[Server2019 Essentials x64] "We are having difficulties downloading updates"

[MetalicMan]

Errors when trying to start service



Also, in the same second:

 

[Maxstar]

Still trows the error while trying to change startup type

Yes, but do this again with Process Monitor running and upload the PML trace. Also copy and paste the errors from the Event Viewer so I can translate them.

 

[MetalicMan]

Thanks, here it goes.

It recorded changing startup type and starting up the service

SAPO Transfer - sapotransfer-5fc71a55a4243bh

 

[Maxstar]

Hi,

Could you please re-check the permissions of the DoSvc service for all the administrator accounts as described in post #82 and post new screenshots of it.

 

[MetalicMan]

For sure, here it goes, thanks"


Looks ok, doesn't it?

 

[Maxstar]

Please post also a screenshot of the Security tab when Operadores de servidor is selected.

 

[MetalicMan]

Thanks.
Here it goes

 

[Maxstar]

Hi,

Retrieve Software Hive
1. Navigate to C:\Windows\System32\Config and locate the SOFTWARE file.
2. Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, try Option#2 below.
3. Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named SOFTWARE.ZIP on your desktop.
4. Upload the zip file (SOFTWARE.zip) to your favourite file sharing website (it will be too big to upload here). Examples of services to upload to are Gofile or WeTransfer.
5. Note: Send the downloadlink in a private message as the SOFTWARE hive contains sensitive information!

---

Option#2 (only if you are unable to follow the previous instructions)

• Please download the Freeware RegBak from here: Acelogix Software - Download products
  You will find it at the bottom of the page that the link brings you to.
• Go ahead and install this program and accept all the defaults. After the last install screen the program should open.
• Click the New Backup button. Accept the defaults and simply click Start.
• When it says Finished successfully, click the Close button.
• This will bring you back to the main screen of the program. You will see one entry in this list with the date that you did it. Right-click on this line-item and select Explore Backup...
• This will bring you into the folder where the backup was made. You should see a Users folder and a Windows folder along with a couple other files. Double-click on the Windows folder to open it. Then open the System32 folder and then config folder. You should see around 6 files in here, one of which is named SOFTWARE.
• Copy the SOFTWARE file to your Desktop. If the SOFTWARE file does not exist, please fetch it instead from C:\Windows\System32\config\SOFTWARE.
• Now right-click on the SOFTWARE file that is on your desktop and select Send to > Compressed (zipped) folder.
• Then please upload the zip file (SOFTWARE.zip) to your favourite file sharing website (it will be too big to upload here). Examples of services to upload to are Gofile or WeTransfer.
• Note: Send the downloadlink in a private message as the SOFTWARE hive contains sensitive information!
• You can close any open windows you have as well as the RegBak program now.

 

[MetalicMan]

Sent, thanks!

 

[Maxstar]

Hi,

You have send me the SYSTEM hive instead of the SOFTWARE hive.

 

[MetalicMan]

So sorry for the mishap
Sent new link

 

[Maxstar]

Hi,

Has this server ever been infected with malware, I noticed an registry value which may indicate this server was compromised in the past? This may also explain the problem with permissions and the access denied error when trying to start the DoSvc service.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS]
"PerfMMFileName"="Global\\MMF_BITS30e771e6-4785-4fb4-a4ba-42a786ea39af"

 

[MetalicMan]

Can't really vouch for that, as I'm maintaining it only for a couple of months.
What can we do to mend it?

 

[Maxstar]

Hi,

The key above is a part of Daxin this is a kernel mode backdoor:
- Automated Malware Analysis IOC Report for - Generated by Joe Sandbox
- Daxin Malware : New Espionage Backdoor - CyberSRC
- Daxin: Stealthy Backdoor Designed for Attacks Against Hardened Networks

From a security perspective, my advise would be to completely wipe and reinstall this server.