Can't update Windows 10 Anniversary

simrick said:

Ugh - I hate that crap. Trojans, bringing more friends along for the ride....

Disk Mgmt looks okay.
Just so you know - once a system has had W10 installed on it (and activated), you can clean install W10 back on it as often as you like/need - so you don't have to do the W8>upgrade>W10 thing anymore. From the looks of your partitions, you did a clean install of W10, because I think a W8 install would have left a few more partitions on the drive, so I am a little confused(?) Unless you clean installed with a Win8.1Update - maybe that's why.

Do me a favor and run ADWCleaner, selecting Tools>Options and check all the reset options; see if it comes up with anything.


Attachment 102251

Might even want to check the box for prefetch as well.

Thanks Simrick. I just finished that step. No dice unfortunately. It did find a few minor things. but nothing to write home about. Re-tried again after that all completed and no dice. Still seeing that same error message. But just for your info, I have posted a copy of the ADW Cleaner log below;



# AdwCleaner v6.020 - Logfile created 19/09/2016 at 22:10:49
# Updated on 14/09/2016 by ToolsLib
# Database : 2016-09-20.1 [Server]
# Operating System : Windows 10 Home (X64)
# Username : Luke - LUKE
# Running from : Z:\FIREFOX DOWNLOADS\adwcleaner_6.020.exe
# Mode: Clean
# Support : ToolsLib - Forum: Ask for help or share your experience.



***** [ Services ] *****

***** [ Folders ] *****
[-] Folder deleted: C:\Users\Luke Berger\AppData\Local\MalwareProtectionLive
[-] Folder deleted: C:\Users\Luke Berger\AppData\Roaming\Systweak

***** [ Files ] *****
[-] File deleted: C:\Users\Luke Berger\AppData\Roaming\Mozilla\Firefox\Profiles\5i3ghlif.default\searchplugins\trovi.xml

***** [ DLL ] *****
***** [ WMI ] *****
***** [ Shortcuts ] *****
***** [ Scheduled Tasks ] *****
***** [ Registry ] *****
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
[-] Key deleted: HKU\S-1-5-21-4232256137-3942767270-2832098513-1001\Software\systweak
[#] Key deleted on reboot: HKCU\Software\systweak
[#] Key deleted on reboot: [x64] HKCU\Software\systweak
[-] Key deleted: HKU\S-1-5-21-4232256137-3942767270-2832098513-1001\Software\Microsoft\Internet Explorer\SearchScopes\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
[-] Key deleted: HKU\S-1-5-21-4232256137-3942767270-2832098513-1001\Software\Microsoft\Internet Explorer\SearchScopes\{95602BBF-1462-4DFA-A67A-CA6BC22DCDDA}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95602BBF-1462-4DFA-A67A-CA6BC22DCDDA}
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95602BBF-1462-4DFA-A67A-CA6BC22DCDDA}

***** [ Web browsers ] *****
[-] Chrome preferences cleaned: "browser.newtab.url" - "hxxp://www.trovi.com/?gd=&ctid=CT3333673&octid=EB_ORIGINAL_CTID&ISID=CC189085-F21C-491B-8002-F53EA1DBAEEB&SearchSource=69&CUI=&SSPV=&Lay=1&UM=8&UP=SPB315EC6B-EAF9-4555-8081-A552AB863FEE&D=081116"
[-] Chrome preferences cleaned: "keyword.URL" - "hxxps://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=994519&p="
[-] [C:\Users\Luke Berger\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\Luke Berger\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
*************************
:: "Tracing" keys deleted
:: Winsock settings cleared
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [2702 Bytes] - [19/09/2016 22:10:49]
C:\AdwCleaner\AdwCleaner[S0].txt - [3946 Bytes] - [19/09/2016 18:11:45]
C:\AdwCleaner\AdwCleaner[S1].txt - [2894 Bytes] - [19/09/2016 22:09:18]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2921 Bytes] ##########

simrick said:

Okay, so I am seeing remnants of trovi hijacker, MalwareProtectionLive rogue AV, Systweak, SearchScopes hijacker.

Were you able to perform a clean boot and try the DISM tool yet?
Next would be the repair install using an in-place upgrade as suggested earlier. That will allow you to keep all apps and files.

Hi Simrick,
I have had issues trying to perform a clean boot. Whenever I do, I lose use of my internet so it's kind of hard to update. I tried several times and leaving certain stuff active but no dice. I posted about that above, with screenshots of the System Config screen, and the programs I was shutting down.

Also, I tried the DISM tutorial but I couldn't get it to work. It wasn't accepting any of the commands it suggested. What that DISM page was telling me, and the commands that actually work didnt mesh. Also I didn't know what image file I should be using.

I was in my device management looking to uninstall some drivers. And I found this;






Then, I googled Athwbx.sys and found this. I'm gonna try the steps there and see if this helps;

http://windowsreport.com/athwbx-sys-windows-10/

LAPS said:

I was in my device management looking to uninstall some drivers. And I found this;






Then, I googled Athwbx.sys and found this. I'm gonna try the steps there and see if this helps;

http://windowsreport.com/athwbx-sys-windows-10/

OK. I did that. It seems the driver is now working properly, but all of a sudden I get this error message at startup. It seems Windows Defender stopped working

.

Update still doesn't work. I don't get why I'm getting this error now. If it's not one thing it's another.

Hi Simrick,
I'm really trying here. I did everything you said but the DISM tool is giving me heartache. This is what it shows this.



What am I doing wrong?

simrick said:

Yes, sorry, I see that. The Atheros would need to stay enabled in order to have internet in a clean boot.

The dism tool would need to be online, unless you have an install.WIM file to point it to on the the system. So, you'd want to use an ISO that is most recent. Right-click the ISO to mount, then note the location of the wim file (i.e. F:\sources\install.wim) and point the dism tool to it. If you have an ISO with install.ESD instead of install.WIM, it may not work.

EDIT: I've just re-read the whole thread, and wanted to make some additional observations, and ask some more questions:

You indicated that W8 installed fine, but W10 upgrade was a problem. In addition to what's already been mentioned, I do know that this will happen if hardware is failing/failed/problematic (could have been the wrls nic). Also, USB failures, memory failures - anything like that will prevent the install or upgrade.

Internet wasn't working well (pages slow to load and resetting) - has that resolved now that the Atheros driver has been repaired?

DISM can be done without internet (and that's probably how you want to do it now anyway):

Reset Internet Explorer.
Reset Chrome.
Check your HOSTS file for leftover changes from the infection.
Show hidden files; open with Notepad
C:\Windows\System32\Drivers\etc\HOSTS
Post it here in a code box (use # button) if you're not sure what you've got.

Put the system in a clean boot state. If you have ASUS AI Suite on the system, uninstall it. Also uninstall any 3rd-party AV, and hardware monitoring software (like Speccy, HDD Sentinel, etc.).

Have the ISO on the desktop - not the Z drive. Mount the ISO by right-clicking it and selecting MOUNT. Note the drive letter assigned to it, and the path to the install.wim file.

Disconnect your Z drive. Disable your wrls nic, and any ethernet nic you may have, in Device Manager. Also disable your USB hub. Disconnect all peripherals except keyboard, mouse and monitor. Open an admin command prompt and type the command (this is assuming the ISO is a wim-type, mounted to drive F):

Code:

DISM /online /cleanup-image /restorehealth /source:wim:F:\sources\install.wim:1 /limitaccess

Note the spaces preceding each forward slash. The limitaccess switch tells the tool to search locally for files needed in the wim you pointed it to, and not to look online. If your ISO has an install.esd instead of install.wim, use that and change the command accordingly.

Code:

DISM /online /cleanup-image /restorehealth /source:esd:F:\sources\install.esd:1 /limitaccess

If it still fails to run, it could be that the ISO is corrupt. If there is an error number, please post it. In this case, it may be best to download a new one from a known clean, functioning system.

If the tool doesn't run, I would be suspicious of the ISO being corrupt, and would get a good one before I proceeded with a repair install.

I think, if you can, you should try the repair install using an in-place upgrade. Again, the latest ISO would be best to use, and makes no difference if you have an ESD or WIM file for that.

OK. I did it all. Even the in place upgrade. The DISM tool worked, but didn't seem to fix anything, but the In-Place upgrade worked. By worked, I mean it installed, and created the Windows.Old file. Problem is now, my internet is back to slug mode. Also, I tried to run windows update again and it didn't work. Just the same error message again. When I opened up my case though I noticed it's full of dust (well, alot dustier than it ever has been). I'm going to clean it out tomorrow and hopefully at least might stop any of these phantom hardware issues, but IDK, that's alot of wishful thinking I bet.

But like I said, my internet is really slow again. This is what it shows at the bottom of each page when loading, and this is what it was showing before when it was slow. When it was working well for a few days there this wasn't happening.



I ran ADWCleaner and it came up with one threat c:\END or something like that. Other than that nothing at all. I almost want to just reformat everything and start clean but IDK if that would even work. At the least I want my quick internet back. I'm willing to sacrifice the new windows updates if I can get that back, but maybe you can still help. Please HELP.