Windows 10 Update - seriously screwed up. (Maybe TDSS and friends?)

VirtualLarry

No Lifer
Aug 25, 2001
56,343
10,046
126
I've got a friend, who built his own PC (AM4 Ryzen 3 1200), out of parts I half gave/half sold him. This was not his first computer build, and I was guiding him over Skype the whole way. I thought that he did a fine job overall.

But nearly two years later, he's having tab crashes in Firefox, BSODs, and other such problems. Mostly, after upgrading to Win10 2004.

Which, I haven't specifically had much in the way of problems, with my 3+ AM4 rigs, and 2004. Except for my RX 5700 reference AMD drivers, which have steadily gotten much better over the last six months, and a lot more crash-proof.

I mailed him a new kit of DDR4-3200 RAM (Team Group, his existing RAM was DDR4-3000 GSKill), and after he put it in, he didn't have any more BSODs immediately after. (He was getting BSODs on boot!) So that was a positive sign.

Unfortunately, his Windows Update is screwed up. BADLY.

His OS install, was a nearly 8-year old Win7 64-bit installation, never re-installed fresh, that was backed up, restored onto a new Silicon Power 512GB SSD, and activated on the new AM4 hardware, and then upgraded in-place to Win10, either 1903 or 1909, at the time, I think. Then upgraded every time to the newer version of Win10.

Well, now, here's what is going on:
1) WIndows Update - when he goes there, it shows a bunch of items, that fail RIGHT AWAY, and then there's just a "Retry" button.
2) Media Creation Tool - I had him download this using Firefox, and then try to make a USB boot drive with Win10 20H2. Won't go. Gives error 0x8007007e right away, after doing GUI selections, like it simply won't enter the "download" phase.
3) Manually downloading the 2020-10 Cumulative Update for Win10 2004 x64 KB update from Windows Update Catalog, and attempting to install it. It goes, and then at the end, says "Failed installing Update". First time I've seen a manually-downloaded and locally-installed update fail to install. (OTOH, I just figured it out, the Cumulative Update, installs, and then downloads MORE, and then THAT installs. So maybe it was failing to download the rest of the update. That's probably it.)
4) Firefox works OK, he can browse. Firefox is most likely using DNS-over-HTTPS using CloudFlare as DNS provider. So Firefox isn't affected by router or local Windows DNS settings.
5) He can play online casino games using downloaded clients.
6) Malwarebytes installed the newest update, and runs, and doesn't find anything notable amiss.
7) Downloaded and installed Win10 2004 x64 "Servicing Stack Update". It is listed in Windows Update Catalog as a "Security Update", but when my friend ran it, it said that it was a "Standalone" installer for the "Servicing Stack", aka Windows Update Components in Windows 10. This installed OK, surprisingly enough, but can't be re-installed, and didn't help with the WU problem.
8) I tried before we hung up, setting the DNS manually for his ethernet connection, to 8.8.8.8. I also tried disabling IPv6. (separately) Didn't help.
9) DISM commands, say "no source files", even when using the "/Online" flag. A page I read on Windows Central about using DISM and SFC, said that DISM uses Windows Update to download components that are corrupted (it found corruption). But Windows Update doesn't work, we're trying to use DISM to FIX WU.
10) Also tried a BAT file from tenforums.com, to reset Windows Update and Re-register it's components. Run as Admin. Showed an ERROR most of the way through, but friend said that he couldn't scroll the Command Prompt window back up to read which component was erroring. (At the time, I suspected registry corruption, possibly a security descriptor on a registry entry got corrupted, and wouldn't allow access any more.)

He claims that WU stopped working, and the OS started crashing, around the time of the Win10 2004 upgrade. Here's what I think happened. His RAM turned bad, and the Win10 2004 upgrade re-wrote many system binaries on his drive, and they ended up corrupted. (I had suspected a failing SSD, but after replacing the RAM fixed his boot BSODs, apparently, I decided to somewhat discount this idea.)

This "broke" Windows Update.

Something seems to strongly indicate, that Windows Update just can't seem to get online, for some reason.

But Firefox gets online, and so does his online gaming clients.

I had him re-boot his Asus AC66U router, which may not have up-to-date firmware. I was wonder if it were hacked, and Windows Update was being denied/re-directed, somehow, by some "DNS malware" that had infected his router. (He goes to "movie sites", which I've warned him about.)

So, either RAM corruption, before a Windows Upgrade, caused corrupted binaries to be installed (and DISM and SFC both DO complain, so that may be the legit reason), and replacing the RAM will hopefully allow resolution, or he has some really bad and really secretive malware from going to "bad" sites, and not always keeping up on updates. Either is possible, or maybe even both.

I was going to mail him a USB boot drive with Win10 20H2 x64 on it, and a fresh new SSD, in case that he wants to attempt a fresh installation onto a new SSD. Another possibility, is booting the USB, and doing an over-top re-install upgrade of Win10 (I think that's still possible, right?).

Any suggestions? I web-searched the MCT error, and couldn't come up with an exact match.

Edit: Hmm, maybe it is malware. Apparently, this is one of the signs of a TDSS infection?
 
Last edited:

Maxima1

Diamond Member
Jan 15, 2013
3,515
756
146
I've got a friend, who built his own PC (AM4 Ryzen 3 1200), out of parts I half gave/half sold him. This was not his first computer build, and I was guiding him over Skype the whole way. I thought that he did a fine job overall.

But nearly two years later, he's having tab crashes in Firefox, BSODs, and other such problems. Mostly, after upgrading to Win10 2004.

[/snip]

I would just do a fresh install. It actually goes pretty fast even if he hasn't kept tabs on what is on the computer. A screwed up OS can still remain corrupted even after many attempts at resolving it. He'll probably sink much more time into doing that.
 

VirtualLarry

No Lifer
Aug 25, 2001
56,343
10,046
126
Thing is, he would lose his Skype history and browser URL history for the last umpteen years.

That may be the only realistic ultimate solution here, though, if I can't get it resolved.
 

jmagg

Platinum Member
Nov 21, 2001
2,022
357
126
Still sounds like ram or a bad slot. Try a minimal amount of ram in all slots?
 

VirtualLarry

No Lifer
Aug 25, 2001
56,343
10,046
126
I don't know know of any way to back up the Skype history, really. It's encrypted, and I believe on a per-instance (per-installation) basis.

The Firefox bookmarks could be saved, but I don't know about the typed URL history. I guess I could look into that.

As far as bad RAM, you think that the new RAM is bad too? How would bad RAM keep WU off of the internet altogether? I really believe that it sounds more like some sort of malware to me.

I tried last night to get him to do another tech-support session with me, maybe I could remote into his PC and run TDSSKiller and Hitman Pro.
 

jmagg

Platinum Member
Nov 21, 2001
2,022
357
126
I don't know know of any way to back up the Skype history, really. It's encrypted, and I believe on a per-instance (per-installation) basis.

The Firefox bookmarks could be saved, but I don't know about the typed URL history. I guess I could look into that.

As far as bad RAM, you think that the new RAM is bad too? How would bad RAM keep WU off of the internet altogether? I really believe that it sounds more like some sort of malware to me.

I tried last night to get him to do another tech-support session with me, maybe I could remote into his PC and run TDSSKiller and Hitman Pro.
Could be a bad slot or controller going bad. I'm not saying this is so, but i have experienced very strange/tough to diagnose symptoms from ram errors. I suppose a full overnight Memtest (or an equivalent) would rule it out completely.
 

VirtualLarry

No Lifer
Aug 25, 2001
56,343
10,046
126
Could be a bad slot or controller going bad. I'm not saying this is so, but i have experienced very strange/tough to diagnose symptoms from ram errors. I suppose a full overnight Memtest (or an equivalent) would rule it out completely.
I'm not saying that you're wrong, but I would think that "bad RAM" would manifest itself in a number of ways, including crashing / BSODs / appcrashes (tab crashes in browser). All of which he was getting on his system, including BSODs right after boot, UNTIL he swapped out the RAM with a fresh new kit that I sent him.

But Windows Update still isn't working, and I've tried a BAT from tenforums, to reset winsock and re-register Windows Update component DLLs, I've had him manually download the "Servicing Stack Update" from Windows Update Catalog, and install that, which should have refreshed the Windows Update component binaries, at least. Still doesn't work.

Even Media Creation Tool doesn't work, nor does DISM /Online commands. All of which, use Windows Update mechanisms to access the internet. Yet, his browser and online gaming clients can access the internet fine.

I tried setting the DNS server in IPv4 properties for his ethernet card, to 8.8.8.8, and tried disabling IPv6, and re-enabling it, disabling/re-enabling the NIC after changes, etc., and even had him reboot his router. Still, no-go.

So at this point, I feel like I've exhausted most of the solutions for "simple" Windows Update fixes (including running trouble-shooter), and it seems more apparent to me now that something is actively blocking Windows Update, such as a TDSS rootkit (which evidently does block WU, through a driver).
 

VirtualLarry

No Lifer
Aug 25, 2001
56,343
10,046
126
No, but that's a really good idea. Maybe I can do some remote access to his PC and check up on a few things like that. He's not technical enough to attempt that over the phone.

When I told him about re-installing Win10, he was like "does that mean, that I need to re-install like the chipset drivers and the AMD drivers and my poker program"? Me: "Yep". Him: "Yeah, let's hold off on that for a while..."
 

mxnerd

Diamond Member
Jul 6, 2007
6,799
1,101
126
Whenever system got BSOD, unexpected sudden shutdown, file corruptions, etc., you should always check Event Viewer first see if there were some sort of errors.
 

Steltek

Diamond Member
Mar 29, 2001
3,042
753
136
@VirtualLarry, when the Malwarebytes scan was run, was the option to scan for rootkits turned on? It is normally disabled by default because it greatly increases scan times (I believe you have to go in to the Malwarebytes settings cog under the security tab to activate it).

It also might be a good idea to go ahead and create and send a Kaspersky rescue disk media with the other stuff you are sending him so he can try to do an offline scan of the Windows installation for malware.
 

VirtualLarry

No Lifer
Aug 25, 2001
56,343
10,046
126
I did have him enable the "Rootkit Scan" option under the Security settings, before doing the scan.
 

Steltek

Diamond Member
Mar 29, 2001
3,042
753
136
If there is no malware infection, it might be worth running a CHKDSK session in read only mode to see if there is any file system corruption. If you stick to read only mode, it should error out if it encounters any so it won't affect his use of the system.

Another possibility, is booting the USB, and doing an over-top re-install upgrade of Win10 (I think that's still possible, right?).

If you do it this way, he will end up with a clean Windows 10 install with the old version dropped into a Windows.old file.

If he wants to try to retain his current install, he'd be better off running the setup.exe file off the USB media to get the repair install instead. Of course, that also means if there is malware he'd end right back up where he started.
 
Last edited:
  • Like
Reactions: VirtualLarry