Many times, following a nasty infection (such as that of various rogues or rootkits), you might notice that some of the critical Windows services are missing (such as the Security Center or Windows Firewall), or that Windows seems to be devoid of some typically critical functionality (such as Windows Update). \u00a0Apart from the obvious corrective measures that often must be taken post-disinfection (such as reinstalling any security software which might have been damaged), repairing system components can be much tougher.<\/p>\n
Today, I’ll focus specifically on how to detect\/repair some of the most commonly damaged services following an infection. \u00a0The four most commonly-damaged services are:<\/p>\n
It’s easy to understand why these services specifically are targeted by infections:\u00a0all\u00a0<\/em>of them are potential threats to the malware, as they deal directly with Windows’ ability to protect and update itself.<\/p>\n The easiest way to detect missing or damaged services is to run these commands at the Command Prompt:<\/p>\n sc query bits<\/p>\n sc query wscsvc<\/p>\n sc query bfe<\/p>\n sc query mpssvc<\/p><\/blockquote>\n As mentioned above, the bottom two services don’t exist on XP. \u00a0You can also script this using batch like so:<\/p>\n If any required services return an erroneous response (i.e., “The specified service does not exist as an installed service.”) then it’s pretty clear that damage has been done by the infection which requires repair.<\/p>\n At this point, you have to first check to ensure that the relevant system files for each service are still intact. \u00a0The easiest way to do this is to perform a\u00a0sfc \/scannow\u00a0<\/strong>operation at the command line (run as Administrator) and ensure that any damaged files were successfully repaired.<\/p>\n Next, it’s generally as easy as reimporting the default registry keys corresponding with each missing service. \u00a0This isn’t difficult once you find a reliable location to acquire those keys. \u00a0The best place available is currently BleepingComputer.com’s Index of Windows Services<\/a>. \u00a0Simply choose the folder which matches your operating system, select the name of the damaged\/missing service, download the file, and import it into your registry.<\/p>\n After this is finished, you’ll still need to set each service to its default Startup type. \u00a0The easiest way to do this is to simply type each of these commands at the Command Prompt (again, running as Administrator):<\/p>\n sc config BITS start= delayed-auto<\/p>\n sc config wscsvc start= delayed-auto<\/p>\n sc config BFE start= auto<\/p>\n sc config MpsSvc start= auto<\/p><\/blockquote>\n Again, it bears repeating: the final two services don’t exist on XP machines.<\/p>\n After completing these steps,\u00a0reboot the PC\u00a0<\/strong>and see if everything’s working again.<\/p>\n In a later post, I’ll cover Windows Update repair procedures, permissions resets, and plenty more techniques to help repair damaged systems following infection.<\/p>\n","protected":false},"excerpt":{"rendered":" Many times, following a nasty infection (such as that of various rogues or rootkits), you might notice that some of the critical Windows services are missing (such as the Security Center or Windows Firewall), or that Windows seems to be … Continue reading echo Checking for damaged Windows services...\r\n\r\nsc query bits|find \"The specified service does not exist as an installed service.\">nul&&( echo BITS Service [BITS] does not exist )\r\n\r\nsc query wscsvc|find \"The specified service does not exist as an installed service.\">nul&&( echo Security Center Service [WscSvc] does not exist )\r\n\r\nsc query bfe|find \"The specified service does not exist as an installed service.\">nul&&( echo Base Filtering Engine Service [bfe] does not exist )\r\n\r\nsc query mpssvc|find \"The specified service does not exist as an installed service.\">nul&&( echo Windows Firewall Service [MpsSvc] does not exist )<\/pre>\n