How can your organization benefit from savings just by replacing your legacy backup solutions with Acronis' #CyberProtection? Join Forrester's Joe Branca and Ryan Davis from Acronis live as they explain how you can too.
Hijackthis log - Win7 SP1 Issues
Good afternoon,
I am unable to upgrade to Windows 7 SP1- I get a C004F01F error. I really would like to get SP1 on this machine, and remove anything malicious that might still be on it (without doing a system reinstall).
This machine is used for work, and it's imperative that work-related files/programs installed remain intact if I have to do a recovery/reinstall.
Some background:
1. The machine had a virus at some point. A registry edit was able to "fix" the issue (I think).
2. I installed/ran Spybot, Symantec Antivirus, and Microsoft Security Essentials.
3. I am unable to install Win7 SP1. I keep getting a C004F01F error.
4. I ran a scan disk, and came up with several problems (not fixable).
5. The laptop is a Toshiba, and it came with a recovery disk (not a Windows disk).
What I've done to get closer to fixing it:
1. Ran Hijackthis, attached the log.
2. Attached a shorted CBS.log.
Could someone please help me!
hijackthis.log
sfcdetails.txt
I am unable to upgrade to Windows 7 SP1- I get a C004F01F error. I really would like to get SP1 on this machine, and remove anything malicious that might still be on it (without doing a system reinstall).
This machine is used for work, and it's imperative that work-related files/programs installed remain intact if I have to do a recovery/reinstall.
Some background:
1. The machine had a virus at some point. A registry edit was able to "fix" the issue (I think).
2. I installed/ran Spybot, Symantec Antivirus, and Microsoft Security Essentials.
3. I am unable to install Win7 SP1. I keep getting a C004F01F error.
4. I ran a scan disk, and came up with several problems (not fixable).
5. The laptop is a Toshiba, and it came with a recovery disk (not a Windows disk).
What I've done to get closer to fixing it:
1. Ran Hijackthis, attached the log.
2. Attached a shorted CBS.log.
Could someone please help me!
hijackthis.log
sfcdetails.txt
Do more with
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
1. The machine had a virus at some point. A registry edit was able to "fix" the issue (I think).
<Not likely that a registry edit will do it for you>
2. I installed/ran Spybot, Symantec Antivirus, and Microsoft Security Essentials.
<Not likely that any of these would help with a 'repair' of an infection and I would run Symantec and MSE on the same machine>
I think you should start over with basic Malware repair as outlined here:
http://www.experts-exchange.com/A_1940.html (Basic Malware Troubleshooting)
http://www.experts-exchange.com/A_5124.html (Stop-the-Bleeding-First-A
http://www.experts-exchange.com/A_4922.html (Rogue-Killer-What-a-great
It will only take you a few minutes to read through the articles and about an hour to go through the entire scan/clean process.
Using one of the tools to stop the 'rogue processes' that malware creates is the first step in the clean/repair process.
<Not likely that a registry edit will do it for you>
2. I installed/ran Spybot, Symantec Antivirus, and Microsoft Security Essentials.
<Not likely that any of these would help with a 'repair' of an infection and I would run Symantec and MSE on the same machine>
I think you should start over with basic Malware repair as outlined here:
http://www.experts-exchange.com/A_1940.html (Basic Malware Troubleshooting)
http://www.experts-exchange.com/A_5124.html (Stop-the-Bleeding-First-A
http://www.experts-exchange.com/A_4922.html (Rogue-Killer-What-a-great
It will only take you a few minutes to read through the articles and about an hour to go through the entire scan/clean process.
Using one of the tools to stop the 'rogue processes' that malware creates is the first step in the clean/repair process.
After following the younghv advice, and per your HiJackthis logs, following entries needs to be fixed:
O23 - Service: @%SystemRoot%\system32\Alg
O23 - Service: @%SystemRoot%\system32\efs
O23 - Service: @%SystemRoot%\System32\net
O23 - Service: @%systemroot%\system32\psb
O23 - Service: @%systemroot%\system32\Loc
O23 - Service: @%SystemRoot%\system32\sam
O23 - Service: @%systemroot%\system32\spo
O23 - Service: @%SystemRoot%\system32\vau
O23 - Service: @%SystemRoot%\system32\vds
O23 - Service: @%systemroot%\system32\vss
Sudeep
O23 - Service: @%SystemRoot%\system32\Alg
O23 - Service: @%SystemRoot%\system32\efs
O23 - Service: @%SystemRoot%\System32\net
O23 - Service: @%systemroot%\system32\psb
O23 - Service: @%systemroot%\system32\Loc
O23 - Service: @%SystemRoot%\system32\sam
O23 - Service: @%systemroot%\system32\spo
O23 - Service: @%SystemRoot%\system32\vau
O23 - Service: @%SystemRoot%\system32\vds
O23 - Service: @%systemroot%\system32\vss
Sudeep
Once that is done I would also advice you if you a copy of you Symantec Antivirus then uninstall before installing the Service Pack 1. Once that is install, install the Symantec Antivirus afterwards.
I hope that would help
Sudeep
I hope that would help
Sudeep
As noted in this Article, there are several things that HijackThis cannot handle in a 64 bit architecture.
http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/A_3178-HijackThis-reports-missing-files-on-64-bit-Systems.html
There is no need to take any action in any of the above listed "023" entries.
http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/A_3178-HijackThis-reports-missing-files-on-64-bit-Systems.html
There is no need to take any action in any of the above listed "023" entries.
I ran the combo fix log, and here are the results. I'll look into that rogue killer hyperlink suggested by younghv.
Based on the combo fix log, should I take any additional steps?
ComboFix.txt
Based on the combo fix log, should I take any additional steps?
ComboFix.txt
The Rogue Killer didn't return any bad processes or tasks. I'm going to uninstall Symantec and try to do the SP1 update again.
Unionblitz,
RogueKiller is only the first step in the process.
After you run that, you immediately install and update Malwarebytes - then do a full scan.
Post your Malwarebytes log when you are through.
RogueKiller is only the first step in the process.
After you run that, you immediately install and update Malwarebytes - then do a full scan.
Post your Malwarebytes log when you are through.
20 minutes and still scanning, using the Malware tool (Full scan)... I will post the log up here when it's done.
Younghv, here is the anti-malware log. It doesn't look like anything malicious is running in the background (which is obviously a great thing). Please advice me on what to do next.
Thank you!
mbam-log-2011-05-15--15-08-03-.txt
Thank you!
mbam-log-2011-05-15--15-08-03-.txt
I agree - nothing bad showing up - and I agree that it is a great thing.
Have you tried downloading the actual SP1 "executable file and running that from your system?
As noted above, Symantec and SME could be conflicting - or - it could be the Symantec is/was blocking the install.
With all of your AV (temporarily) disconnected, try run SP1 from the website again.
If that doesn't work, download the executable and try running that.
Have you tried downloading the actual SP1 "executable file and running that from your system?
As noted above, Symantec and SME could be conflicting - or - it could be the Symantec is/was blocking the install.
With all of your AV (temporarily) disconnected, try run SP1 from the website again.
If that doesn't work, download the executable and try running that.
nope, the web version didn't work. I got the c004f01f error again. What should I do now? Download the SP1 onto my desktop, restart in safe mode, and try installing it that way?
Again, the scandisk will probably come up with additional errors. I don't think we ever addressed those errors. Is there any way to fix that?
Again, the scandisk will probably come up with additional errors. I don't think we ever addressed those errors. Is there any way to fix that?
That is a very common error (according to MS).
Their number one recommendation is to download and install the SP manually.
http://support.microsoft.com/kb/947366
Their number one recommendation is to download and install the SP manually.
http://support.microsoft.com/kb/947366
I've tried running the windows 7 sp1 file by itself on my machine, to no avail. I tried running those files to prime the machine for the windows updates, which fixed nothing.
I tried booting in recovery mode for Windows 7, and it couldn't find any issues with the setup.
I am wondering if the scan disk log is a good start as to what is wrong.
Help!
I tried booting in recovery mode for Windows 7, and it couldn't find any issues with the setup.
I am wondering if the scan disk log is a good start as to what is wrong.
Help!
Did you read the suggestions at the second MS link I posted?
MS have an actual SP trouble-shooter that you can use.
MS have an actual SP trouble-shooter that you can use.
yes, I ran that trouble shooter. I ran the preparer tool as well. Nothing is working... I might just reinstall windows soon. I can't get any windows update to install. Fun fun. :)
Before you reinstall the OS take a look at this article, Although it describes a different error code the suggestions should help>>
http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_update/unable-to-install-windows-7-service-pack-1-sp1-due/2859b00a-e472-e011-8dfc-68b599b31bf5?msgId=292ba7c6-e972-e011-8dfc-68b599b31bf5
As stated, please ensure you disable your AV, & ensure the laptop is connected to mains power & not battery.
Also ...
http://www.zdnet.com/blog/bott/microsoft-notes-windows-update-inconsistencies-provides-fix/3044
http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_update/unable-to-install-windows-7-service-pack-1-sp1-due/2859b00a-e472-e011-8dfc-68b599b31bf5?msgId=292ba7c6-e972-e011-8dfc-68b599b31bf5
As stated, please ensure you disable your AV, & ensure the laptop is connected to mains power & not battery.
Also ...
http://www.zdnet.com/blog/bott/microsoft-notes-windows-update-inconsistencies-provides-fix/3044
Its conceivable the laptop is still infected, so you may like to run another Malware scan before you attempt that last article.
Try Hitman Pro, a second opinion scanner:
Hitman Pro http://www.surfright.nl/en/hitmanpro
Also this ESET Online Scanner:
http://www.eset.com/online-scanner
Meanwhile i'll study the previous ComboFix log file ...
Try Hitman Pro, a second opinion scanner:
Hitman Pro http://www.surfright.nl/en/hitmanpro
Also this ESET Online Scanner:
http://www.eset.com/online-scanner
Meanwhile i'll study the previous ComboFix log file ...
Premium Content
You need an Expert Office subscription to comment.Start Free Trial