Windows 10 Update broken?

[glennd]

Windows 10 Pro 1903. tiworker.exe is running at 50% *until* I open Task Manager, then it closes. After a few minutes it starts again and terminates Task Manager. I open Task Manager and tiworker.exe shuts down. Bizarre.

Start->Settings->Update never populates.
Dism.exe gives "DismHostLib: Failed to create dismhost.exe servicing process"

What have I forgotten?

 

[GTP]

You have forgotten to Fabs > Format > Reinstall Windoze....tehee
But seriously.. have you done a (full) offline malware scan with 2 scanners?
Emsisoft and Kaspersky Rescue are good.
Is tiworker.exe located in the C:\Windows\WinSxS\ folder? If it isnt refer to above.
Have you run SFC?
Does DISM /Online Cleanup-Image /RestoreHealth complete?
Is BITS set to Manual?
Have you completely removed the contents of Software Distribution folder?
Is the Windows Update Service set to manual?

Does it still do it if you run from a PE?

 

[glennd]

But seriously.. have you done a (full) offline malware scan with 2 scanners?

running now..

Is tiworker.exe located in the C:\Windows\WinSxS\ folder? If it isnt refer to above.

no. running now..

Have you run SFC?

reports no errors.

Does DISM /Online Cleanup-Image /RestoreHealth complete?

no. immediately reports error 2.

Is BITS set to Manual?

yes.

Have you completely removed the contents of Software Distribution folder?

yes.

Is the Windows Update Service set to manual?

is Disabled. When I set it to Manual, it immediately reverts to Disabled.

 

[glennd]

Interesting. This is Emsisoft EEK.

 

[GTP]

Hmmm well I would be uninstalling AOMEI PE Builder in the interim.

"Rootkit" anyone?

 

[glennd]

Hmmm well I would be uninstalling AOMEI PE Builder in the interim.

"Rootkit" anyone?

Done. EEK still running.

 

[britechguy]

And if it doesn't work after this, why not try using bootable media or ISO file to update to 2004?

 

[glennd]

Oh look what MBar found.

Infected: C:\Windows\System32\Tasks\Microsoft\Windows\Google\GoogleUpdateTaskMachineHD --> [Trojan.BitCoinMiner.Generic]
Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{90A688C4-DB3C-4E84-A13F-28539EA50619}|Path --> [Trojan.BitCoinMiner.Generic]
Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{90A688C4-DB3C-4E84-A13F-28539EA50619} --> [Trojan.BitCoinMiner.Generic]
Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\MICROSOFT\WINDOWS\GOOGLE\GoogleUpdateTaskMachineHD --> [Trojan.BitCoinMiner.Generic]

 

[glennd]

"Rootkit" anyone?

You win the prize!

 

[GTP]

Nice job lol
The fact that tiworker.exe wasnt where it was supposed to be was the alarm..

 

[glennd]

Nice job lol
The fact that tiworker.exe wasnt where it was supposed to be was the alarm..

Ok. I didn't know about that one. I learnt something, nice!

dism is working correctly now.

 

[Sky-Knight]

Here's the fun part...

The bitcoin miner wasn't the rootkit, it was what the rootkit was hiding!

 

[glennd]

Here's the fun part...

The bitcoin miner wasn't the rootkit, it was what the rootkit was hiding!

There's more?

 

[GTP]

Tbqh, after finding a rootkit it might be prudent to just bite the bullet and Fab's nuke reinstall.
I wouldnt trust the system now.
You could have a timebomb or any number of other hidden gems lurking in the firmware in your HDD, BIOS, chipsets and more waiting to surprise you as well.

 

[Sky-Knight]

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

 

[Larry Sabo]

You could have a timebomb or any number of other hidden gems lurking in the firmware in your HDD, BIOS, chipsets and more waiting to surprise you as well.

How would a N&P clear these?

 

[GTP]

How would a N&P clear these?

Obviously it wouldnt, hence my comment about never trusting the device.
You couldn't be certain that something hasn't been written to other parts of the system.
It should never more be used in a business or security critical environment.
Maybe as a home PC but even then I would feel uneasy.

 

[GTP]

Has anyone done it? Any experience?

Are you serious? Are you really a tech?
This is something an "end user" would ask.
@Kraken