Troubleshoot RKill shows missing services

TheBlue262

Level 3
Thread author
Verified
Well-known
Dec 24, 2015
128
Briefly explain your current issue(s)
When RKill finished scanning, the text file said missing services.
Steps taken to resolve, but have been unsuccessful
Followed the How to remove trojans, spyware, rogues and other malware Guide.
When I used RKill, the text file showed this :

Checking Windows Service Integrity:

* EventSystem (EventSystem) is not Running.
Startup Type set to: Automatic

* wscsvc (wscsvc) is not Running.
Startup Type set to: Automatic

* fcvsc [Missing Service]
* HdAudAddService [Missing Service]
* HyperVideo [Missing Service]
* netvsc [Missing Service]
* tunnel [Missing Service]
* wfpcapture [Missing Service]

* CompositeBus => \SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_912dfdedc3d2f520\CompositeBus.sys [Incorrect ImagePath]
* NgcSvc => %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted [Incorrect ImagePath]
* swenum => \SystemRoot\System32\drivers\swenum.sys [Incorrect ImagePath]
 
S

Smith83

sfc /scannow is not going to replace any missing services, it only replaces corrupt .dll files.

You would want to do this....

All in one repair tool.


Install (use the direct download) the Tweaking.com - Windows all in one repair tool. Then boot Windows into Safe Mode, (Make Certain To Run This Program As Administrator) then run through the Prescan on step 2 tab. Then skip to step 5 and create a system restore point. Then go to the repair tab...


Notice create a registry backup is ticked by default, so no need to do so in step 5...
mAcI3sC.png




Now run the program, with the boxes ticked in the picture below.




Click image for better resolution.

KWdvRSp.png




May want to save picture or write down what boxes need ticked, since you will run this in Safe Mode.


Important: Make certain to reboot twice after running this tool!!
 
Upvote 0

DracusNarcrym

Level 20
Verified
Top Poster
Well-known
Oct 16, 2015
970
sfc /scannow is not going to replace any missing services, it only replaces corrupt .dll files.

You would want to do this....

All in one repair tool.


Install (use the direct download) the Tweaking.com - Windows all in one repair tool. Then boot Windows into Safe Mode, (Make Certain To Run This Program As Administrator) then run through the Prescan on step 2 tab. Then skip to step 5 and create a system restore point. Then go to the repair tab...


Notice create a registry backup is ticked by default, so no need to do so in step 5...
mAcI3sC.png




Now run the program, with the boxes ticked in the picture below.




Click image for better resolution.

KWdvRSp.png




May want to save picture or write down what boxes need ticked, since you will run this in Safe Mode.


Important: Make certain to reboot twice after running this tool!!
@TheBlue262, follow @Smith83's suggestion and guidelines above, Windows Repair by Tweaking.com is a trusted and safe-to-use application. (it's pretty much a tool which automatically performs fixes for broken Windows objects, as those fixes are detailed in numerous guides posted at tweaking.com)
 
Upvote 0
S

Smith83

When I used RKill, the text file showed the same missing services. I guess it's not a big issue since I'm not noticing any difference.


I have not used rkill on windows 10, as I do not run windows 10. Might actually be a bug?? If you want you can always create a thread in the virus removal area here, to see if there is anything going on.
 
Upvote 0

TheBlue262

Level 3
Thread author
Verified
Well-known
Dec 24, 2015
128
This one you should be a litlle worried about, Windows Security Center service.
This is the new text file after running tweaking.

Checking Windows Service Integrity:

* fcvsc [Missing Service]
* HdAudAddService [Missing Service]
* HyperVideo [Missing Service]
* netvsc [Missing Service]
* tunnel [Missing Service]
* wfpcapture [Missing Service]

* CompositeBus => \SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_912dfdedc3d2f520\CompositeBus.sys [Incorrect ImagePath]
* NgcSvc => %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted [Incorrect ImagePath]
* swenum => \SystemRoot\System32\drivers\swenum.sys [Incorrect ImagePath]
 
  • Like
Reactions: DracusNarcrym
Upvote 0
S

Smith83

Was this an upgrade to windows 10, or did you clean install it? Might be a good idea to clean install if this was an upgrade, those usually do not workout well.. But then again, what prompted you to run rkill? Was there issues with malware?
 
Upvote 0

TheBlue262

Level 3
Thread author
Verified
Well-known
Dec 24, 2015
128
I think this was a partial clean install. It wasn't a complete clean install so I can try a complete clean install. I ran rkill because I was trying out the malware removal guide.
 
  • Like
Reactions: DracusNarcrym
Upvote 0
S

Smith83

A complete clean install will save you some headache in the future, especially now if you are willing to do it. Before you have a lot of information on the machine. Might be a good idea to make a backup on the machine, once you get it setup the way you want.
 
Upvote 0

TheBlue262

Level 3
Thread author
Verified
Well-known
Dec 24, 2015
128
A complete clean install will save you some headache in the future, especially now if you are willing to do it. Before you have a lot of information on the machine. Might be a good idea to make a backup on the machine, once you get it setup the way you want.
Ok, that should be all. I found out my friend has the same missing services and he upgraded to windows 10 too. Thanks for everyone's help! :)
 
  • Like
Reactions: DracusNarcrym
Upvote 0

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top