Windows 10: Can't update Windows 10 Anniversary

I fully deleted the partition, and re-formatted the hard drive. However, I had downloaded the virus to my STORAGE drive which I did not format. I deleted the file, and did a quick scan but nothing turned up. But maybe that could be it.. It was definitely a very nasty little virus that basically decommissioned my computer in about 5 seconds. As soon as I realized what it was I just crashed my SSD drive and started over. I'm running that SFC /scannow tool right now, first time I've ever tried that. I'll let you know if anything turns up.

SCAN COMPLETED: NO INTEGRITY VIOLATIONS FOUND

 

I didn't format just clean out drivers and drives before install.

 

Some other tips before upgrading Windows are to uninstall any 3rd party antivirus programs (i.e. use Defender), turn off Secure Boot, disable Fast Startup, disconnect external drives and run sfc / scannow to check/repair system files. You should also back up your working system before upgrading (using Macrium Refelect?) but since you had a virus this wouldn't have been a good idea.

Have you tried running the compatibility wizard on the offending Cubase program?

 

Yes it worked fine in build 1511, but am not entirely sure what causes the crash, which plugin...it's likely these anti-piracy systems, each program has their own either on USB stick like Steinberg and waves respectively, or use iLok, or have their own proprietary anti piracy systems.

Bleeding super difficult they are, licenses and their functioning always give me gray hairs. It's crazy that pirated software would work ten times better and not big down the machine and cause monthly issues with licenses not loading or machine or Windows updates rendering some serial incompatible or whatever. Almost enough to make me turn to piracy. I am not at all surprised piracy is so popular, it's so much more accessible, dependable and easy to use pirated software than legit ones.

 

So you reformatted, and you've got the Anniversary Update installed now? And Windows Update doesn't work on it? Have you run a complete scan on the storage drive and checked the number of partitions on it (including hidden partitions)?
Do you have the name/identification of the infection? What exactly did it do to the system? Was it a worm?
Have you tried this?
Windows Update - Reset in Windows 10 - Windows 10 Forums

The in-place repair may do it.

 

I scanned it previously using Windows Defender, and I just re-scanned it now. No infections found at all.

Regarding the virus I had, or whatever it was, it was nasty. It fully changed my browser to a completely different program. I tried to run some cleanup software on it, and I thought it worked but 10 minutes later all the programs I had removed or uninstalled were back again. I couldn't even really do anything on the internet and I sure as hell wasn't going to use that browser.

It all started when I was trying to play a downloaded video file, and there was a .txt file saying to run with WinMediaPlayer, and it will automatically update the codecs. I was skeptical but I threw caution to the wind and started the file with Windows Media Player. It almost immediately started installing software on my computer and I to proceed through different warnings 2 or 3 times. Obviously, at that point I was infested, and as soon as I realized that I would probably never get rid of it with my abilities, i put in my WIN8 disk, deleted the partitions and started fresh.

At that point, after I installed my motherboard drivers and tried to update to WIN10. It wouldn't work. I couldn't update Windows 8, I was getting the same error message. But I thought, no big deal. The last time I did this I had issues updating as well and I got it fixed. But this time I couldn't get it to allow me to update. I tried for about a week then threw in the towel and called Microsoft to help me update to WIN10 Home. At first. everything seemed fine, but here and there I have been having issues I didn't have before, or problems installing different software (Like Microsoft Office). Or often now, it seems my internet isn't working well (pages loading very slowly, before they would all seem to flash up super quick). I've used the speedtest.net site several different occasions, and it says I'm downloading at 15-16mbps, and uploading between 2-3mbps which is pretty normal. So I thought, maybe I just need to update WIN10. But no dice, it sometimes says there are no updates when there clearly are. When I re-try I get the error message 0x8024401C.

As for my storage drive I have pretty much left that alone (There is only 1 partition. And since the re-format I have seen no traces of the infection so I'm pretty confident its gone. At least I hope so. If not it seems undetectable.
--
As of now, I just did this; Windows Update - Reset in Windows 10 - Windows 10 Forums. I restarted my computer, tried the update. No dice. I am now going to do a clean boot and try the DISM tool. Hopefully that will work. And if not I will try the in-place repair, but I don't feel confident either of those will work, but it sure beats a re-format.

As for my drives/partitions, I have attached a snapshot of my disk management screen. Let me know if anything seems unusual;

 

Ugh - I hate that crap. Trojans, bringing more friends along for the ride....

Disk Mgmt looks okay.
Just so you know - once a system has had W10 installed on it (and activated), you can clean install W10 back on it as often as you like/need - so you don't have to do the W8>upgrade>W10 thing anymore. From the looks of your partitions, you did a clean install of W10, because I think a W8 install would have left a few more partitions on the drive, so I am a little confused(?) Unless you clean installed with a Win8.1Update - maybe that's why.

Do me a favor and run ADWCleaner, selecting Tools>Options and check all the reset options; see if it comes up with anything.






Might even want to check the box for prefetch as well.

 

Thanks Simrick. I just finished that step. No dice unfortunately. It did find a few minor things. but nothing to write home about. Re-tried again after that all completed and no dice. Still seeing that same error message. But just for your info, I have posted a copy of the ADW Cleaner log below;



# AdwCleaner v6.020 - Logfile created 19/09/2016 at 22:10:49
# Updated on 14/09/2016 by ToolsLib
# Database : 2016-09-20.1 [Server]
# Operating System : Windows 10 Home (X64)
# Username : Luke - LUKE
# Running from : Z:\FIREFOX DOWNLOADS\adwcleaner_6.020.exe
# Mode: Clean
# Support : ToolsLib - Forum: Ask for help or share your experience.



***** [ Services ] *****

***** [ Folders ] *****
[-] Folder deleted: C:\Users\Luke Berger\AppData\Local\MalwareProtectionLive
[-] Folder deleted: C:\Users\Luke Berger\AppData\Roaming\Systweak

***** [ Files ] *****
[-] File deleted: C:\Users\Luke Berger\AppData\Roaming\Mozilla\Firefox\Profiles\5i3ghlif.default\searchplugins\trovi.xml

***** [ DLL ] *****
***** [ WMI ] *****
***** [ Shortcuts ] *****
***** [ Scheduled Tasks ] *****
***** [ Registry ] *****
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
[-] Key deleted: HKU\S-1-5-21-4232256137-3942767270-2832098513-1001\Software\systweak
[#] Key deleted on reboot: HKCU\Software\systweak
[#] Key deleted on reboot: [x64] HKCU\Software\systweak
[-] Key deleted: HKU\S-1-5-21-4232256137-3942767270-2832098513-1001\Software\Microsoft\Internet Explorer\SearchScopes\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
[-] Key deleted: HKU\S-1-5-21-4232256137-3942767270-2832098513-1001\Software\Microsoft\Internet Explorer\SearchScopes\{95602BBF-1462-4DFA-A67A-CA6BC22DCDDA}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95602BBF-1462-4DFA-A67A-CA6BC22DCDDA}
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95602BBF-1462-4DFA-A67A-CA6BC22DCDDA}

***** [ Web browsers ] *****
[-] Chrome preferences cleaned: "browser.newtab.url" - "hxxp://www.trovi.com/?gd=&ctid=CT3333673&octid=EB_ORIGINAL_CTID&ISID=CC189085-F21C-491B-8002-F53EA1DBAEEB&SearchSource=69&CUI=&SSPV=&Lay=1&UM=8&UP=SPB315EC6B-EAF9-4555-8081-A552AB863FEE&D=081116"
[-] Chrome preferences cleaned: "keyword.URL" - "hxxps://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=994519&p="
[-] [C:\Users\Luke Berger\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\Luke Berger\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
*************************
:: "Tracing" keys deleted
:: Winsock settings cleared
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [2702 Bytes] - [19/09/2016 22:10:49]
C:\AdwCleaner\AdwCleaner[S0].txt - [3946 Bytes] - [19/09/2016 18:11:45]
C:\AdwCleaner\AdwCleaner[S1].txt - [2894 Bytes] - [19/09/2016 22:09:18]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2921 Bytes] ##########

 

Okay, so I am seeing remnants of trovi hijacker, MalwareProtectionLive rogue AV, Systweak, SearchScopes hijacker.

Were you able to perform a clean boot and try the DISM tool yet?
Next would be the repair install using an in-place upgrade as suggested earlier. That will allow you to keep all apps and files.

 

Hi Simrick,
I have had issues trying to perform a clean boot. Whenever I do, I lose use of my internet so it's kind of hard to update. I tried several times and leaving certain stuff active but no dice. I posted about that above, with screenshots of the System Config screen, and the programs I was shutting down.

Also, I tried the DISM tutorial but I couldn't get it to work. It wasn't accepting any of the commands it suggested. What that DISM page was telling me, and the commands that actually work didnt mesh. Also I didn't know what image file I should be using.

 

I was in my device management looking to uninstall some drivers. And I found this;












Then, I googled Athwbx.sys and found this. I'm gonna try the steps there and see if this helps;

http://windowsreport.com/athwbx-sys-windows-10/

 

OK. I did that. It seems the driver is now working properly, but all of a sudden I get this error message at startup. It seems Windows Defender stopped working

.



Update still doesn't work. I don't get why I'm getting this error now. If it's not one thing it's another.

 

Yes, sorry, I see that. The Atheros would need to stay enabled in order to have internet in a clean boot.

The dism tool would need to be online, unless you have an install.WIM file to point it to on the the system. So, you'd want to use an ISO that is most recent. Right-click the ISO to mount, then note the location of the wim file (i.e. F:\sources\install.wim) and point the dism tool to it. If you have an ISO with install.ESD instead of install.WIM, it may not work.

EDIT: I've just re-read the whole thread, and wanted to make some additional observations, and ask some more questions:

You indicated that W8 installed fine, but W10 upgrade was a problem. In addition to what's already been mentioned, I do know that this will happen if hardware is failing/failed/problematic (could have been the wrls nic). Also, USB failures, memory failures - anything like that will prevent the install or upgrade.

Internet wasn't working well (pages slow to load and resetting) - has that resolved now that the Atheros driver has been repaired?

DISM can be done without internet (and that's probably how you want to do it now anyway):

Reset Internet Explorer.
Reset Chrome.
Check your HOSTS file for leftover changes from the infection.
Show hidden files; open with Notepad
C:\Windows\System32\Drivers\etc\HOSTS
Post it here in a code box (use # button) if you're not sure what you've got.

Put the system in a clean boot state. If you have ASUS AI Suite on the system, uninstall it. Also uninstall any 3rd-party AV, and hardware monitoring software (like Speccy, HDD Sentinel, etc.).

Have the ISO on the desktop - not the Z drive. Mount the ISO by right-clicking it and selecting MOUNT. Note the drive letter assigned to it, and the path to the install.wim file.

Disconnect your Z drive. Disable your wrls nic, and any ethernet nic you may have, in Device Manager. Also disable your USB hub. Disconnect all peripherals except keyboard, mouse and monitor. Open an admin command prompt and type the command (this is assuming the ISO is a wim-type, mounted to drive F):

Code: DISM /online /cleanup-image /restorehealth /source:wim:F:\sources\install.wim:1 /limitaccess[/quote] Note the spaces preceding each forward slash. The limitaccess switch tells the tool to search locally for files needed in the wim you pointed it to, and not to look online. If your ISO has an install.esd instead of install.wim, use that and change the command accordingly.

Code: DISM /online /cleanup-image /restorehealth /source:esd:F:\sources\install.esd:1 /limitaccess[/quote]

If it still fails to run, it could be that the ISO is corrupt. If there is an error number, please post it. In this case, it may be best to download a new one from a known clean, functioning system.

If the tool doesn't run, I would be suspicious of the ISO being corrupt, and would get a good one before I proceeded with a repair install.

I think, if you can, you should try the repair install using an in-place upgrade. Again, the latest ISO would be best to use, and makes no difference if you have an ESD or WIM file for that.

 

Hi Simrick,
I'm really trying here. I did everything you said but the DISM tool is giving me heartache. This is what it shows this.





What am I doing wrong?

 

Hi LAPS. I must apologise profusely - the restorehealth does NOT have a dash in it. I will change my post above to correct that for others who may come here....so sorry about that. Try it without the dash, and it should work.