Tech Support Guy banner
Status
Not open for further replies.
41 - 60 of 159 Posts

·
Administrator
Joined
·
124,121 Posts
Discussion Starter · #41 ·
I've checked with a Moderator and a Trusted Advisor both running Windows 8.1 Pro and the same two files are not signed on their machines either. I know some are and some aren't and don't the reason why but everything is working now as it should and I know it's not malware-related so I'm going to hold off for the time being running SFC and DISM mainly because it's annoying to have to wait so long for them to complete and having to run SFC multiple times. I will be getting a new computer in a year anyway.

Thanks again Panos for your help with this matter. :)
 

·
Trusted Advisor & Malware Specialist
Joined
·
4,053 Posts
Glad everything is working now. :)

As for those files, I don't know what is happening (that's something we are searching about it), but in any case they have to be digitally signed.

DISM/SFC don't take so much. Not more than an hour, both of them. And absolutely there is no need to run SFC multiple times.
 

·
Administrator
Joined
·
124,121 Posts
Discussion Starter · #43 ·
that's something we are searching about it
Do you have someone looking into it further for me? If so thanks for that.

I've been told it's sometimes necessary to run SFC more than once as it may not be able to fix everything in the first run. But I'm not there yet anyway, we'll see if it finds anything first.
 

·
Trusted Advisor & Malware Specialist
Joined
·
4,053 Posts
Do you have someone looking into it further for me? If so thanks for that.
Yes, and it's something I would like to know the cause. :)

SFC will not fix more things when is executed several times in a row. In the case the result is "Windows Resource Protection found corrupt files and successfully repaired them", you may want to check if a second run would result to this: "Windows resource protection did not find any integrity violations".
 

·
Administrator
Joined
·
124,121 Posts
Discussion Starter · #46 · (Edited)
BTW, if it might help finding the cause I will tell you the only discrepancies between the registry fixes and my own registry entries. I am quite familiar with the registry and have helped many people with registry fixes during my malware removal days so I used a hex editor to compare them. Only the Windows_Update one had two discrepancies.

Under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv
Mine:
"RequiredPrivileges"=SeAuditPrivilege SeCreateGlobalPrivilege SeCreatePageFilePrivilege SeTcbPrivilege SeAssignPrimaryTokenPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege
instead of:
"RequiredPrivileges"=SeAuditPrivilege SeCreateGlobalPrivilege SeCreatePageFilePrivilege SeTcbPrivilege SeAssignPrimaryTokenPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeShutdownPrivilege

Mine was missing the last one that I have bolded above.

and Under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters
Mine:
My "ServiceDll"=C:\WINDOWS\system32\wuaueng.dll
instead of:
My "ServiceDll"=%systemroot%\system32\wuaueng.dll

Those are the only two differences in all of the three registry fixes. I ran them all even though the last two were identical to mine.
 

·
Trusted Advisor & Malware Specialist
Joined
·
4,053 Posts
Thanks, Karen.

As I understand is that the possible problem has to do with the specific files and not necessarily with the related services. I will keep you informed.
 

·
Administrator
Joined
·
124,121 Posts
Discussion Starter · #48 ·
As I understand is that the possible problem has to do with the specific files and not necessarily with the related services. I will keep you informed.
Thanks. It didn't detect the Window Defender Update this morning. :( I had it set to download but let me choose whether to install them.
 

·
Administrator
Joined
·
124,121 Posts
Discussion Starter · #49 ·
So I bit the bullet and ran SFC and it found problems. This was the report:

Microsoft Windows [Version 6.3.9600]

(c) 2013 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>sfc /scannow
Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection found corrupt files but was unable to fix some
of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not
supported in offline servicing scenarios.

I looked at the CBS log and didn't see any reference to corrupt files in the report.

So I ran DISM and it fixed something:

Microsoft Windows [Version 6.3.9600]

(c) 2013 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>DISM /Online /Cleanup-Image /RestoreHealth
Deployment Image Servicing and Management tool
Version: 6.3.9600.19408
Image Version: 6.3.9600.19397

[==========================100.0%==========================]

The restore operation completed successfully. The component store corruption was repaired.

The operation completed successfully.

I then ran SFC again and it no longer found any issues. However, those two file remain unsigned.
 

·
Trusted Advisor & Malware Specialist
Joined
·
4,053 Posts
Microsoft updated the instructions for SFC to include the recommendation to run DISM first. From Use the System File Checker tool to repair missing or corrupted system files:

If you are running Windows 10, Windows 8.1 or Windows 8, first run the inbox Deployment Image Servicing and Management (DISM) tool prior to running the System File Checker.
Actually, DISM will restore the image of the operating system, through which the SFC command will run to recover the corrupted files.

It's good that the corruptions are fixed.
 

·
Administrator
Joined
·
124,121 Posts
Discussion Starter · #51 ·
Thanks Panos. it seems it's not working again. I see an error in the Event Viewer that the WU service is stopping.

Log Name: System
Source: Service Control Manager
Date: 2021-11-02 6:51:09 AM
Event ID: 7034
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Cookie-PC
Description:
The System Update service terminated unexpectedly. It has done this 1 time(s).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7034</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2021-11-02T10:51:09.959725900Z" />
<EventRecordID>256535</EventRecordID>
<Correlation />
<Execution ProcessID="616" ThreadID="3028" />
<Channel>System</Channel>
<Computer>Cookie-PC</Computer>
<Security />
</System>
<EventData>
System Update
1
<Binary>5300550053006500720076006900630065000000</Binary>
</EventData>
</Event>
 

·
Trusted Advisor
Joined
·
25,955 Posts
Hope you do not mind me posting on this thread
I am puzzled you say
I checked to make sure I had the proper version of the Windows Update Agent (KB2919355) installed by verifying the version of the wuadeng.dll file and it was version 7.9.9600.19915 that was last updated on December 14, 2020 which seems to be the correct one.
The latest version of the Windows Update Agent for Windows 8.1 is 7.9.9600.16422. as of September this year
Update Windows Update Agent to latest version - Windows Client | Microsoft Docs

albeit the version shown can be confusing as different versions are listed on different aspects of the update components in windows.

I would however recommend if you have NOT done so that you check you have the latest version by either configuring automatic updates which will check itself and install the latest version

To download the Windows Update Agent automatically, follow these steps:

  1. Turn on automatic updating. Follow these steps, for the version of Windows that you are running.
    • Windows 8.1 or Windows 8
      1. Open Windows Update by swiping in from the right edge of the screen (or, if you're using a mouse, pointing to the lower-right corner of the screen and moving up the mouse pointer), tapping or clicking Settings, tapping or clicking Control Panel, and then tapping or clicking Windows Update.
      2. Tap or click Change settings.
      3. Under Important updates, choose Install updates automatically.
      4. Under Recommended updates, select the Give me recommended updates the same way I receive important updates check box, and then select OK.

OR installing it manually from the link
 

·
Trusted Advisor & Malware Specialist
Joined
·
4,053 Posts
Hi, Karen.

It seems that those two files in the FSS log were shown as un-signed due to a FSS bug. According to Farbar this has been fixed.

You can run the FSS now and post here the new log.

In addition, I recommend you to run the Windows Update Troubleshooter.

Read the first part of this article to see how to run the Troubleshooter, if you didn't already run it. :)
How to Fix Windows Update When It Gets Stuck or Frozen (howtogeek.com)
 

·
Trusted Advisor
Joined
·
25,955 Posts
Look please at the link in post 52
where you will see this
The latest version of the Windows Update Agent for Windows 8.1 is 7.9.9600.16422.
as of September this year.
If the link details are correct then how you get that listing on your screenshot for yours is a puzzle to me at this time.
If the Mod has 8.1 running and can check his it would save me having to swap drives again
The 8.1 drive is not even in the tower as is triple boot with 11, 10 and Linux.

and leaving the other drive in makes the boot procedure too complicated to configure, as the 8.1 also has Linux
 
41 - 60 of 159 Posts
Status
Not open for further replies.
Top