[SOLVED] VM Server 2019 Configuration Registry Database Corrupt

MoZi · Oct 8, 2024

No, we don't have SCCM
and indeed, the DoSvc fails every time

Maxstar · Oct 8, 2024

Please disconnect this server from WSUS and try to update using Windows Update to see what happens.

MoZi · Oct 8, 2024

unfortunately it's the same outcome with the same error codes

Maxstar · Oct 8, 2024

Okay, please try the following, but I guess you will see an access denied error?!
1. Open Start and type Services.msc
2. Change the Starttype of DoSvc to Automatic (Delayed Start).
3. If succesful press start and let me know the result.

MoZi · Oct 8, 2024

yeah, access denied when trying to apply

Maxstar · Oct 8, 2024

Step 1. Make a backup of the Services key

Open the Start menu of Windows and type CMD.
When you see Command Prompt on the list, select the option Run as administrator.
Copy and paste the following command into the command prompt and press enter.

Code:

reg save "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" "%userprofile%\Desktop\Services-bkp.hiv"

Once done, a file will appear on your desktop, called Services-bkp.hiv.

Step 2. Download

SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

Save any work you have open, and close all programs.
Download the attachment SFCFixScript.txt and save it to your desktop.
Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Post the logfile (SFCFix.txt) as attachment in your next reply.

MoZi · Oct 8, 2024

done and done!

Maxstar · Oct 8, 2024

Please run the following commands again and copy paste the result in your next post.

Code:

sc start DoSvc

...wait a few seconds and run the following commands:

Code:

sc query DoSvc
sc qc DoSvc

MoZi · Oct 8, 2024

Code:

sc start DoSvc

SERVICE_NAME: DoSvc
        TYPE               : 30  WIN32
        STATE              : 2  START_PENDING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x7d0
        PID                : 5888
        FLAGS              :


sc query DoSvc

SERVICE_NAME: DoSvc
        TYPE               : 30  WIN32
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1066  (0x42a)
        SERVICE_EXIT_CODE  : 2147942402  (0x80070002)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0


sc qc Dosvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Dosvc
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Windows\System32\svchost.exe -k NetworkService -p
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Delivery Optimization
        DEPENDENCIES       : rpcss
        SERVICE_START_NAME : NT Authority\NetworkService

Maxstar · Oct 8, 2024

Please run the previous commands again with Process Monitor running.

Capture Process Monitor Trace
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Try to start the DoSvc service again with the previous commands
3. Stop Process Monitor a minute after it fails, just to be sure everything is logged. You can simply do this by clicking the capture icon (CTRL +E) on the toolbar as shown below.

4. Select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
5. Zip up the LogFile.PML and upload it to WeTransfer | Send Large Files Fast - Up To 2GB Free and provide the link.

MoZi · Oct 8, 2024

here is the link to the requested file:
WeTransfer

Maxstar · Oct 8, 2024

Rich (BB code):

10/8/2024 12:42:13 PM    svchost.exe    FileSystemControl    C:\Windows\System32\dosvc.dll    INVALID DEVICE REQUEST    Control: FSCTL_GET_EXTERNAL_BACKING

Please run the following commands and copy paste the result in your next post.

Code:

icacls C:\Windows\System32\dosvc.dll
certutil -hashfile C:\Windows\System32\dosvc.dll SHA256
fsutil hardlink list C:\Windows\System32\dosvc.dll

MoZi · Oct 8, 2024

Code:

icacls C:\windows\system32\dosvc.dll
C:\windows\system32\dosvc.dll NT SERVICE\TrustedInstaller:(F)
                              BUILTIN\Administrators:(RX)
                              NT AUTHORITY\SYSTEM:(RX)
                              BUILTIN\Users:(RX)
                              APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
                              APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)

Successfully processed 1 files; Failed processing 0 files



certutil -hashfile C:\Windows\System32\dosvc.dll SHA256
SHA256 hash of C:\Windows\System32\dosvc.dll:
f56010cfbf0d36b2d7a025d2e37d769fbf802a1a54e34226b7bc79c6557f2228
CertUtil: -hashfile command completed successfully.



fsutil hardlink list C:\Windows\System32\dosvc.dll
\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.17763.1697_none_17cf181298e5b907\dosvc.dll
\Windows\System32\dosvc.dll

Maxstar · Oct 8, 2024

Please run also the following commands:

Code:

certutil -hashfile C:\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.17763.1697_none_17cf181298e5b907\dosvc.dll SHA256
dir /s /a C:\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.17763.1697_none_17cf181298e5b907

MoZi · Oct 8, 2024

Code:

certutil -hashfile C:\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.17763.1697_none_17cf181298e5b907\dosvc.dll SHA256
SHA256 hash of C:\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.17763.1697_none_17cf181298e5b907\dosvc.dll:
f56010cfbf0d36b2d7a025d2e37d769fbf802a1a54e34226b7bc79c6557f2228
CertUtil: -hashfile command completed successfully.


dir /s /a C:\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.17763.1697_none_17cf181298e5b907
 Volume in drive C has no label.
 Volume Serial Number is 8A59-09CA

 Directory of C:\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.17763.1697_none_17cf181298e5b907

21.01.2021  21:22    <DIR>          .
21.01.2021  21:22    <DIR>          ..
21.01.2021  21:21             4 110 2213703c9c64cc61ba900531652e23c84728d2a2.xml
21.01.2021  21:21         1 567 744 dosvc.dll
21.01.2021  21:22    <DIR>          f
21.01.2021  21:22    <DIR>          r
               2 File(s)      1 571 854 bytes

 Directory of C:\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.17763.1697_none_17cf181298e5b907\f

21.01.2021  21:22    <DIR>          .
21.01.2021  21:22    <DIR>          ..
07.01.2021  19:30                59 2213703c9c64cc61ba900531652e23c84728d2a2.xml
07.01.2021  19:31           144 016 dosvc.dll
               2 File(s)        144 075 bytes

 Directory of C:\Windows\WinSxS\amd64_microsoft-windows-deliveryoptimization_31bf3856ad364e35_10.0.17763.1697_none_17cf181298e5b907\r

21.01.2021  21:22    <DIR>          .
21.01.2021  21:22    <DIR>          ..
07.01.2021  19:31                56 2213703c9c64cc61ba900531652e23c84728d2a2.xml
07.01.2021  19:31           143 705 dosvc.dll
               2 File(s)        143 761 bytes

     Total Files Listed:
               6 File(s)      1 859 690 bytes
               8 Dir(s)  41 399 934 976 bytes free

Maxstar · Oct 8, 2024

Please follow these instructions to run the

Farbar Recovery Scan Tool with system privileges.

Download the 64 bit version: - Farbar Recovery Scan Tool Link

Warning: This script was written specifically for this system. Do not run this script on another system.

Download PsExec from Microsoft Sysinternals to your desktop.
Unzip PsTools.zip to its own directory on the system drive, for example: C:\Tools\PsTools
Navigate in an elevated command prompt to the PsTools directory: cd C:\Tools\PsTools.
Now copy and paste the following command into the command prompt and press enter. Click on the Agree button when the licence agreement of PsExec appears.
Note: Ensure that both FRST64.exe and the Fixlist.txt file are on your desktop! Otherwise you'll need to ammend the command to the right location.
Code:
```
psexec -i -d -s "%userprofile%\desktop\FRST64.exe"
```
FRST will make a new backup of the registry first, please wait until this process is completed.
Ensure the provided Fixlist.txt is in the same location as FRST64.exe and then press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally.
When finished, a log called Fixlog.txt will appear in the same directory the tool is run from.
Post the logfile Fixlog.txt as attachment in your next reply.

MoZi · Oct 8, 2024

please find the fixlog.txt attached

Maxstar · Oct 8, 2024

Please run the following commands again and copy paste the result in your next post.

Code:

sc start DoSvc

...wait a few seconds and run the following commands:

Code:

sc query DoSvc
sc qc DoSvc

MoZi · Oct 8, 2024

unfortunately the same

Code:

sc start DoSvc

SERVICE_NAME: DoSvc
        TYPE               : 30  WIN32
        STATE              : 2  START_PENDING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x7d0
        PID                : 1216
        FLAGS              :
       
       

sc query DoSvc

SERVICE_NAME: DoSvc
        TYPE               : 30  WIN32
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1066  (0x42a)
        SERVICE_EXIT_CODE  : 2147942402  (0x80070002)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0



sc qc DoSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: DoSvc
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Windows\System32\svchost.exe -k NetworkService -p
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Delivery Optimization
        DEPENDENCIES       : rpcss
        SERVICE_START_NAME : NT Authority\NetworkService

Maxstar · Oct 8, 2024

Which security software is installed on this server?

[SOLVED] VM Server 2019 Configuration Registry Database Corrupt

Windows Update Trainee

Moderator, Windows Update Expert, Security Analyst

Windows Update Trainee

Moderator, Windows Update Expert, Security Analyst

Windows Update Trainee

Moderator, Windows Update Expert, Security Analyst

Attachments

Windows Update Trainee

Attachments

Moderator, Windows Update Expert, Security Analyst

Windows Update Trainee

Moderator, Windows Update Expert, Security Analyst

Windows Update Trainee

Moderator, Windows Update Expert, Security Analyst

Windows Update Trainee

Moderator, Windows Update Expert, Security Analyst

Windows Update Trainee

Moderator, Windows Update Expert, Security Analyst

Attachments

Windows Update Trainee

Attachments

Moderator, Windows Update Expert, Security Analyst

Windows Update Trainee

Moderator, Windows Update Expert, Security Analyst