Answered by:
Autoupdates not completing (were working) - now added "not genuine" message

Question
-
Autoupdate identifies updates, but when running stops at "0 KB total, 0% complete"
Any MS tools tried (eg WindowsUpdateAgent30-x64) fail when trying to download files during install.
Log error 80070002 relates to connection failure or corrupt download; have tried removing all old download and re-setting auto-update.
NEW message on screen today: "Windows 7 Build 7601 This copy of Windows is not genuine"
Output from MGADiag:
Diagnostic Report (1.9.0027.0): ----------------------------------------- Windows Validation Data--> Validation Code: 0x8004FE21 Cached Online Validation Code: N/A, hr = 0x8007041d Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7 Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34= Windows Product ID: 00359-OEM-8992687-00006 Windows Product ID Type: 2 Windows License Type: OEM SLP Windows OS version: 6.1.7601.2.00010300.1.0.003 ID: {9A81D316-5FFC-4E15-B45F-482280D46C6B}(1) Is Admin: Yes TestCab: 0x0 LegitcheckControl ActiveX: N/A, hr = 0x80070002 Signed By: N/A, hr = 0x80070002 Product Name: Windows 7 Home Premium Architecture: 0x00000009 Build lab: 7601.win7sp1_rtm.101119-1850 TTS Error: Validation Diagnostic: Resolution Status: N/A Vista WgaER Data--> ThreatID(s): N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 Windows XP Notifications Data--> Cached Result: N/A, hr = 0x80070002 File Exists: No Version: N/A, hr = 0x80070002 WgaTray.exe Signed By: N/A, hr = 0x80070002 WgaLogon.dll Signed By: N/A, hr = 0x80070002 OGA Notifications Data--> Cached Result: N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 OGAExec.exe Signed By: N/A, hr = 0x80070002 OGAAddin.dll Signed By: N/A, hr = 0x80070002 OGA Data--> Office Status: 100 Genuine Microsoft Office Home and Student 2007 - 100 Genuine OGA Version: N/A, 0x80070002 Signed By: N/A, hr = 0x80070002 Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005 Browser Data--> Proxy settings: N/A User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32) Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe Download signed ActiveX controls: Prompt Download unsigned ActiveX controls: Disabled Run ActiveX controls and plug-ins: Allowed Initialize and script ActiveX controls not marked as safe: Disabled Allow scripting of Internet Explorer Webbrowser control: Disabled Active scripting: Allowed Script ActiveX controls marked as safe for scripting: Allowed File Scan Data--> File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003 Other data--> Office Details: <GenuineResults><MachineData><UGUID>{9A81D316-5FFC-4E15-B45F-482280D46C6B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-1224988271-2596631285-3465386728</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire X1301</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>P01-A0</Version><SMBIOSVersion major="2" minor="5"/><Date>20090828000000.000000+000</Date></BIOS><HWID>950E3107018400F4</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>A42E8A07DB8B73C</Val><Hash>CPDpu47H4Twch6oj+xCw1TPXado=</Hash><Pid>81602-926-1582192-68769</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> Spsys.log Content: 0x80070002 Licensing Data--> C:\Windows\system32\slmgr.vbs(22, 1) Microsoft VBScript runtime error: ActiveX component can't create object: 'Scripting.Dictionary' Windows Activation Technologies--> HrOffline: 0x8004FE21 HrOnline: N/A HealthStatus: 0x0000000000008000 Event Time Stamp: 2:21:2011 17:55 ActiveX: Registered, Version: 7.1.7600.16395 Admin Service: Registered, Version: 7.1.7600.16395 HealthStatus Bitmask Output: Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui HWID Data--> HWID Hash Current: MAAAAAEAAwABAAEAAAACAAAAAQABAAEAeqi237oelpIAdcQtuBkMvoIyhhwaMBh5 OEM Activation 1.0 Data--> N/A OEM Activation 2.0 Data--> BIOS valid for OA 2.0: yes Windows marker version: 0x20001 OEMID and OEMTableID Consistent: yes BIOS Information: ACPI Table Name OEMID Value OEMTableID Value APIC ACRSYS ACRPRDCT FACP ACRSYS ACRPRDCT HPET ACRSYS ACRPRDCT MCFG ACRSYS ACRPRDCT SSDT PTLTD POWERNOW SLIC ACRSYS ACRPRDCT
Note this also includes the 80070002 errorSaturday, August 13, 2011 8:52 AM
Answers
-
"BeyondBeige" wrote in message news:907b7d5e-5e0f-4a51-8356-8fe5fdf5e202...
cl get the following reply:
C:\Users\Administrator>net start sppsvc The service is not responding to the control function.
I'll be honest not sure which service (name) SPPSVC is.
In Services control panel:
Software Protection is set to Automatic (delayed start) not started
SPP Notification Service is set to Manual startedIt’s the Software Protection Service (see the sc qc sppsvc result)There’s obviously something interfering with it – but I have no idea what, at the moment.See if the guys in Windows Updates have any suggestions for you – my next suggestion would be a repair install, if not.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth- Marked as answer by Darin Smith MS Monday, August 15, 2011 7:56 PM
Saturday, August 13, 2011 5:23 PMModerator
All replies
-
"BeyondBeige" wrote in message news:9c0eeff3-83d3-4cf1-8d6d-09d409451636...
Autoupdate identifies updates, but when running stops at "0 KB total, 0% complete"
Any MS tools tried (eg WindowsUpdateAgent30-x64) fail when trying to download files during install.
Log error 80070002 relates to connection failure or corrupt download; have tried removing all old download and re-setting auto-update.
NEW message on screen today: "Windows 7 Build 7601 This copy of Windows is not genuine"
Output from MGADiag:
Diagnostic Report (1.9.0027.0): ----------------------------------------- Windows Validation Data--> Validation Code: 0x8004FE21 Cached Online Validation Code: N/A, hr = 0x8007041d Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7 Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34= Windows Product ID: 00359-OEM-8992687-00006 Windows Product ID Type: 2 Windows License Type: OEM SLP Windows OS version: 6.1.7601.2.00010300.1.0.003 File Scan Data--> File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003 Spsys.log Content: 0x80070002 Licensing Data--> C:\Windows\system32\slmgr.vbs(22, 1) Microsoft VBScript runtime error: ActiveX component can't create object: 'Scripting.Dictionary'
Note this also includes the 80070002 errorYou have a couple of problems here which may or may not be related.1) the scripting error appears to result from an improperly registered SXH ..dll2) You have a Tampered sppsvc.exe file – which is the Software Protection Service.I hope that fixing the scripting problem will also fix the Service problem.try the followingOpen an Elevated Command Prompt windowat the prompt, typeregsvr32 scrrun.dllregsvr32 wshcon.dll(hit the Enter key at the end of each line) – you should get ‘success’ messages after each line.reboot.then run another MGADiag report and post the result.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothSaturday, August 13, 2011 11:06 AMModerator -
Hi Noel,
Re-registering the dll's (both completed successfully) and re-booting has cleared the "Windows...not genuine" message.
New MGADiag result:
Diagnostic Report (1.9.0027.0): ----------------------------------------- Windows Validation Data--> Validation Code: 0x8004FE21 Cached Online Validation Code: N/A, hr = 0x8007041d Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7 Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34= Windows Product ID: 00359-OEM-8992687-00006 Windows Product ID Type: 2 Windows License Type: OEM SLP Windows OS version: 6.1.7601.2.00010300.1.0.003 ID: {9A81D316-5FFC-4E15-B45F-482280D46C6B}(3) Is Admin: Yes TestCab: 0x0 LegitcheckControl ActiveX: N/A, hr = 0x80070002 Signed By: N/A, hr = 0x80070002 Product Name: Windows 7 Home Premium Architecture: 0x00000009 Build lab: 7601.win7sp1_rtm.101119-1850 TTS Error: Validation Diagnostic: Resolution Status: N/A Vista WgaER Data--> ThreatID(s): N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 Windows XP Notifications Data--> Cached Result: N/A, hr = 0x80070002 File Exists: No Version: N/A, hr = 0x80070002 WgaTray.exe Signed By: N/A, hr = 0x80070002 WgaLogon.dll Signed By: N/A, hr = 0x80070002 OGA Notifications Data--> Cached Result: N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 OGAExec.exe Signed By: N/A, hr = 0x80070002 OGAAddin.dll Signed By: N/A, hr = 0x80070002 OGA Data--> Office Status: 100 Genuine Microsoft Office Home and Student 2007 - 100 Genuine OGA Version: N/A, 0x80070002 Signed By: N/A, hr = 0x80070002 Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3 Browser Data--> Proxy settings: N/A User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32) Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe Download signed ActiveX controls: Prompt Download unsigned ActiveX controls: Disabled Run ActiveX controls and plug-ins: Allowed Initialize and script ActiveX controls not marked as safe: Disabled Allow scripting of Internet Explorer Webbrowser control: Disabled Active scripting: Allowed Script ActiveX controls marked as safe for scripting: Allowed File Scan Data--> File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003 Other data--> Office Details: <GenuineResults><MachineData><UGUID>{9A81D316-5FFC-4E15-B45F-482280D46C6B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-1224988271-2596631285-3465386728</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire X1301</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>P01-A0</Version><SMBIOSVersion major="2" minor="5"/><Date>20090828000000.000000+000</Date></BIOS><HWID>950E3107018400F4</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>A42E8A07DB8B73C</Val><Hash>CPDpu47H4Twch6oj+xCw1TPXado=</Hash><Pid>81602-926-1582192-68769</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> Spsys.log Content: 0x80070002 Licensing Data--> C:\Windows\system32\slmgr.vbs(22, 1) Microsoft VBScript runtime error: ActiveX component can't create object: 'Scripting.Dictionary' Windows Activation Technologies--> HrOffline: 0x8004FE21 HrOnline: N/A HealthStatus: 0x0000000000008000 Event Time Stamp: 2:21:2011 17:55 ActiveX: Registered, Version: 7.1.7600.16395 Admin Service: Registered, Version: 7.1.7600.16395 HealthStatus Bitmask Output: Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui HWID Data--> HWID Hash Current: MAAAAAEAAwABAAEAAAACAAAAAQABAAEAeqi237oelpIAdcQtuBkMvoIyhhwaMBh5 OEM Activation 1.0 Data--> N/A OEM Activation 2.0 Data--> BIOS valid for OA 2.0: yes Windows marker version: 0x20001 OEMID and OEMTableID Consistent: yes BIOS Information: ACPI Table Name OEMID Value OEMTableID Value APIC ACRSYS ACRPRDCT FACP ACRSYS ACRPRDCT HPET ACRSYS ACRPRDCT MCFG ACRSYS ACRPRDCT SSDT PTLTD POWERNOW SLIC ACRSYS ACRPRDCT
Saturday, August 13, 2011 1:33 PM -
"BeyondBeige" wrote in message news:7ff7e25b-eae7-4f55-ac39-d27cab959aa6...
Hi Noel,
Re-registering the dll's (both completed successfully) and re-booting has cleared the "Windows...not genuine" message.
New MGADiag result:
Diagnostic Report (1.9.0027.0): ----------------------------------------- Windows Validation Data--> Validation Code: 0x8004FE21 Cached Online Validation Code: N/A, hr = 0x8007041d Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7 Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34= Windows Product ID: 00359-OEM-8992687-00006 Windows Product ID Type: 2 Windows License Type: OEM SLP Windows OS version: 6.1.7601.2.00010300.1.0.003 File Scan Data--> File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003 Licensing Data--> C:\Windows\system32\slmgr.vbs(22, 1) Microsoft VBScript runtime error: ActiveX component can't create object: 'Scripting.Dictionary' Windows Activation Technologies--> HrOffline: 0x8004FE21 HrOnline: N/A HealthStatus: 0x0000000000008000 Event Time Stamp: 2:21:2011 17:55 ActiveX: Registered, Version: 7.1.7600.16395 Admin Service: Registered, Version: 7.1.7600.16395 HealthStatus Bitmask Output: Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
It shouldn’t have done – not with that report! :)What security software are you running?What happens if you do a ‘Clean Boot’? – try that, and run another MGADiag report.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothSaturday, August 13, 2011 2:04 PMModerator -
Got a nasty feeling, you're not going to like this... ;-)
System is running in "clean boot" state. Only non-MS services running were security/diag related, now cut these back to McAfee only (see below).Security: McAfee Internet Security Suite
Active security services: McShield; McAfee Validation Trust Protection Service
No (software) firewall active on pc {ADSL router has built-in firewall, but this should not be effecting MS updates - my Win7 laptop is running update without an issue}.
MGADiag report:
Diagnostic Report (1.9.0027.0): ----------------------------------------- Windows Validation Data--> Validation Code: 0x8004FE21 Cached Online Validation Code: N/A, hr = 0x8007041d Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7 Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34= Windows Product ID: 00359-OEM-8992687-00006 Windows Product ID Type: 2 Windows License Type: OEM SLP Windows OS version: 6.1.7601.2.00010300.1.0.003 ID: {9A81D316-5FFC-4E15-B45F-482280D46C6B}(3) Is Admin: Yes TestCab: 0x0 LegitcheckControl ActiveX: N/A, hr = 0x80070002 Signed By: N/A, hr = 0x80070002 Product Name: Windows 7 Home Premium Architecture: 0x00000009 Build lab: 7601.win7sp1_rtm.101119-1850 TTS Error: Validation Diagnostic: Resolution Status: N/A Vista WgaER Data--> ThreatID(s): N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 Windows XP Notifications Data--> Cached Result: N/A, hr = 0x80070002 File Exists: No Version: N/A, hr = 0x80070002 WgaTray.exe Signed By: N/A, hr = 0x80070002 WgaLogon.dll Signed By: N/A, hr = 0x80070002 OGA Notifications Data--> Cached Result: N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 OGAExec.exe Signed By: N/A, hr = 0x80070002 OGAAddin.dll Signed By: N/A, hr = 0x80070002 OGA Data--> Office Status: 100 Genuine Microsoft Office Home and Student 2007 - 100 Genuine OGA Version: N/A, 0x80070002 Signed By: N/A, hr = 0x80070002 Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3 Browser Data--> Proxy settings: N/A User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32) Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe Download signed ActiveX controls: Prompt Download unsigned ActiveX controls: Disabled Run ActiveX controls and plug-ins: Allowed Initialize and script ActiveX controls not marked as safe: Disabled Allow scripting of Internet Explorer Webbrowser control: Disabled Active scripting: Allowed Script ActiveX controls marked as safe for scripting: Allowed File Scan Data--> File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003 Other data--> Office Details: <GenuineResults><MachineData><UGUID>{9A81D316-5FFC-4E15-B45F-482280D46C6B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-1224988271-2596631285-3465386728</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire X1301</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>P01-A0</Version><SMBIOSVersion major="2" minor="5"/><Date>20090828000000.000000+000</Date></BIOS><HWID>950E3107018400F4</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>A42E8A07DB8B73C</Val><Hash>CPDpu47H4Twch6oj+xCw1TPXado=</Hash><Pid>81602-926-1582192-68769</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> Spsys.log Content: 0x80070002 Licensing Data--> C:\Windows\system32\slmgr.vbs(22, 1) Microsoft VBScript runtime error: ActiveX component can't create object: 'Scripting.Dictionary' Windows Activation Technologies--> HrOffline: 0x8004FE21 HrOnline: N/A HealthStatus: 0x0000000000008000 Event Time Stamp: 2:21:2011 17:55 ActiveX: Registered, Version: 7.1.7600.16395 Admin Service: Registered, Version: 7.1.7600.16395 HealthStatus Bitmask Output: Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui HWID Data--> HWID Hash Current: MAAAAAEAAwABAAEAAAACAAAAAQABAAEAeqi237oelpIAdcQtuBkMvoIyhhwaMBh5 OEM Activation 1.0 Data--> N/A OEM Activation 2.0 Data--> BIOS valid for OA 2.0: yes Windows marker version: 0x20001 OEMID and OEMTableID Consistent: yes BIOS Information: ACPI Table Name OEMID Value OEMTableID Value APIC ACRSYS ACRPRDCT FACP ACRSYS ACRPRDCT HPET ACRSYS ACRPRDCT MCFG ACRSYS ACRPRDCT SSDT PTLTD POWERNOW SLIC ACRSYS ACRPRDCT
Saturday, August 13, 2011 2:38 PM -
"BeyondBeige" wrote in message news:8b287710-740f-4081-bbc1-33a60de62eff...
Got a nasty feeling, you're not going to like this... ;-)
System is running in "clean boot" state. Only non-MS services running were security/diag related, now cut these back to McAfee only (see below).Security: McAfee Internet Security Suite
Active security services: McShield; McAfee Validation Trust Protection Service
No (software) firewall active on pc {ADSL router has built-in firewall, but this should not be effecting MS updates - my Win7 laptop is running update without an issue}.
I must admit I’m not a fan of either McAfee or Norton (please tell me that Norton has never ben installed on that machine?) but I don’t think it should cause this type of problem.McAfee ISS contains its own firewall – are you saying that it’s been switched off?Just in case there /is/ a malware problem, install Malwarebytes Anti-malware and run a quick scan (do NOT enable the real-time scanner when installing the free version) www.malwarebytes.org – delete everything it finds.Having said that, I’m pretty much convinced that the problem lies with the windows script host – and we have very little knowledge of that in this forum.I would suggest that you might want to try posting to the Windows Updates forum on Answers, where others are much more likely to be able to give some sensible answers :)That may or may not also solve the other problem of the tampered file/servicebefore you disappear that way, though – please post the results of the following commands in an Elevated Command Prompt window....sc qc sppsvc
sc queryex sppsvc
sc qprivs sppsvc
sc qsidtype sppsvc
sc sdshow sppsvc
as that may also give some pointers to the problem with the service/file
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothSaturday, August 13, 2011 3:45 PMModerator -
Snap I'm not an M&N fan either (friend's pc, I've been "asked" to look at). No sign of N having been on here, I think M waas only registered as it came OEM "free starter trial" style.
Yes M firewall turned off when update problem first spotted. Other sites can be connected to easily and downloaded from, but any MS updates/download which aren't directly user selected from a web page, don't complete (or, I suspect, even start).
I suspected something nasty initally; Malwarebytes is the first scanning tool I use, so this has been done and comes up clean (including full scan).
Results from your cl queries:
C:\Users\Administrator>sc qc sppsvc [SC] QueryServiceConfig SUCCESS SERVICE_NAME: sppsvc TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START (DELAYED) ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Windows\system32\sppsvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Software Protection DEPENDENCIES : RpcSs SERVICE_START_NAME : NT AUTHORITY\NetworkService C:\Users\Administrator>sc queryex sppsvc SERVICE_NAME: sppsvc TYPE : 10 WIN32_OWN_PROCESS STATE : 1 STOPPED WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x0 PID : 0 FLAGS : C:\Users\Administrator>sc qprivs sppsvc [SC] QueryServiceConfig2 SUCCESS SERVICE_NAME: sppsvc PRIVILEGES : SeAuditPrivilege : SeChangeNotifyPrivilege : SeCreateGlobalPrivilege : SeImpersonatePrivilege C:\Users\Administrator>sc qsidtype sppsvc [SC] QueryServiceConfig2 SUCCESS SERVICE_NAME: sppsvc SERVICE_SID_TYPE: UNRESTRICTED C:\Users\Administrator>sc sdshow sppsvc D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO CRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)(A;;LCRP;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCW DWO;;;WD) C:\Users\Administrator>
Saturday, August 13, 2011 4:43 PM -
"BeyondBeige" wrote in message news:b292d03a-cb45-4d40-8632-07a1de1858c9...
Snap I'm not an M&N fan either (friend's pc, I've been "asked" to look at). No sign of N having been on here, I think M waas only registered as it came OEM "free starter trial" style.
Yes M firewall turned off when update problem first spotted. Other sites can be connected to easily and downloaded from, but any MS updates/download which aren't directly user selected from a web page, don't complete (or, I suspect, even start).
I suspected something nasty initally; Malwarebytes is the first scanning tool I use, so this has been done and comes up clean (including full scan).
Results from your cl queries:
SERVICE_NAME: sppsvc TYPE : 10 WIN32_OWN_PROCESS STATE : 1 STOPPED WIN32_EXIT_CODE : 0 (0x0) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x0 PID : 0 FLAGS :
That all looks normal – except for the fact that the service is STOPPED (not too surprising if the file is tampered)what happens if you attempt to start it? – either using NET START SPPSVC or the Services Control panel?
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothSaturday, August 13, 2011 4:56 PMModerator -
cl get the following reply:
C:\Users\Administrator>net start sppsvc The service is not responding to the control function.
I'll be honest not sure which service (name) SPPSVC is.
In Services control panel:
Software Protection is set to Automatic (delayed start) not started
SPP Notification Service is set to Manual startedSaturday, August 13, 2011 5:15 PM -
"BeyondBeige" wrote in message news:907b7d5e-5e0f-4a51-8356-8fe5fdf5e202...
cl get the following reply:
C:\Users\Administrator>net start sppsvc The service is not responding to the control function.
I'll be honest not sure which service (name) SPPSVC is.
In Services control panel:
Software Protection is set to Automatic (delayed start) not started
SPP Notification Service is set to Manual startedIt’s the Software Protection Service (see the sc qc sppsvc result)There’s obviously something interfering with it – but I have no idea what, at the moment.See if the guys in Windows Updates have any suggestions for you – my next suggestion would be a repair install, if not.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth- Marked as answer by Darin Smith MS Monday, August 15, 2011 7:56 PM
Saturday, August 13, 2011 5:23 PMModerator