System infected by Stealer/Coinminer malware, Windows Update services deleted (Error 1053)

Question

Hello,

I am creating this new thread as requested by Volunteer Moderator Ramesh in a previous discussion.

My system issues: My PC was recently infected by a combination of Stealer and Coinminer malware. The malware compromised my social media accounts and caused abnormal CPU usage spikes that hide when Task Manager is opened.

What I have done so far:

Disconnected from the internet, changed all critical passwords, and enforced 2FA on another clean device.

Scanned and removed threats using Windows Defender Offline, Malwarebytes Free, and Kaspersky Virus Removal Tool (KVRT) in Safe Mode.

Cleared the Temp folders and checked Task Scheduler/Registry for malicious entries.

Current problem: Windows Update is completely broken. When trying to access it in Settings, it shows an error. Attempting to manually start the Windows Update service (wuauserv) results in Error 1053: The service did not respond to the start or control request in a timely fashion. Commands like sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth ran successfully but did not fix the issue.

As instructed, I ran the Farbar Service Scanner (FSS). The log indicates that the registry keys for critical services like wuauserv, BITS, UsoSvc, WaaSMedicSvc, and dosvc are missing (deleted by malware), and there is a policy restriction placed on Windows Update.

FSS Log: Here is the link to my FSS.txt file for your review: FSS.txt

Could you please provide a fixlist to restore these services, or advise if a Clean Install is the only safe option left?

Thank you for your time and assistance!

Answer 1

Please run the fixlist below.

• Download fixlist.txt
• Save Fixlist.txt to the same folder as FRST64English.exe.
• Close all programs.
• Launch the Farbar Scanner tool and click "Fix".
• Restart Windows if prompted.
• Upload the output log file (FixLog.txt) in your next reply.

---

NOTE: The fixlist.txt script was written specifically for this user and for use on that particular machine. It is not recommended to run it on another machine, and don't run the same fixlist.txt more than once.

---

The fixlist will clear temp files and your browser's cache and cookies. You may have to sign-in again to websites.

Answer 2

Please share your Farbar scan logs for analysis.

• Download Farbar Recovery Scan Tool 64-bit FRST64.exe
• If the OS language is not English, rename FRST64.exe to FRST64English.exe.
• Run the program. Don't check or uncheck any options. Click "Scan".
• Add the two logs, FRST.txt and Addition.txt, to a zip archive.
• Share the zip file on OneDrive or GoFile.io, and post the link here.

---

Note: If Microsoft Edge or Chrome mislabels the Farbar Scanner executable as PUA/malware, choose to keep it by tapping … in the bottom bar, choosing Keep, and then choosing Keep anyway in the dialog that appears. See this screenshot. It's a safe tool used in most antimalware forums.

---