Vista Update 80070424 - Trusted Installer

Hallo,
I have problems with a notebook of a client of mine. Since October 2008
there are no updates, error 80070424.
the same with sp2, trying to install from a cd. (missing service)

I tried a lot of things (registering wuaueng.dll by hand, rename the
catroot2-folder, installer-update from microsoft), but found out now:

the trustedinstaller service is not there. the trustedinstaller.exe was
missing in the servicing directory, but i managed to get it there. but there
must be more errors, since the service does not start.

The files in the windows-system-directories belong to an owner "unknown
account"

Is there a way to get back this service trustedinstaller.

it would be a lot of work, setting up the notebook again.

Many thanks in advance

Ingo Weber

Hello Ingo:

80070424 usually means that the BITS service (required by Windows Update) is
not running.

Have a look at this article. It may be relevant to your problem.

Error message when you use Windows Update or Microsoft Update Web sites
to install updates: 0x80070424
<http://support.microsoft.com/kb/968002/>
-=-

OR

It seems possible that your Windows installation has been deliberately
damaged by the Trojan so as to prevent you updating your system or removing
the Trojan.



Some very good antimalware applications are SUPERAntiSpyware and
Malwarebytes Anti-Malware

Run both programs. (MBAM) and (SAS)
-=-

SUPERAntiSpyware (SAS)
There is a free version (Home)
<http://www.superantispyware.com/>
-=-

MalwareBytes Anti-Malware (MBAM) Same as above.
<http://www.malwarebytes.com/>
-=-


I hope this post is helpful.


Let us know how it works ºut.



Good luck
-=-


"MSNews" wrote:

> Hallo,
> I have problems with a notebook of a client of mine. Since October 2008
> there are no updates, error 80070424.
> the same with sp2, trying to install from a cd. (missing service)
>
> I tried a lot of things (registering wuaueng.dll by hand, rename the
> catroot2-folder, installer-update from microsoft), but found out now:
>
> the trustedinstaller service is not there. the trustedinstaller.exe was
> missing in the servicing directory, but i managed to get it there. but there
> must be more errors, since the service does not start.
>
> The files in the windows-system-directories belong to an owner "unknown
> account"
>
> Is there a way to get back this service trustedinstaller.
>
> it would be a lot of work, setting up the notebook again.
>
> Many thanks in advance
>
> Ingo Weber
>
>
>

There is a very good chance that you are seeing the effects of a hijackware
infection!

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/ma...e/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
(only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/...moving_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachi...php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

=====================
Start a free Windows Update support incident request:
https://support.microsoft.com/oas/de...spx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002


MSNews wrote:
> Hallo,
> I have problems with a notebook of a client of mine. Since October 2008
> there are no updates, error 80070424.
> the same with sp2, trying to install from a cd. (missing service)
>
> I tried a lot of things (registering wuaueng.dll by hand, rename the
> catroot2-folder, installer-update from microsoft), but found out now:
>
> the trustedinstaller service is not there. the trustedinstaller.exe was
> missing in the servicing directory, but i managed to get it there. but
> there
> must be more errors, since the service does not start.
>
> The files in the windows-system-directories belong to an owner "unknown
> account"
>
> Is there a way to get back this service trustedinstaller.
>
> it would be a lot of work, setting up the notebook again.
>
> Many thanks in advance
>
> Ingo Weber

Hi,
thank you for your fast answer.

The services 'bits' and 'windows update' are running and can be stopped and
started without any problem.
I tried to install the microsoft update agent (Version 3), but it said
unrecoverable error and stopped.

I checked for malware, but found no evidence for it.

I am nearly 100 per cent sure that the whole problem comes from the missing
(or wrong) trustedInstaller-Service/Group. This would also cover the problem
with the microsoft update agent.

On the files in the system32-directory, if you look-up the security-tab,
there is no entry for trustedInstaller, but beside the entries for
administator and user there is an unknown account (S-1-50 ..). I think, this
was the TrustedInstaller.

many thanks again

Ingo

"??ç?l" <> schrieb im Newsbeitrag
news:1AF8BBA6-A837-412D-9206-...
> Hello Ingo:
>
> 80070424 usually means that the BITS service (required by Windows Update)
> is
> not running.
>
> Have a look at this article. It may be relevant to your problem.
>
> Error message when you use Windows Update or Microsoft Update Web sites
> to install updates: 0x80070424
> <http://support.microsoft.com/kb/968002/>
> -=-
>
> OR
>
> It seems possible that your Windows installation has been deliberately
> damaged by the Trojan so as to prevent you updating your system or
> removing
> the Trojan.
>
>
>
> Some very good antimalware applications are SUPERAntiSpyware and
> Malwarebytes Anti-Malware
>
> Run both programs. (MBAM) and (SAS)
> -=-
>
> SUPERAntiSpyware (SAS)
> There is a free version (Home)
> <http://www.superantispyware.com/>
> -=-
>
> MalwareBytes Anti-Malware (MBAM) Same as above.
> <http://www.malwarebytes.com/>
> -=-
>
>
> I hope this post is helpful.
>
>
> Let us know how it works ºut.
>
>
>
> Good luck
> -=-
>
>
> "MSNews" wrote:
>
>> Hallo,
>> I have problems with a notebook of a client of mine. Since October 2008
>> there are no updates, error 80070424.
>> the same with sp2, trying to install from a cd. (missing service)
>>
>> I tried a lot of things (registering wuaueng.dll by hand, rename the
>> catroot2-folder, installer-update from microsoft), but found out now:
>>
>> the trustedinstaller service is not there. the trustedinstaller.exe was
>> missing in the servicing directory, but i managed to get it there. but
>> there
>> must be more errors, since the service does not start.
>>
>> The files in the windows-system-directories belong to an owner "unknown
>> account"
>>
>> Is there a way to get back this service trustedinstaller.
>>
>> it would be a lot of work, setting up the notebook again.
>>
>> Many thanks in advance
>>
>> Ingo Weber
>>
>>
>>

Hello Robear,

thank you for your fast answer.

Sorry, but I think there is only a very low chance of a malware-infection.
The complete scan of the malware-removal-tool found no infected file. Avast
antivirus is running for years, spybots search and destroy found no malware.

I am nearly 100 per cent sure that the whole problem comes from the missing
(or wrong) trustedInstaller-Service/Group. This would also cover the problem
with the microsoft update agent.

On the files in the system32-directory, if you look-up the security-tab,
there is no entry for trustedInstaller, but beside the entries for
administator and user there is an unknown account (S-1-50 ..). I think, this
was the TrustedInstaller.

It is the x64-Version of Vista Business.

many thanks again

Ingo


"PA Bear [MS MVP]" <> schrieb im Newsbeitrag
news:...
> There is a very good chance that you are seeing the effects of a
> hijackware infection!
>
> NB: If you had no anti-virus application installed or the subscription had
> expired *when the machine first got infected* and/or your subscription has
> since expired and/or the machine's not been kept fully-patched at Windows
> Update, don't waste your time with any of the below: Format & reinstall
> Windows. A Repair Install will NOT help!
>
> 1. See if you can download/run the MSRT manually:
> http://www.microsoft.com/security/ma...e/default.mspx
>
> NB: Run the FULL scan, not the QUICK scan! You may need to download the
> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
> machine and rename it to SCAN.EXE before running it.
>
> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
> scan (only!) in Safe Mode with Networking, if need be:
> http://onecare.live.com/site/en-us/center/howsafe.htm
>
> 3. Run a /thorough/ check for hijackware, including posting the requested
> logs in an appropriate forum, not here.
>
> Checking for/Help with Hijackware
> http://aumha.net/viewtopic.php?f=30&t=4075
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
> http://inetexplorer.mvps.org/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://www.elephantboycomputers.com/...moving_Malware
>
> **Chances are you will need to seek expert assistance in
> http://spywarehammer.com/simplemachi...php?board=10.0,
> http://www.spywarewarrior.com/viewforum.php?f=5,
> http://www.dslreports.com/forum/cleanup,
> http://www.bluetack.co.uk/forums/index.php,
> http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**
>
> If these procedures look too complex - and there is no shame in admitting
> this isn't your cup of tea - take the machine to a local, reputable and
> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>
> =====================
> Start a free Windows Update support incident request:
> https://support.microsoft.com/oas/de...spx?gprid=6527
>
> Support for Windows Update:
> http://support.microsoft.com/gp/wusupport
>
> For home users, no-charge support is available by calling 1-866-PCSAFETY
> in the United States and in Canada or by contacting your local Microsoft
> subsidiary. There is no-charge for support calls that are associated with
> security updates.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>
>
> MSNews wrote:
>> Hallo,
>> I have problems with a notebook of a client of mine. Since October 2008
>> there are no updates, error 80070424.
>> the same with sp2, trying to install from a cd. (missing service)
>>
>> I tried a lot of things (registering wuaueng.dll by hand, rename the
>> catroot2-folder, installer-update from microsoft), but found out now:
>>
>> the trustedinstaller service is not there. the trustedinstaller.exe was
>> missing in the servicing directory, but i managed to get it there. but
>> there
>> must be more errors, since the service does not start.
>>
>> The files in the windows-system-directories belong to an owner "unknown
>> account"
>>
>> Is there a way to get back this service trustedinstaller.
>>
>> it would be a lot of work, setting up the notebook again.
>>
>> Many thanks in advance
>>
>> Ingo Weber
>

Repost:
> Start a free Windows Update support incident request:
> https://support.microsoft.com/oas/de...spx?gprid=6527
>
> Support for Windows Update:
> http://support.microsoft.com/gp/wusupport
>
> For home users, no-charge support is available by calling 1-866-PCSAFETY
> in the United States and in Canada or by contacting your local Microsoft
> subsidiary. There is no-charge for support calls that are associated with
> security updates.

Ingo Weber wrote:
> Hello Robear,
>
> thank you for your fast answer.
>
> Sorry, but I think there is only a very low chance of a malware-infection.
> The complete scan of the malware-removal-tool found no infected file.
> Avast
> antivirus is running for years, spybots search and destroy found no
> malware.
>
> I am nearly 100 per cent sure that the whole problem comes from the
> missing
> (or wrong) trustedInstaller-Service/Group. This would also cover the
> problem
> with the microsoft update agent.
>
> On the files in the system32-directory, if you look-up the security-tab,
> there is no entry for trustedInstaller, but beside the entries for
> administator and user there is an unknown account (S-1-50 ..). I think,
> this
> was the TrustedInstaller.
>
> It is the x64-Version of Vista Business.
>
> many thanks again
>
> Ingo
>
>
> "PA Bear [MS MVP]" <> schrieb im Newsbeitrag
> news:...
>> There is a very good chance that you are seeing the effects of a
>> hijackware infection!
>>
>> NB: If you had no anti-virus application installed or the subscription
>> had
>> expired *when the machine first got infected* and/or your subscription
>> has
>> since expired and/or the machine's not been kept fully-patched at Windows
>> Update, don't waste your time with any of the below: Format & reinstall
>> Windows. A Repair Install will NOT help!
>>
>> 1. See if you can download/run the MSRT manually:
>> http://www.microsoft.com/security/ma...e/default.mspx
>>
>> NB: Run the FULL scan, not the QUICK scan! You may need to download the
>> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
>> machine and rename it to SCAN.EXE before running it.
>>
>> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
>> scan (only!) in Safe Mode with Networking, if need be:
>> http://onecare.live.com/site/en-us/center/howsafe.htm
>>
>> 3. Run a /thorough/ check for hijackware, including posting the requested
>> logs in an appropriate forum, not here.
>>
>> Checking for/Help with Hijackware
>> http://aumha.net/viewtopic.php?f=30&t=4075
>> http://mvps.org/winhelp2002/unwanted.htm
>> http://inetexplorer.mvps.org/data/prevention.htm
>> http://inetexplorer.mvps.org/tshoot.html
>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>> http://www.elephantboycomputers.com/...moving_Malware
>>
>> **Chances are you will need to seek expert assistance in
>> http://spywarehammer.com/simplemachi...php?board=10.0,
>> http://www.spywarewarrior.com/viewforum.php?f=5,
>> http://www.dslreports.com/forum/cleanup,
>> http://www.bluetack.co.uk/forums/index.php,
>> http://aumha.net/viewforum.php?f=30 or other appropriate forums as
>> well.**
>>
>> If these procedures look too complex - and there is no shame in admitting
>> this isn't your cup of tea - take the machine to a local, reputable and
>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>>
>> =====================
>> Start a free Windows Update support incident request:
>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>
>> Support for Windows Update:
>> http://support.microsoft.com/gp/wusupport
>>
>> For home users, no-charge support is available by calling 1-866-PCSAFETY
>> in the United States and in Canada or by contacting your local Microsoft
>> subsidiary. There is no-charge for support calls that are associated
>> with
>> security updates.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>
>>
>> MSNews wrote:
>>> Hallo,
>>> I have problems with a notebook of a client of mine. Since October 2008
>>> there are no updates, error 80070424.
>>> the same with sp2, trying to install from a cd. (missing service)
>>>
>>> I tried a lot of things (registering wuaueng.dll by hand, rename the
>>> catroot2-folder, installer-update from microsoft), but found out now:
>>>
>>> the trustedinstaller service is not there. the trustedinstaller.exe was
>>> missing in the servicing directory, but i managed to get it there. but
>>> there
>>> must be more errors, since the service does not start.
>>>
>>> The files in the windows-system-directories belong to an owner "unknown
>>> account"
>>>
>>> Is there a way to get back this service trustedinstaller.
>>>
>>> it would be a lot of work, setting up the notebook again.
>>>
>>> Many thanks in advance
>>>
>>> Ingo Weber

Ingo Weber wrote:

> Sorry, but I think there is only a very low chance of a malware-infection.
> The complete scan of the malware-removal-tool found no infected file. Avast
> antivirus is running for years, spybots search and destroy found no malware.
>
> I am nearly 100 per cent sure that the whole problem comes from the missing
> (or wrong) trustedInstaller-Service/Group. This would also cover the problem
> with the microsoft update agent.

Regardless of the original cause of the loss of this account, I'd recommend
backing up files, reformatting, and reinstalling.

Harry.


>
> On the files in the system32-directory, if you look-up the security-tab,
> there is no entry for trustedInstaller, but beside the entries for
> administator and user there is an unknown account (S-1-50 ..). I think, this
> was the TrustedInstaller.
>
> It is the x64-Version of Vista Business.
>
> many thanks again
>
> Ingo
>
>
> "PA Bear [MS MVP]" <> schrieb im Newsbeitrag
> news:...
>> There is a very good chance that you are seeing the effects of a
>> hijackware infection!
>>
>> NB: If you had no anti-virus application installed or the subscription had
>> expired *when the machine first got infected* and/or your subscription has
>> since expired and/or the machine's not been kept fully-patched at Windows
>> Update, don't waste your time with any of the below: Format & reinstall
>> Windows. A Repair Install will NOT help!
>>
>> 1. See if you can download/run the MSRT manually:
>> http://www.microsoft.com/security/ma...e/default.mspx
>>
>> NB: Run the FULL scan, not the QUICK scan! You may need to download the
>> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
>> machine and rename it to SCAN.EXE before running it.
>>
>> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
>> scan (only!) in Safe Mode with Networking, if need be:
>> http://onecare.live.com/site/en-us/center/howsafe.htm
>>
>> 3. Run a /thorough/ check for hijackware, including posting the requested
>> logs in an appropriate forum, not here.
>>
>> Checking for/Help with Hijackware
>> http://aumha.net/viewtopic.php?f=30&t=4075
>> http://mvps.org/winhelp2002/unwanted.htm
>> http://inetexplorer.mvps.org/data/prevention.htm
>> http://inetexplorer.mvps.org/tshoot.html
>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>> http://www.elephantboycomputers.com/...moving_Malware
>>
>> **Chances are you will need to seek expert assistance in
>> http://spywarehammer.com/simplemachi...php?board=10.0,
>> http://www.spywarewarrior.com/viewforum.php?f=5,
>> http://www.dslreports.com/forum/cleanup,
>> http://www.bluetack.co.uk/forums/index.php,
>> http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**
>>
>> If these procedures look too complex - and there is no shame in admitting
>> this isn't your cup of tea - take the machine to a local, reputable and
>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>>
>> =====================
>> Start a free Windows Update support incident request:
>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>
>> Support for Windows Update:
>> http://support.microsoft.com/gp/wusupport
>>
>> For home users, no-charge support is available by calling 1-866-PCSAFETY
>> in the United States and in Canada or by contacting your local Microsoft
>> subsidiary. There is no-charge for support calls that are associated with
>> security updates.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>
>>
>> MSNews wrote:
>>> Hallo,
>>> I have problems with a notebook of a client of mine. Since October 2008
>>> there are no updates, error 80070424.
>>> the same with sp2, trying to install from a cd. (missing service)
>>>
>>> I tried a lot of things (registering wuaueng.dll by hand, rename the
>>> catroot2-folder, installer-update from microsoft), but found out now:
>>>
>>> the trustedinstaller service is not there. the trustedinstaller.exe was
>>> missing in the servicing directory, but i managed to get it there. but
>>> there
>>> must be more errors, since the service does not start.
>>>
>>> The files in the windows-system-directories belong to an owner "unknown
>>> account"
>>>
>>> Is there a way to get back this service trustedinstaller.
>>>
>>> it would be a lot of work, setting up the notebook again.
>>>
>>> Many thanks in advance
>>>
>>> Ingo Weber
>
>

.... But What is this???

Is This so catastrophic ERROR?
This is with no solution posible?

Bits is running as described in KB 968002


i think this is incredible... backup, reinstalling and reconfiguring is not
a solution

"Harry Johnston [MVP]" wrote:

> Ingo Weber wrote:
>
> > Sorry, but I think there is only a very low chance of a malware-infection.
> > The complete scan of the malware-removal-tool found no infected file. Avast
> > antivirus is running for years, spybots search and destroy found no malware.
> >
> > I am nearly 100 per cent sure that the whole problem comes from the missing
> > (or wrong) trustedInstaller-Service/Group. This would also cover the problem
> > with the microsoft update agent.
>
> Regardless of the original cause of the loss of this account, I'd recommend
> backing up files, reformatting, and reinstalling.
>
> Harry.
>
>
> >
> > On the files in the system32-directory, if you look-up the security-tab,
> > there is no entry for trustedInstaller, but beside the entries for
> > administator and user there is an unknown account (S-1-50 ..). I think, this
> > was the TrustedInstaller.
> >
> > It is the x64-Version of Vista Business.
> >
> > many thanks again
> >
> > Ingo
> >
> >
> > "PA Bear [MS MVP]" <> schrieb im Newsbeitrag
> > news:...
> >> There is a very good chance that you are seeing the effects of a
> >> hijackware infection!
> >>
> >> NB: If you had no anti-virus application installed or the subscription had
> >> expired *when the machine first got infected* and/or your subscription has
> >> since expired and/or the machine's not been kept fully-patched at Windows
> >> Update, don't waste your time with any of the below: Format & reinstall
> >> Windows. A Repair Install will NOT help!
> >>
> >> 1. See if you can download/run the MSRT manually:
> >> http://www.microsoft.com/security/ma...e/default.mspx
> >>
> >> NB: Run the FULL scan, not the QUICK scan! You may need to download the
> >> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
> >> machine and rename it to SCAN.EXE before running it.
> >>
> >> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
> >> scan (only!) in Safe Mode with Networking, if need be:
> >> http://onecare.live.com/site/en-us/center/howsafe.htm
> >>
> >> 3. Run a /thorough/ check for hijackware, including posting the requested
> >> logs in an appropriate forum, not here.
> >>
> >> Checking for/Help with Hijackware
> >> http://aumha.net/viewtopic.php?f=30&t=4075
> >> http://mvps.org/winhelp2002/unwanted.htm
> >> http://inetexplorer.mvps.org/data/prevention.htm
> >> http://inetexplorer.mvps.org/tshoot.html
> >> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> >> http://www.elephantboycomputers.com/...moving_Malware
> >>
> >> **Chances are you will need to seek expert assistance in
> >> http://spywarehammer.com/simplemachi...php?board=10.0,
> >> http://www.spywarewarrior.com/viewforum.php?f=5,
> >> http://www.dslreports.com/forum/cleanup,
> >> http://www.bluetack.co.uk/forums/index.php,
> >> http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**
> >>
> >> If these procedures look too complex - and there is no shame in admitting
> >> this isn't your cup of tea - take the machine to a local, reputable and
> >> independent (i.e., not BigBoxStoreUSA) computer repair shop.
> >>
> >> =====================
> >> Start a free Windows Update support incident request:
> >> https://support.microsoft.com/oas/de...spx?gprid=6527
> >>
> >> Support for Windows Update:
> >> http://support.microsoft.com/gp/wusupport
> >>
> >> For home users, no-charge support is available by calling 1-866-PCSAFETY
> >> in the United States and in Canada or by contacting your local Microsoft
> >> subsidiary. There is no-charge for support calls that are associated with
> >> security updates.
> >> --
> >> ~Robear Dyer (PA Bear)
> >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> >>
> >>
> >> MSNews wrote:
> >>> Hallo,
> >>> I have problems with a notebook of a client of mine. Since October 2008
> >>> there are no updates, error 80070424.
> >>> the same with sp2, trying to install from a cd. (missing service)
> >>>
> >>> I tried a lot of things (registering wuaueng.dll by hand, rename the
> >>> catroot2-folder, installer-update from microsoft), but found out now:
> >>>
> >>> the trustedinstaller service is not there. the trustedinstaller.exe was
> >>> missing in the servicing directory, but i managed to get it there. but
> >>> there
> >>> must be more errors, since the service does not start.
> >>>
> >>> The files in the windows-system-directories belong to an owner "unknown
> >>> account"
> >>>
> >>> Is there a way to get back this service trustedinstaller.
> >>>
> >>> it would be a lot of work, setting up the notebook again.
> >>>
> >>> Many thanks in advance
> >>>
> >>> Ingo Weber
> >
> >
>

To avoid confusion, please begin a new thread about your specific problems.
State your IE version and full Windows version (e.g., WinXP SP3; Vista SP2)
in your first post.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002

Francisco Gabriel Aroca wrote:
> ... But What is this???
>
> Is This so catastrophic ERROR?
> This is with no solution posible?
>
> Bits is running as described in KB 968002
>
>
> i think this is incredible... backup, reinstalling and reconfiguring is
> not
> a solution
>
> "Harry Johnston [MVP]" wrote:
>
>> Ingo Weber wrote:
>>
>>> Sorry, but I think there is only a very low chance of a
>>> malware-infection.
>>> The complete scan of the malware-removal-tool found no infected file.
>>> Avast antivirus is running for years, spybots search and destroy found
>>> no
>>> malware.
>>>
>>> I am nearly 100 per cent sure that the whole problem comes from the
>>> missing (or wrong) trustedInstaller-Service/Group. This would also cover
>>> the problem with the microsoft update agent.
>>
>> Regardless of the original cause of the loss of this account, I'd
>> recommend
>> backing up files, reformatting, and reinstalling.
>>
>> Harry.
>>
>>
>>>
>>> On the files in the system32-directory, if you look-up the security-tab,
>>> there is no entry for trustedInstaller, but beside the entries for
>>> administator and user there is an unknown account (S-1-50 ..). I think,
>>> this was the TrustedInstaller.
>>>
>>> It is the x64-Version of Vista Business.
>>>
>>> many thanks again
>>>
>>> Ingo
>>>
>>>
>>> "PA Bear [MS MVP]" <> schrieb im Newsbeitrag
>>> news:...
>>>> There is a very good chance that you are seeing the effects of a
>>>> hijackware infection!
>>>>
>>>> NB: If you had no anti-virus application installed or the subscription
>>>> had expired *when the machine first got infected* and/or your
>>>> subscription has since expired and/or the machine's not been kept
>>>> fully-patched at Windows Update, don't waste your time with any of the
>>>> below: Format & reinstall Windows. A Repair Install will NOT help!
>>>>
>>>> 1. See if you can download/run the MSRT manually:
>>>> http://www.microsoft.com/security/ma...e/default.mspx
>>>>
>>>> NB: Run the FULL scan, not the QUICK scan! You may need to download
>>>> the
>>>> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
>>>> machine and rename it to SCAN.EXE before running it.
>>>>
>>>> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
>>>> scan (only!) in Safe Mode with Networking, if need be:
>>>> http://onecare.live.com/site/en-us/center/howsafe.htm
>>>>
>>>> 3. Run a /thorough/ check for hijackware, including posting the
>>>> requested
>>>> logs in an appropriate forum, not here.
>>>>
>>>> Checking for/Help with Hijackware
>>>> http://aumha.net/viewtopic.php?f=30&t=4075
>>>> http://mvps.org/winhelp2002/unwanted.htm
>>>> http://inetexplorer.mvps.org/data/prevention.htm
>>>> http://inetexplorer.mvps.org/tshoot.html
>>>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>>>> http://www.elephantboycomputers.com/...moving_Malware
>>>>
>>>> **Chances are you will need to seek expert assistance in
>>>> http://spywarehammer.com/simplemachi...php?board=10.0,
>>>> http://www.spywarewarrior.com/viewforum.php?f=5,
>>>> http://www.dslreports.com/forum/cleanup,
>>>> http://www.bluetack.co.uk/forums/index.php,
>>>> http://aumha.net/viewforum.php?f=30 or other appropriate forums as
>>>> well.**
>>>>
>>>> If these procedures look too complex - and there is no shame in
>>>> admitting
>>>> this isn't your cup of tea - take the machine to a local, reputable and
>>>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>>>>
>>>> =====================
>>>> Start a free Windows Update support incident request:
>>>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>>>
>>>> Support for Windows Update:
>>>> http://support.microsoft.com/gp/wusupport
>>>>
>>>> For home users, no-charge support is available by calling
>>>> 1-866-PCSAFETY
>>>> in the United States and in Canada or by contacting your local
>>>> Microsoft
>>>> subsidiary. There is no-charge for support calls that are associated
>>>> with security updates.
>>>> --
>>>> ~Robear Dyer (PA Bear)
>>>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>>>
>>>>
>>>> MSNews wrote:
>>>>> Hallo,
>>>>> I have problems with a notebook of a client of mine. Since October
>>>>> 2008
>>>>> there are no updates, error 80070424.
>>>>> the same with sp2, trying to install from a cd. (missing service)
>>>>>
>>>>> I tried a lot of things (registering wuaueng.dll by hand, rename the
>>>>> catroot2-folder, installer-update from microsoft), but found out now:
>>>>>
>>>>> the trustedinstaller service is not there. the trustedinstaller.exe
>>>>> was
>>>>> missing in the servicing directory, but i managed to get it there. but
>>>>> there
>>>>> must be more errors, since the service does not start.
>>>>>
>>>>> The files in the windows-system-directories belong to an owner
>>>>> "unknown
>>>>> account"
>>>>>
>>>>> Is there a way to get back this service trustedinstaller.
>>>>>
>>>>> it would be a lot of work, setting up the notebook again.
>>>>>
>>>>> Many thanks in advance
>>>>>
>>>>> Ingo Weber

Francisco Gabriel Aroca wrote:

> ... But What is this???
>
> Is This so catastrophic ERROR?
> This is with no solution posible?

If a built-in account is missing, something has gone seriously wrong.

> Bits is running as described in KB 968002

Please start a new thread about your own problem. It almost certainly isn't the
same as that of the original poster, and can probably be resolved more easily.

> i think this is incredible... backup, reinstalling and reconfiguring is not
> a solution

Unfortunately, sometimes it is the only solution.

Harry.

>
> "Harry Johnston [MVP]" wrote:
>
>> Ingo Weber wrote:
>>
>>> Sorry, but I think there is only a very low chance of a malware-infection.
>>> The complete scan of the malware-removal-tool found no infected file. Avast
>>> antivirus is running for years, spybots search and destroy found no malware.
>>>
>>> I am nearly 100 per cent sure that the whole problem comes from the missing
>>> (or wrong) trustedInstaller-Service/Group. This would also cover the problem
>>> with the microsoft update agent.
>> Regardless of the original cause of the loss of this account, I'd recommend
>> backing up files, reformatting, and reinstalling.
>>
>> Harry.
>>
>>
>>> On the files in the system32-directory, if you look-up the security-tab,
>>> there is no entry for trustedInstaller, but beside the entries for
>>> administator and user there is an unknown account (S-1-50 ..). I think, this
>>> was the TrustedInstaller.
>>>
>>> It is the x64-Version of Vista Business.
>>>
>>> many thanks again
>>>
>>> Ingo
>>>
>>>
>>> "PA Bear [MS MVP]" <> schrieb im Newsbeitrag
>>> news:...
>>>> There is a very good chance that you are seeing the effects of a
>>>> hijackware infection!
>>>>
>>>> NB: If you had no anti-virus application installed or the subscription had
>>>> expired *when the machine first got infected* and/or your subscription has
>>>> since expired and/or the machine's not been kept fully-patched at Windows
>>>> Update, don't waste your time with any of the below: Format & reinstall
>>>> Windows. A Repair Install will NOT help!
>>>>
>>>> 1. See if you can download/run the MSRT manually:
>>>> http://www.microsoft.com/security/ma...e/default.mspx
>>>>
>>>> NB: Run the FULL scan, not the QUICK scan! You may need to download the
>>>> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
>>>> machine and rename it to SCAN.EXE before running it.
>>>>
>>>> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
>>>> scan (only!) in Safe Mode with Networking, if need be:
>>>> http://onecare.live.com/site/en-us/center/howsafe.htm
>>>>
>>>> 3. Run a /thorough/ check for hijackware, including posting the requested
>>>> logs in an appropriate forum, not here.
>>>>
>>>> Checking for/Help with Hijackware
>>>> http://aumha.net/viewtopic.php?f=30&t=4075
>>>> http://mvps.org/winhelp2002/unwanted.htm
>>>> http://inetexplorer.mvps.org/data/prevention.htm
>>>> http://inetexplorer.mvps.org/tshoot.html
>>>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>>>> http://www.elephantboycomputers.com/...moving_Malware
>>>>
>>>> **Chances are you will need to seek expert assistance in
>>>> http://spywarehammer.com/simplemachi...php?board=10.0,
>>>> http://www.spywarewarrior.com/viewforum.php?f=5,
>>>> http://www.dslreports.com/forum/cleanup,
>>>> http://www.bluetack.co.uk/forums/index.php,
>>>> http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**
>>>>
>>>> If these procedures look too complex - and there is no shame in admitting
>>>> this isn't your cup of tea - take the machine to a local, reputable and
>>>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>>>>
>>>> =====================
>>>> Start a free Windows Update support incident request:
>>>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>>>
>>>> Support for Windows Update:
>>>> http://support.microsoft.com/gp/wusupport
>>>>
>>>> For home users, no-charge support is available by calling 1-866-PCSAFETY
>>>> in the United States and in Canada or by contacting your local Microsoft
>>>> subsidiary. There is no-charge for support calls that are associated with
>>>> security updates.
>>>> --
>>>> ~Robear Dyer (PA Bear)
>>>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>>>
>>>>
>>>> MSNews wrote:
>>>>> Hallo,
>>>>> I have problems with a notebook of a client of mine. Since October 2008
>>>>> there are no updates, error 80070424.
>>>>> the same with sp2, trying to install from a cd. (missing service)
>>>>>
>>>>> I tried a lot of things (registering wuaueng.dll by hand, rename the
>>>>> catroot2-folder, installer-update from microsoft), but found out now:
>>>>>
>>>>> the trustedinstaller service is not there. the trustedinstaller.exe was
>>>>> missing in the servicing directory, but i managed to get it there. but
>>>>> there
>>>>> must be more errors, since the service does not start.
>>>>>
>>>>> The files in the windows-system-directories belong to an owner "unknown
>>>>> account"
>>>>>
>>>>> Is there a way to get back this service trustedinstaller.
>>>>>
>>>>> it would be a lot of work, setting up the notebook again.
>>>>>
>>>>> Many thanks in advance
>>>>>
>>>>> Ingo Weber
>>>