.
4. I ran a scan disk, and came up with several problems (not fixable).
5. The laptop is a Toshiba, and it came with a recovery disk (not a Windows disk).

What I've done to get closer to fixing it:
1. Ran Hijackthis, attached the log.
2. Attached a shorted CBS.log.

Could someone please help me!
hijackthis.log
sfcdetails.txt
ASKER CERTIFIED SOLUTION
Avatar of younghv
younghv
Flag of United States of America image

Link to home
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
See answer
After following the younghv advice,  and per your HiJackthis logs, following entries needs to be fixed:
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)

Sudeep
Once that is done I would also advice you if you a copy of you Symantec Antivirus then uninstall before installing the Service Pack 1. Once that is install, install the Symantec Antivirus afterwards.

I hope that would help

Sudeep
As noted in this Article, there are several things that HijackThis cannot handle in a 64 bit architecture.
https://www.experts-exchange.com/Virus_and_Spyware/HijackThis/A_3178-HijackThis-reports-missing-files-on-64-bit-Systems.html

There is no need to take any action in any of the above listed "023" entries.

Avatar of Unionblitz

ASKER

I ran the combo fix log, and here are the results.  I'll look into that rogue killer hyperlink suggested by younghv.

Based on the combo fix log, should I take any additional steps?
ComboFix.txt
The Rogue Killer didn't return any bad processes or tasks.  I'm going to uninstall Symantec and try to do the SP1 update again.
Unionblitz,
RogueKiller is only the first step in the process.
After you run that, you immediately install and update Malwarebytes - then do a full scan.

Post your Malwarebytes log when you are through.
20 minutes and still scanning, using the Malware tool (Full scan)... I will post the log up here when it's done.
*anti-malware (malwarebytes)
Younghv, here is the anti-malware log.  It doesn't look like anything malicious is running in the background (which is obviously a great thing).  Please advice me on what to do next.

Thank you!
mbam-log-2011-05-15--15-08-03-.txt
I agree - nothing bad showing up - and I agree that it is a great thing.

Have you tried downloading the actual SP1 "executable file and running that from your system?

As noted above, Symantec and SME could be conflicting - or - it could be the Symantec is/was blocking the install.

With all of your AV (temporarily) disconnected, try run SP1 from the website again.
If that doesn't work, download the executable and try running that.
Installing from web (Windows Updates)...  Hopefully this will work! *fingers crossed*
Concur!
X'd
nope, the web version didn't work.  I got the c004f01f error again. What should I do now? Download the SP1 onto my desktop, restart in safe mode, and try installing it that way?

Again, the scandisk will probably come up with additional errors.  I don't think we ever addressed those errors.  Is there any way to fix that?
That is a very common error (according to MS).

Their number one recommendation is to download and install the SP manually.

http://support.microsoft.com/kb/947366
I've tried running the windows 7 sp1 file by itself on my machine, to no avail.  I tried running those files to prime the machine for the windows updates, which fixed nothing.

I tried booting in recovery mode for Windows 7, and it couldn't find any issues with the setup.

I am wondering if the scan disk log is a good start as to what is wrong.

Help!
Did you read the suggestions at the second MS link I posted?
MS have an actual SP trouble-shooter that you can use.
yes, I ran that trouble shooter. I ran the preparer tool as well. Nothing is working... I might just reinstall windows soon. I can't get any windows update to install. Fun fun. :)
Avatar of Jonvee
Jonvee

Before you reinstall  the OS take a look at this article,  Although it describes a different error code the suggestions should help>>
http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_update/unable-to-install-windows-7-service-pack-1-sp1-due/2859b00a-e472-e011-8dfc-68b599b31bf5?msgId=292ba7c6-e972-e011-8dfc-68b599b31bf5

As stated, please ensure you disable your AV, & ensure the laptop is connected to mains power & not battery.

Also ...
http://www.zdnet.com/blog/bott/microsoft-notes-windows-update-inconsistencies-provides-fix/3044
Its conceivable the laptop is still infected, so you may like to run another Malware scan before you attempt that last article.

Try Hitman Pro, a second opinion scanner:
Hitman Pro http://www.surfright.nl/en/hitmanpro

Also this ESET Online Scanner:
http://www.eset.com/online-scanner 

Meanwhile i'll study the previous ComboFix log file ...
Apart from the "Other Deletions" and "Orphans removed" lists in the CF log file, there does not appear to be any other infection ...but still advise you re-scan as suggested above.
I was unable to resolve this problem. However, this was the closest solution.