{"id":1477,"date":"2019-03-07T04:07:37","date_gmt":"2019-03-07T12:07:37","guid":{"rendered":"http:\/\/wonghoi.humgar.com\/blog\/?p=1477"},"modified":"2019-03-08T14:09:22","modified_gmt":"2019-03-08T22:09:22","slug":"malware-deleting-trustedinstaller-exe","status":"publish","type":"post","link":"https:\/\/wonghoi.humgar.com\/blog\/2019\/03\/07\/malware-deleting-trustedinstaller-exe\/","title":{"rendered":"Malware deleting TrustedInstaller.exe, therefore crippling Windows"},"content":{"rendered":"

My sister’s computer is<\/del> was infected with a bunch of stubborn malware. Even after cleaning the offending files, a lot of things won’t<\/del> wouldn’t work.<\/p>\n

Windows Update, run sfc \/scannow, or DISM \/Online \/Cleanup-Image fails with unknown reasons, which I found it somehow related to “Windows Module Installer” service not running.<\/p>\n

I saw something weird in services.msc: “Windows Module Installer” doesn’t exist, but I know the underlying name is “TrustedIntaller” and noticed a service named as such is there, but it cannot be started, nor there are any descriptive information.<\/p>\n

So I searched registry for “TrustedInstaller” and got to its entry. I noticed these two:<\/p>\n

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\TrustedInstaller]\r\n\"DisplayName\"=\"@%SystemRoot%\\\\servicing\\\\TrustedInstaller.exe,-100\"\r\n\"Description\"=\"@%SystemRoot%\\\\servicing\\\\TrustedInstaller.exe,-101\"<\/pre>\n
It means the meaningful names and descriptions I saw on services.msc are generated by calling the underlying\u00a0 service executable file with switches. I checked my “C:\\Windows\\servicing” and found that “TrustedInstaller.exe” is not there at all! Of course you cannot start a service where the file does not exist at the promised path (ImagePath).<\/p>\n
I searched the hard drive and found only one instance of the file stored somewhere (like C:\\Windows\\winsxs\\x86_microsoft-windows-trustedinstaller_31bf3856ad364e35_6.1.7600.16385_none_90e389a7ae7a4b6c) and I tried to move the file to\u00a0“C:\\Windows\\servicing”. However the ownership and permissions to write to “C:\\Windows\\servicing” goes to “TrustedInstaller” account, not “Administrator”, so I took the ownership, gave Administrator full rights, then move the file over.<\/p>\n
Everything worked after that! Just the mere trick of deleting TrustedInstaller.exe is enough to make the user miserable trying to clean the system up! “sfc \/scannow” or the like requires TrustedInstaller\/WIM to be working in the first place, so you cannot use it to repair TrustedInstaller\/WIM problems.<\/p>\n
<\/div>\n
<\/path><\/svg><\/i> \"Loading\"<\/p>\n
<\/div>\n","protected":false},"excerpt":{"rendered":"
My sister’s computer is was infected with a bunch of stubborn malware. Even after cleaning the offending files, a lot of things won’t wouldn’t work. Windows Update, run sfc \/scannow, or DISM \/Online \/Cleanup-Image fails with unknown reasons, which I … Continue reading →<\/span><\/a><\/p>\n
<\/div>\n
<\/path><\/svg><\/i> \"Loading\"<\/p>\n
<\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[6,4],"tags":[],"class_list":["post-1477","post","type-post","status-publish","format-standard","hentry","category-note-to-self","category-windows"],"_links":{"self":[{"href":"https:\/\/wonghoi.humgar.com\/blog\/wp-json\/wp\/v2\/posts\/1477","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wonghoi.humgar.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wonghoi.humgar.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wonghoi.humgar.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wonghoi.humgar.com\/blog\/wp-json\/wp\/v2\/comments?post=1477"}],"version-history":[{"count":9,"href":"https:\/\/wonghoi.humgar.com\/blog\/wp-json\/wp\/v2\/posts\/1477\/revisions"}],"predecessor-version":[{"id":1487,"href":"https:\/\/wonghoi.humgar.com\/blog\/wp-json\/wp\/v2\/posts\/1477\/revisions\/1487"}],"wp:attachment":[{"href":"https:\/\/wonghoi.humgar.com\/blog\/wp-json\/wp\/v2\/media?parent=1477"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wonghoi.humgar.com\/blog\/wp-json\/wp\/v2\/categories?post=1477"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wonghoi.humgar.com\/blog\/wp-json\/wp\/v2\/tags?post=1477"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}