Hijackthis log - Win7 SP1 Issues

Unionblitz
Unionblitz used Ask the Experts™
on
Good afternoon,

I am unable to upgrade to Windows 7 SP1- I get a C004F01F error.  I really would like to get SP1 on this machine, and remove anything malicious that might still be on it (without doing a system reinstall).

This machine is used for work, and it's imperative that work-related files/programs installed remain intact if I have to do a recovery/reinstall.

Some background:
1. The machine had a virus at some point.  A registry edit was able to "fix" the issue (I think).
2. I installed/ran Spybot, Symantec Antivirus, and Microsoft Security Essentials.  
3. I am unable to install Win7 SP1. I keep getting a C004F01F error.
4. I ran a scan disk, and came up with several problems (not fixable).
5. The laptop is a Toshiba, and it came with a recovery disk (not a Windows disk).

What I've done to get closer to fixing it:
1. Ran Hijackthis, attached the log.
2. Attached a shorted CBS.log.

Could someone please help me!
hijackthis.log
sfcdetails.txt
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Author of the Year 2011
Top Expert 2006
Commented:
1. The machine had a virus at some point.  A registry edit was able to "fix" the issue (I think).
<Not likely that a registry edit will do it for you>
2. I installed/ran Spybot, Symantec Antivirus, and Microsoft Security Essentials.  
<Not likely that any of these would help with a 'repair' of an infection and I would run Symantec and MSE on the same machine>

I think you should start over with basic Malware repair as outlined here:

http://www.experts-exchange.com/A_1940.html (Basic Malware Troubleshooting)
http://www.experts-exchange.com/A_5124.html (Stop-the-Bleeding-First-Aid-for-Malware)
http://www.experts-exchange.com/A_4922.html (Rogue-Killer-What-a-great-name)

It will only take you a few minutes to read through the articles and about an hour to go through the entire scan/clean process.

Using one of the tools to stop the 'rogue processes' that malware creates is the first step in the clean/repair process.
Sudeep SharmaTechnical Designer

Commented:
After following the younghv advice,  and per your HiJackthis logs, following entries needs to be fixed:
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)

Sudeep
Sudeep SharmaTechnical Designer

Commented:
Once that is done I would also advice you if you a copy of you Symantec Antivirus then uninstall before installing the Service Pack 1. Once that is install, install the Symantec Antivirus afterwards.

I hope that would help

Sudeep
11/26 Forrester Webinar: Savings for Enterprise

How can your organization benefit from savings just by replacing your legacy backup solutions with Acronis' #CyberProtection? Join Forrester's Joe Branca and Ryan Davis from Acronis live as they explain how you can too.

Author of the Year 2011
Top Expert 2006

Commented:
As noted in this Article, there are several things that HijackThis cannot handle in a 64 bit architecture.
http://www.experts-exchange.com/Virus_and_Spyware/HijackThis/A_3178-HijackThis-reports-missing-files-on-64-bit-Systems.html

There is no need to take any action in any of the above listed "023" entries.

Author

Commented:
I ran the combo fix log, and here are the results.  I'll look into that rogue killer hyperlink suggested by younghv.

Based on the combo fix log, should I take any additional steps?
ComboFix.txt

Author

Commented:
The Rogue Killer didn't return any bad processes or tasks.  I'm going to uninstall Symantec and try to do the SP1 update again.
Author of the Year 2011
Top Expert 2006

Commented:
Unionblitz,
RogueKiller is only the first step in the process.
After you run that, you immediately install and update Malwarebytes - then do a full scan.

Post your Malwarebytes log when you are through.

Author

Commented:
20 minutes and still scanning, using the Malware tool (Full scan)... I will post the log up here when it's done.

Author

Commented:
*anti-malware (malwarebytes)

Author

Commented:
Younghv, here is the anti-malware log.  It doesn't look like anything malicious is running in the background (which is obviously a great thing).  Please advice me on what to do next.

Thank you!
mbam-log-2011-05-15--15-08-03-.txt
Author of the Year 2011
Top Expert 2006

Commented:
I agree - nothing bad showing up - and I agree that it is a great thing.

Have you tried downloading the actual SP1 "executable file and running that from your system?

As noted above, Symantec and SME could be conflicting - or - it could be the Symantec is/was blocking the install.

With all of your AV (temporarily) disconnected, try run SP1 from the website again.
If that doesn't work, download the executable and try running that.

Author

Commented:
Installing from web (Windows Updates)...  Hopefully this will work! *fingers crossed*
Author of the Year 2011
Top Expert 2006

Commented:
Concur!
X'd

Author

Commented:
nope, the web version didn't work.  I got the c004f01f error again. What should I do now? Download the SP1 onto my desktop, restart in safe mode, and try installing it that way?

Again, the scandisk will probably come up with additional errors.  I don't think we ever addressed those errors.  Is there any way to fix that?
Author of the Year 2011
Top Expert 2006

Commented:
That is a very common error (according to MS).

Their number one recommendation is to download and install the SP manually.

http://support.microsoft.com/kb/947366
Author of the Year 2011
Top Expert 2006

Commented:

Author

Commented:
I've tried running the windows 7 sp1 file by itself on my machine, to no avail.  I tried running those files to prime the machine for the windows updates, which fixed nothing.

I tried booting in recovery mode for Windows 7, and it couldn't find any issues with the setup.

I am wondering if the scan disk log is a good start as to what is wrong.

Help!
Author of the Year 2011
Top Expert 2006

Commented:
Did you read the suggestions at the second MS link I posted?
MS have an actual SP trouble-shooter that you can use.

Author

Commented:
yes, I ran that trouble shooter. I ran the preparer tool as well. Nothing is working... I might just reinstall windows soon. I can't get any windows update to install. Fun fun. :)

Commented:
Before you reinstall  the OS take a look at this article,  Although it describes a different error code the suggestions should help>>
http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_update/unable-to-install-windows-7-service-pack-1-sp1-due/2859b00a-e472-e011-8dfc-68b599b31bf5?msgId=292ba7c6-e972-e011-8dfc-68b599b31bf5

As stated, please ensure you disable your AV, & ensure the laptop is connected to mains power & not battery.

Also ...
http://www.zdnet.com/blog/bott/microsoft-notes-windows-update-inconsistencies-provides-fix/3044

Commented:
Its conceivable the laptop is still infected, so you may like to run another Malware scan before you attempt that last article.

Try Hitman Pro, a second opinion scanner:
Hitman Pro http://www.surfright.nl/en/hitmanpro

Also this ESET Online Scanner:
http://www.eset.com/online-scanner 

Meanwhile i'll study the previous ComboFix log file ...

Commented:
Apart from the "Other Deletions" and "Orphans removed" lists in the CF log file, there does not appear to be any other infection ...but still advise you re-scan as suggested above.

Author

Commented:
I was unable to resolve this problem. However, this was the closest solution.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial