Cannot repair Windows update (wuauserv missing)

[Zorglab]

Bonjour (just to tell you I am french).

I use your program (All in one version) to try to repair Windows Update. Unfortunaltly, it does not work.
My PC is running Windows 7 (64 bit).
Malwarebytes found and correct some errors
Check disk run ok.

Looking in log files I found :
In file "windows_repair_hkey_local_machine_4_log" :
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wuauserv : 2 Le fichier spécifié est introuvable.
Translated in english : Specified file not found.
And in file "windows_repair_hkey_local_machine_services_4_log" :
HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\wuauserv : 2 Le fichier spécifié est introuvable.

I tried to access "manualy" this entrie in registry using regedit, and get error :
Translated :
Impossible to open wuauserv.
Details : Specified file does not exist.

Service "wuauserv" is listed (left column) bur cannot "open" it.

Do you have some advice to fix this problem before going to an new Windows install. 

Thnk you.
Zorglab

[Shane]

A virus deleted the service reg keys. But my repair puts those regkeys back.

Did you also do a system file check to make sure no files where removed by the virus as well? And when you run my repair tool have it run all the repairs and make sure to reboot after.

Shane

[Zorglab]

Thank you for your answer.
I ran system file check without error, ran your program (All in one version) with all option selected, and reboot was done.
I think registry is corrupted, I cannot have access to several keys using regedit, as your tool too.

Errors in log file "windows_repair_hkey_local_machine_4_log"

HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\WSearch : 2 Le fichier spécifié est introuvable.
HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\WSearchIdxPi : 2 Le fichier spécifié est introuvable.
HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\wuauserv : 2 Le fichier spécifié est introuvable.
HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\WudfPf : 2 Le fichier spécifié est introuvable.

Registry keys for above services are correct in "CurrentControlSet002"
Do you know some way to run Windows using this control set ?

Thank you again for your help.

Zorglab

[Shane]

You said that error is Specified file not found. Yet the repair is seeing them but when it goes to access them it cant.

Some viruses put symbolic links or junctions on files and regkeys. What that does it when you go to it you get redirected to a different location.

So see if you can manually delete those keys, when you do the junction gets deleted as well, then we can put those reg keys back

Shane

[Willy2]

Before (re-)installing Windows I would try if running a registry cleaner solves your problem. E.g. Eusing´s Free Registry Cleaner.
http://www.eusing.com/free_registry_cleaner/registry_cleaner.htm

[Zorglab]

I tried several softwares : no one detect and correct the problem.
Impossible to delete failing keys using regedit.
I am going to try to reboot my pc using "last good configuration" option.
I read it will try to use ControlSet002 (which seems to be good).
I will do it as soon I made all backups (just in case  )

Zorglab

[Shane]

You cant even delete the keys?

I would REALLY love to find out what the virus did to those keys so I could build some sort of fix for it.

Shane

[Willy2]

- Make sure you install Tweaking's Registry Backup. Then you can go back to a previous state of the registry. The program has saved my "computer bacon" about 10 times.

[Zorglab]

Belive it or not, but reading your last message give me some idea, and ... I fixed my problem.
I was thinking of what to send you to have a closer look at the problem.
When I export problem part of the failing directory (hklm\system\CurrentControlSet\Services)  in reg format, when I edit the created file, bad keys are not present. No reason to use it.
So I tried to export it in hive format. And made an re-import it into the registry.
And the registry is good again : bad keys are ok, Windows update service running, and Microsoft update on their way.

I found some kind of explanation here : http://cybercoyote.org/classes/registry/documents/20.html

"When you import a hive file to registry, Regedit will delete the key from the registry before importing
       it from hive file, unlike the registration files which will be merged with the current key in registry"
 
So good end  , and thank again for both of us to help me.
Zorglab

[Shane]

Excellent find!

So now what I need to do is fine a way for my repair to do that instead of using the reg files.

I have the API's to load and read hive files, but I need to see if there is an API for importing a hive file or if it is something that only the registry program can do.

Or if there is no API then I wonder if I can do it from a cmd.exe window like the rest of the repairs.
http://ss64.com/nt/reg.html

Shane

[Shane]

Question, by any chance did you do a registry backup with my windows repair before you fixed it? If so I would like to get the system hive file from that backup. That way I can look at the regkeys and see if I can find what the virus did to them so I can find a fix for it

Also do you still have the hive file you exported out? I would like that as well.

Once I find out what that virus did to those keys I want to find away around it and fix it and get it added to the windows repair as soon as possible

Shane

[Zorglab]

Sorry for the delay to answer your request.
Yes I still have backup made by your software. Which file do you want ?
I put "my" hive file imported, then exported here (cannot attach it to this post, because too big).

http://www1.zippyshare.com/v/14826556/file.html

Just by curiosity, why all registry repair program I ran, including yours, where not, at least, detecting the problem ?

Zorglab

[Shane]

The problem was very odd is why. The reg key where there but they where changed in such a way that nothing, not even the system could access or remove it or even change owner or permissions on them.

From what I have been researching I think the virus messed with the security descriptors. The hive file you exported should also have the security descriptors with it as well, so I want to see what it shows.

When you imported the hive file it replaced the regkeys and bypassed the security descriptors since it also tries to restore them. The registry is just a database after all and so your tricked worked because you found a way to get around the block the virus did.

So my goal now is to try and find what the virus changed and see if I can find a way to fix it without having to the the hive trick you did

Shane