Serial and continuous problems after (KB5034441) Error (0x80070643)

Edited by Chris Cosgrove, 07 February 2024 - 06:38 AM.
Moved from Win 10 Discussio to Win 10 support.

Hi:

These new issues most likely have nothing to do with KB5034441 (which was pulled by MS weeks ago).

We need more information in order to better assist you. For starters....

FIRST:

1. Please download, install and run the Free version of Speccy from here: https://www.ccleaner.com/speccy.
2. Then, go to File > Publish Snapshot
3. Click YES > Copy to Clipboard
4. Then please post the LINK to the report by pasting it into your next reply.

NEXT:

1. Please download and install MiniToolBox from here: https://www.bleepingcomputer.com/download/minitoolbox/
2. Place a checkmark in the following boxes:

List Last 10 Event Viewer Errors
List Installed Programs
List Problematic Devices
List Users, Partitions and Memory size

3. Click “GO”
4. Please post the text results here by pasting them in your next reply in this thread.

Thanks

Thanks for reply

 

First :

http://speccy.piriform.com/results/EoOO1TwDnhkzoC0DsNCRwiJ

 

Second :

I didn't see the "list problematic devices" error, that's why I clicked the "list devices - only problems" option

https://i.imgur.com/8NlglFO.png

 

Edited by hamluis, 07 February 2024 - 09:08 AM.

Thanks for those reports. There is a LOT going on with this system. Just a few examples of problems that my untrained eyes have spotted -

 

Evidence of possible cracked/pirated software (use of which violates the BC Forum Rules):

Date: 2024-02-01 00:53:17

Description: 

Microsoft Defender Antivirus has detected malware or other potentially unwanted software.

For more information please see the following:

https://go.microsoft.com/fwlink/?linkid=37020&name=PUA:Win32/Keygen&threatid=225063&enterprise=0

Name: PUA:Win32/Keygen

Severity: Low

Category: Potentially Unwanted Software

Path: file:_C:\Users\FNGeek\Downloads\Stardock Groupy\Stardock.Groupy.2.12.x64\Patch\Stardock Products Patch.exe

Detection Origin: Local machine

Detection Type: Concrete

Detection Source: Real-Time Protection

Process Name: Unknown

Security intelligence Version: AV: 1.403.3000.0, AS: 1.403.3000.0, NIS: 1.403.3000.0

Engine Version: AM: 1.1.23110.2, NIS: 1.1.23110.2

 

 

Evidence of possible malware:

Date: 2024-01-31 04:01:37

Description: 

Microsoft Defender Antivirus has detected malware or other potentially unwanted software.

For more information please see the following:

https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Ransomware!ShadowCopy.E&threatid=2147829652&enterprise=0

Name: Behavior:Win32/Ransomware!ShadowCopy.E

Severity: Severe

Category: Suspicious Behavior

Path: behavior:_process: C:\Windows\System32\rundll32.exe, pid:1356:72238830050985; process:_pid:1356,ProcessStart:133511341622358162

Detection Origin: Unknown

Detection Type: Concrete

Detection Source: Unknown

Process Name: C:\Windows\System32\rundll32.exe

Security intelligence Version: AV: 1.403.2959.0, AS: 1.403.2959.0, NIS: 1.403.2959.0

Engine Version: AM: 1.1.23110.2, NIS: 1.1.23110.2

 

 

Tweaking software that can break Windows:

ExplorerPatcher (HKLM\...\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher) (Version: 22621.2861.62.2 - VALINET Solutions SRL)

Winaero Tweaker (HKLM\...\Winaero Tweaker_is1) (Version: 1.60.1.0 - Winaero)

 

Use of torrents that are one of the most common ways to get infected:

qBittorrent (HKLM-x32\...\qBittorrent) (Version: 4.6.3 - The qBittorrent project)

 

Borderline low disk space on the OS boot drive (C:\) – 20% is the bare minimum required for proper Windows operation:

1 Drive c: (Local Disk) (Fixed) (Total:118.7 GB) (Free:19.43 GB) NTFS

 

 

If I were you, I would backup my data, wipe the drive, and perform a clean install of Windows 10

              >Given the age of the system, it might be advisable to run  hardware diagnostics first

 

Otherwise, it’s likely advisable to head over to the malware removal section for a deeper diagnosis and cleanup. If you proceed, please start with the Preparation Guide HERE (follow as many of the instructions as you can).

THEN, please post the requested FRST & Addition logs in a new, separate topic HERE.

A trained malware expert will assist with scanning and (if needed) cleaning your computer.

After the system is clean (which will include removing all pirated/cracked software) you can return here for additional troubleshooting.

 

 

Other helpers may have other/better suggestions.

 

Agree with MM, her suggestion to initiate a topic in the Malware Forum seems the logical way to proceed.

 

Louis

Thanks for those reports. There is a LOT going on with this system. Just a few examples of problems that my untrained eyes have spotted -

 

Evidence of possible cracked/pirated software (use of which violates the BC Forum Rules):

Date: 2024-02-01 00:53:17

Description: 

Microsoft Defender Antivirus has detected malware or other potentially unwanted software.

For more information please see the following:

https://go.microsoft.com/fwlink/?linkid=37020&name=PUA:Win32/Keygen&threatid=225063&enterprise=0

Name: PUA:Win32/Keygen

Severity: Low

Category: Potentially Unwanted Software

Path: file:_C:\Users\FNGeek\Downloads\Stardock Groupy\Stardock.Groupy.2.12.x64\Patch\Stardock Products Patch.exe

Detection Origin: Local machine

Detection Type: Concrete

Detection Source: Real-Time Protection

Process Name: Unknown

Security intelligence Version: AV: 1.403.3000.0, AS: 1.403.3000.0, NIS: 1.403.3000.0

Engine Version: AM: 1.1.23110.2, NIS: 1.1.23110.2

 

 

Evidence of possible malware:

Date: 2024-01-31 04:01:37

Description: 

Microsoft Defender Antivirus has detected malware or other potentially unwanted software.

For more information please see the following:

https://go.microsoft.com/fwlink/?linkid=37020&name=Behavior:Win32/Ransomware!ShadowCopy.E&threatid=2147829652&enterprise=0

Name: Behavior:Win32/Ransomware!ShadowCopy.E

Severity: Severe

Category: Suspicious Behavior

Path: behavior:_process: C:\Windows\System32\rundll32.exe, pid:1356:72238830050985; process:_pid:1356,ProcessStart:133511341622358162

Detection Origin: Unknown

Detection Type: Concrete

Detection Source: Unknown

Process Name: C:\Windows\System32\rundll32.exe

Security intelligence Version: AV: 1.403.2959.0, AS: 1.403.2959.0, NIS: 1.403.2959.0

Engine Version: AM: 1.1.23110.2, NIS: 1.1.23110.2

 

 

Tweaking software that can break Windows:

ExplorerPatcher (HKLM\...\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher) (Version: 22621.2861.62.2 - VALINET Solutions SRL)

Winaero Tweaker (HKLM\...\Winaero Tweaker_is1) (Version: 1.60.1.0 - Winaero)

 

Use of torrents that are one of the most common ways to get infected:

qBittorrent (HKLM-x32\...\qBittorrent) (Version: 4.6.3 - The qBittorrent project)

 

Borderline low disk space on the OS boot drive (C:\) – 20% is the bare minimum required for proper Windows operation:

1 Drive c: (Local Disk) (Fixed) (Total:118.7 GB) (Free:19.43 GB) NTFS

 

 

If I were you, I would backup my data, wipe the drive, and perform a clean install of Windows 10

              >Given the age of the system, it might be advisable to run  hardware diagnostics first

 

Otherwise, it’s likely advisable to head over to the malware removal section for a deeper diagnosis and cleanup. If you proceed, please start with the Preparation Guide HERE (follow as many of the instructions as you can).

THEN, please post the requested FRST & Addition logs in a new, separate topic HERE.

A trained malware expert will assist with scanning and (if needed) cleaning your computer.

After the system is clean (which will include removing all pirated/cracked software) you can return here for additional troubleshooting.

 

 

Other helpers may have other/better suggestions.

 

 

ETC

Under the circumstances & given the forum rules, I have no additional advice.
Sorry.
Good luck.

All I can say is I agree with MM.

You should raise a ticket in the Malware forum.

If you have not done so already then disable Windows Update from trying to install KB 5034441 but I am fairly certain this is not your problem.

All I can say is I agree with MM.

You should raise a ticket in the Malware forum.

If you have not done so already then disable Windows Update from trying to install KB 5034441 but I am fairly certain this is not your problem.

For the network interfaces error, I'd start by uninstalling your VPN software. I can't even count the number of times I've seen installation of a VPN client interfere with network interfaces applets.

 

And I too think you should check for malware. I'd bet there is at least some as part of the problem. If not, what have you got to lose except a little of your time.

Interestingly still screwed - KB5034441 - 8 days ago - https://www.windowslatest.com/2024/02/14/windows-10-kb5034441-is-still-broken-with-0x80070643-error/ revealed the security update would not install with an error message titled “0x80070643 – ERROR_INSTALL_FAILURE”.

 

All I can say is I agree with MM.

You should raise a ticket in the Malware forum.

If you have not done so already then disable Windows Update from trying to install KB 5034441 but I am fairly certain this is not your problem.

He said that the cracked programs in your system will be deleted, this creates a problem for me

 

Last night, I scanned the entire system with several antiviruses, including malwarebytes, and not even a single malware was found

 

 

That doesn't necessarily mean you aren't infected. I suggest you follow our advice. We have dozens of years of IT experience here.

@FNActivity I thought the same thing that is years old and does not matter.

 

Well years later and better scanning when I uninstalled the program the crack .ini file turned out to be something much worse.

 

My blocking in a great Firewall is the only reason I was safe.

 

It still can effect you, your friends and family and all on the internet.

 

With that thought it is best to find a alternative that is freeware or pay for the program.

 

You mention Iran.  Some of the best hackers in the world may be using you.

Pkshadow
Shplad

Thanks guys, I'll listen to your advice and try not to use cracked programs from now on, I wanted to announce that my problem was solved globally with one change!


All the problems that happened to my operating system were solved by the following change in the registry
(There were a series of other software problems that I just found out, such as the inability to turn off Windows Security or the inability to use the exclude section of Windows Security, etc.)

 

1) Run regedit.exe

2) Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI

3) In this folder create a new key named StringCacheSettings

4) Under this add a new DWORD (32-bit) named StringCacheGeneration

5) Set the value of this new DWORD to 38b (hexdecimal)

6) Close regedit and reboot windows.