Operating System: Windows XP
Type: Malware/Spyware
Problem:
After I had a customer’s computer infected with some regular trojans/malware. I couldn’t get automatic updates and BIT services started.When trying to start these services I received this error message:
“Error 2: The system cannot find the file specified.“
Hijackthis reported these two entries that didn’t seem legit:
O23 – Service: Automatic Updates (wuauserv) – Unknown owner – C:\WINDOWS\
O23 – Service: Background Intelligent Transfer Service (BITS) – Unknown owner – C:\WINDOWS\
I found this article on experts-exchange with a guy with a same problem. I searched long and hard and still no dice. I finally stumbled across a little google groups thread with this advice. Make sure you backup your registry before you attempt this. Also, good idea to do a system restore check point.
Solution:
- start —> run —> regedt32.exe
- Do a search for %fystemroot%
- If you find any hits, first change the permissions on the folders so you can edit the registry entry.
- change %fystemroot% to %systemroot%
- press F3 until you find all entries and repeat step 4.
- Try to start BITS and Automatic Updates
The orginal quote from the google group’s thread:
SOLUTION FOUND:
In my registry, the virus had replaced “%systemroot%” with “%fystemroot%”
in several spots, so the correct files could not be found. I did a search
for “fystemroot” in regedit, and replaced with “systemroot”. (I did have to
click “Edit” / “Permissions” and allow full control in each of the folders
first. Evidently the virus disabled the permissions first.) I hope this
helps anyone else who has a similar issue.
Please comment if this worked for you. Need all the feedback I can get on this solution.
I had this problem as well. Thanks for posting this — it was the only solution which allowed me to start the Automatic Updates Service.
Now to see if I can get BITS running…
You rock…. this worked after a couple hours trying to check my system files/reinstall BITS ect.. ect.. I removed the virus using ComboFix followed up by Symantec Endpoint but it definately left it's damage. These people are such pests they cause so much destruction and it just found it's way in while using IE7 with running resident virus software.
It seems to have broken Windows Defender as well to the point where you cannot reinstall it. You might want to comfirm this happend to you as well. It did something in the registry to where Windows Defender cannot finish installing.
have you tried the Microsoft installer cleanup utility? http://support.microsoft.com/kb/290301
I had this problem. Automatic Updates had problems starting.
and IT WORKS!
Thank you so much…
Thanks – made my day!!
Thank You! You are a Wizzard!
This did the trick for me as well. Thanks for the great help. I've looked everywhere to find this solution for this.
gracias por la solucion, bogota
De nada
Worked like a charm. After I read this, I checked the properties for both services in services.msc and, sure enough, the path was listed as “%fystemroot% . . . ” for both. From now on, I’ll remember to check there if something still isn’t working after removing a malware infection.
Hard to say which malware did this to this particular laptop system (a friend’s), since it had at least nine major infections plus one I can’t identify that infected the USERINIT.EXE that I had to fix manually through the Recovery Console before I could proceed with anything else.
Thanks so much, it works!
This was a life saver. Thanks for the tip.
Hi, thanks for the tip it seems like it was helpful to many people. However, I'm having some issues. I'm not sure if I'm doing this right, but I did search for the fystem and found one, but when I go to change the Permissions, I click the Allow Full Control, then 'Apply', and then 'OK'. But, when I go to try to change it says "Cannot edit: Error writing the value's new contents". When I go to check back on the Permissions the Allow Full Control box is unchecked again and it doesn't seem to work. Does anyone have any suggestions? If you do please reply, it would be very helpful. Thanks.
Actually… I just tried again and it seems to work, and now I've started up BITS. Thanks!
Thank You
Worked for me. I was floundering for hours. I had to reboot though, before it worked.
Good to hear, glad I could help
Thanks a lot. It works again.
Thanks a whole lot–This worked perfectly on a client's computer. Malwarebytes' Anti-Malware didn't catch this error, but removed the virus.
Thanks. Microsoft Update and Defender update is working again
awesome!
You rock..
OMG. You ROCK!!!!!!!! Had the same problem.
CYBER KISS!!!! you rock!!
somebody offered me flowers before, and someone bought me coffee, but cyber kisses ? hehe Thanks!
I.O.U. Dinner
(at the McDonalds of your choice)
Whenever you come to the south I will take you up on that offer
Yes, it worked! The registry value had been replaced in 4 places (if I remember correctly):
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesBITS
HKEY_LOCAL_MACHINESYSTEMControlSet001Serviceswuauserv
HKEY_LOCAL_MACHINESYSTEMControlSet002ServicesBITS
HKEY_LOCAL_MACHINESYSTEMControlSet002Serviceswuauserv
Your solution was exactly the one I needed for this problem, and I could not get help from the losers at Dell or Microsoft without paying them money. Dell actually spent more time on the phone with me than they would have if they just quickly spewed out the answer.
And you would think Microsoft would want to help with this, so their updates actually get implemented. Or maybe not.
P.S.: Thank you.
no problem, helping people out makes it worth every bit of the work that goes into burchwords.
Thank you for sharing your solution (which worked like a charm for me) as well. No other virus software or malware software would make the necessary corrections to the registry, and i could not find this anywhere else on Google. Thanks again!
Completely worked!!! Thanks so much.
Make sure guys spread the word about this fix.
Thanks for the help!!!!
Dude, you absolutely rock!
Been battling this issue on a user's D630 for a few days now. FINALLY! Take that and smoke it, you stupid virus writers!!
Works perfectly, the various AV scans had removed the virus but left those reg keys untouched. This solution made it all OK, thanks so much for posting this!
Dear God. You are a Genius. Thx a lot. After searching the Web for 3 hours, I finally found the solution.
Thx Pal. You are amazing !!!!!!!!!!!!!!!!!!!
Everybody keep retweeting and reposting this solution on the web.
Thanks for this very happy now
Thanks! The solution worked perfectly.
Great work thanks
worked, awesome.
You da bomb and Thanks!
Awesome! A client's computer was infected with a Trojan/Virus. Removed it then tried to run BITS/Automatic Update. It didn't work until I implemented your solution!
Thanks!
I have the same problem, but I didn't find any thing like fystemRoot, %fystemRoot%, or fystemRoot. The problem is still there, i'm not sure what i'm supposed to do next. Oh, I do have Registry Mechanic that repairs any damages, but BITS and AU are still not working. I've noticed that my computer is working slowly also.
when i looked at the history of the anti-spyware, it showed that the malware modified the HKLMSysCurrent Control SetServicesBITSParameters, ServiceDll (registry value). Any ideas on how I can fix BITS/AU?
Man, no clue I would have to be looking at the machine.
After searching the web for a solution I was ready to give up and wipe the computer clean and reinstall. Thanks to you I dont have to.
Hi thanks for the solution i had svchost error messages in my application log . ie and network stopped working so i tried your solution BINGO working fine thanks a lot
Hi… Thank you SOOOOOOOOOOOOOO MUCH… am not sure how much time you spent on getting this solution.. but you did save me a lot of time… and am happy
Thanking you, was almost about ready to explode.
thanks man, for weeks i havebeen earching for a solution, your the man
this worked great!
Brilliant. Amazing that the altering of one letter in all those millions in the registry, can fix the problem I've had for months. Thanks for your help. Gold medal stuff!
This did the trick! Thank you. I've tried everything else. You're a lfe saver!
Thank you very much for making this fix really easy! This worked like a charm!
Wow, I've been working on this for two days straight. This all started with trying to run Windows Update and getting error: 0x8024D007. I'm not sure how I found this page, but I'm glad I did. I've been scouring the web for suggestions and this is the first glimmer of hope I've found.
Worked great!!!! Thanks!!!!!!
really thank you. this problem is sloved by you!
THANK YOU!!! Fixed it quickly with this suggestion
OMG!!! THANK YOU SOOOO MUCH… I have been looking for a solution for days – This did it for me
Thanks a million. This works for me. I've tried a lot of different "solutions" found on the net…This is one that works