Logo

Fix Windows Update Error Code 0x8e5e0147

As you already know, the Windows Update mechanism in Windows 10 is a bit complex as it depends on thousands of files and services in order to properly function. There are DLL files and services that support this mechanism’s proper functioning. And so if there is any malfunction with any of these files or services, it will result in some errors when running Windows Update. One of these errors is the error code 0x8e5e0147 which has the following error message:

“There was a problem installing some updates, but we’ll try again later. If you keep seeing this and want to search the web or contact support for information, this may help – Error 0x8e5e0147”

To fix this error, there are several methods you can try. You can run the Windows Update troubleshooter or reset the Windows Update components manually or clear the SoftwareDistribution folder and install the update manually. You could also reset the Windows Update Agent to default using a command in PowerShell.

Option 1 – Try to run the Windows Update troubleshooter

The first thing you can do to fix the Windows Update error code 0x8e5e0147 is to run the Windows Update Troubleshooter. To run it, go to Settings and then select Troubleshoot from the options. From there, click on Windows Update and then click the “Run the troubleshooter” button. After that, follow the next on-screen instructions and you should be good to go.

Option 2 – Try to reset the Windows Update components

If by any chance that the third option didn’t work, you can also try resetting the Windows Update components as it could also help you resolve the Windows Update error. How? Refer to the following steps:

  • Open Command Prompt with admin privileges.
  • After that, type each one of the following commands and hit Enter after you key in one after the other.
    • net stop wuauserv
    • net stop cryptsvc
    • net stop bits
    • net stop msiserver

Note: The commands you entered will stop the Windows Update components such as Windows Update service, Cryptographic services, BITS and MSI Installer.

  • After disabling WU components, you need to rename both the SoftwareDistribution and Catroot2 folders. To do that, type each one of the following commands below and don’t forget to hit Enter after you type one command after the other.
    • ren C:/Windows/SoftwareDistribution/SoftwareDistribution.old
    • ren C:/Windows/System32/catroot2/Catroot2.old
  • Next, restart the services you’ve stopped by entering another series of commands. Don’t forget to hit Enter after you key in one command after the other.
    • net start wuauserv
    • net start cryptsvc
    • net start bits
    • net start msiserver
  • Close Command Prompt and reboot your PC.

Option 3 – Try downloading and installing the Windows Updates manually

Windows Update error code 0x8e5e0147 might be due to a Windows Update that has failed. So if it is not a feature update and only a cumulative update, you can download the Windows Update and install it manually. But first, you need to find out which update has failed, and to do so, refer to the following steps:

  • Go to Settings and from there go to Update and Security > View Update History.
  • Next, check which particular update has failed. Note that Updates that have failed to install will be displayed under the Status column which has a label of “Failed”.
  • After that, go to the Microsoft Download Center and look for that update using its KB number and once you find it, download and then install it manually.

Note: You can also use the Microsoft Update Catalog, a service from Microsoft that provides a list of software updates that can be distributed over a corporate network. With the help of this service, it can be easier for you to find Microsoft software updates, drivers as well as fixes.

Option 4 – Try to reset the Windows Update Agent

Since you can’t update the Windows Update Agent on your Windows 10 computer manually, you can try resetting it instead and you can do it using the Reset Windows Update Agent tool which you can download from the official Microsoft website. This tool allows you to:

    • Scan all protected system file and replace the corrupted one’s (sfc /scannow)
    • Scan, detect, and repair corruptions in Windows system image
    • Clean up superseded components
    • Reset Windows Update components
  • Change invalid values in Windows Registry
  • Delete temporary files

Moreover, this tool also allows you to carry out these operations:

  • Open Internet Explorer settings
  • Search for Windows Updates
  • Explorer for local or online solutions
  • Restart your computer

Do You Need Help with Your Device?

Our Team of Experts May Help
Troubleshoot.Tech Experts are There for You!
Replace damaged files
Restore performance
Free disk space
Remove Malware
Protects WEB browser
Remove Viruses
Stop PC freezing
GET HELP
Troubleshoot.Tech experts work with all versions of Microsoft Windows including Windows 11, with Android, Mac, and more.

Share this article:

You might also like

The request failed due to a fatal device hardware error
When you are copying some files from your computer to your hard disk and vice versa or when you have several disks connected to your Windows 10 computer and you suddenly receive an error message saying, “The request failed due to fatal device hardware error”, then this means that there is some issue with the hardware of your computer. This issue might be caused by various reasons but whatever they may be, this post will guide you on how you can fix the “The request failed due to fatal device hardware error”. To fix the error, here are some suggestions that could help.

Option 1 – Check for any hard disk errors

  • On your desktop, right-click on the “This PC” or computer icon and then select Manage to open the Disk Management. Here you get to check your drive’s health.
  • Next, click on Disk Management on the left side panel.
  • From there, check the state of your drives. If it shows that all your partitions are healthy then it means all is good and that the problem may have something to do with some physical issues with your hard drive.

Option 2 – Run the CHKDSK utility

When it comes to some issues concerning the hard drive or removable devices, there is a utility in Windows that might help which is called “chkdsk”. This error check utility can help with several issues in the system including “The request failed due to fatal device hardware error”.
  • Tap the Win + S keys to open the Search box.
  • Then type “command prompt” in the field and from the search results that appear, right-click on Command Prompt and select “Run as administrator”.
  • After opening an elevated command prompt, copy and paste the following command and hit Enter:
CHKDSK [volume [[path] filename]] [/F] [/V] [/R] [/X] [/C] [: size]]
Note: In the command given above, “[/F]” will try to fix the system errors while “[/R]” will be the one to fix the bad sectors.
  • Now if you are prompted to run CHKDSK after your reboot your PC, just tap Y and reboot your PC.
  • If CHKDSK is not able to find any errors, tap the Win + E keys and navigate the access window. From there, right-click on the concerned drive and click on Properties.
  • After opening Properties, click on the tab Tools and then click on the “Check” button under the Error-checking section.
  • Wait until the process is completed and then restart your computer

Option 3 – Verify the hard drive using SMART attributes

In case you don’t know, Windows has a built-in feature of SMART analysis which analyzes the hard drive/SSD and checks all the parameters by performing some minor operations. To use it, follow these steps:
  • Tap the Win + S keys and type “command prompt” in the field then right-click on the related search result and select the “Run as administrator” option.
  • After opening Command Prompt as admin, type the “wmic disk drive get status” command and hit Enter.
  • You should get a result after that, and if you see that it’s “normal”, proceed to the next option below.

Option 4 – Format your hard disk

You can try formatting your drive since this problem also occurs on removable hard drives. In addition, if your drive is not properly initialized, this error will really pop up. Thus, you need to make sure that the hard drive is initialized and that the correct partition style is selected.
  • To get started formatting your drive, tap the Win + E keys and then go to the access page of the drive.
  • Next, right-click on the drive and select Format.
  • After that, uncheck the “Quick Format” option and then format your drive properly.
  • Now once the formatting process is finished, unplug the drive and plug it back in afterward.
  • Check if the error is already fixed. If the drive is not initialized, tap the Win + R keys and hit Enter.
  • After opening the Run dialog box, type “diskmgmt.msc” and hit Enter to open Disk Management.
  • From there, right-click on the drive volume and select Initialize Disk.
  • Next, select the correct partition type and proceed.
Read More
Fix Copy & Paste issue in Windows 10
Copy & Paste function is an essential option in properly working Windows, from copying text to weblinks and many other sources like pictures and files it is one of the crucial features in Windows. When the copy and paste feature is not working we are somewhat left in Windows limbo, essentially Windows itself is working but without this specific feature it is very hard, almost impossible to get any work done, if you are an unfortunate user who has faced this particular issue do not worry, we have solutions for you.
  1. Update Windows

    Glitches come in various forms and sometimes they are introduced in updates, check to see if it is available Windows update and if it, download and install it, there is a very high chance that the next update will bring fixes for known glitches.
  2. Disable antivirus

    A good antivirus is an essential piece of software for any PC, however, sometimes it can interfere with the basic operations of windows itself. Disable it completely to see if copying and pasting will start to work, if this is a case, see can you somehow turn options off in antivirus or switch to another one.
  3. Run Check disc

    Corrupted applications and system files can cause issues with Windows functioning, the easiest way to solve this issue is to run build-in Windows Check disk utility and let it scan and fix potential issues.
  4. Run SFC

    If the check disk failed to fix the issue, run command prompt as administrator and type in sfc /scannow, file checker will go through all files and fix if it finds anything including corrupted system files. Reboot your system after the operation completes. Please note that an SFC scan can take a long time sometimes, do not interrupt the scanning process and leave it to finish.
  5. Restart rdpclip process

    Restarting rdpclip.exe can solve the issue. Open task manager and under process find rdpclip.exe, right-click on it and end it, then go to windows/system32 and search for rdpclip.exe and double click it. Please note that you will be able to find this process only if you are on a remote PC machine, on a local user machine rdpclip is not running.
  6. Rollback to the previous system restore point

    If this particular issue was introduced in the latest update and previous solutions have not worked, roll back to the restore point where everything was working as it should.
  7. Stop virtualization

    if you are using virtual software there is a chance that the shared clipboard feature is interfering with Windows, turn the Virtual machine off and try copy & paste again.
Read More
Removing old drivers from Windows 10
So you have just got home from that new computer store with your fancy and all-new mouse, screen, keyboard, etc. You plugged in your new component, Windows detected it, installed drivers for it and it is working like a charm. A few months later down the road and the computer starts little by little to slow down. Plug and play is a great concept, and automatic detection is even greater but how time passes old unused stuff piles in your hard drive and in Windows itself thus slowing down your computer and taxing it more and more as new components and software are added. Old drivers from old components sadly are not removed from Windows itself and over some larger period of time they can pile up and slow down your daily operations on the computer or even cause some problems in it. This guide will teach you how to manually remove old unused device drivers from your Windows so it is fresh and like new again.

Making old devices visible

In order for us to remove old drivers, the first thing we must do is make them visible in our device manager, old drivers are hidden and will not show up, we must make this happen. We do this by pressing WINDOWS + X keys on your keyboard to bring up a hidden menu in Windows. keyboard with windows and x markedOnce the menu appears, click on Command Prompt (admin) Windows menu command prompt adminOnce the command prompt with administrator privileges comes on-screen type in it following string: The device manager will open, go to view > snow hidden devices in order to show unused devices. device manager show hidden devices

Removing old device

Open any category and if there is a device that was once used and still has its drivers in the system it will be shown as faded out. device manager hidden device shownRight-click on the device and click on uninstall device to remove it completely from your system. device manager uninstall device driverPlease always be careful when removing devices so you do not remove the device which is being used by mistake and always double-check that you are removing something that you used to have on your system. This method will show all hidden devices even ones that are hidden but crucial to the system working properly.
Read More
Can’t type in Win apps, Search, Cortana, etc.
If you are typing inside the Search bar, Cortana, Taskbar, Windows 10 apps, etc., and then everything seems invisible then read on as this post will guide you in fixing this issue. At first, you might think that something is wrong with your keyboard but it really has nothing to do with it. The problem actually lies with the apps from Microsoft Store. Thus, if you can’t type anything in any of the apps from Microsoft Store in Windows 10, refer to the options given below to fix them.

Option 1 – Ensure that ctfmon.exe is running

Ctfmon.exe is a Microsoft process in Windows 10 that controls the Alternative User Input as well as the Office Language bar. In other words, it enables end-users to control the computer using on-screen keyboard inputs, speech, and even pen for various languages. It would be better if you launch the program once by going to the C:/Windows/system32 folder. Doing so will ensure that whatever API is needed for the keyboard typing to work properly again. You also have to make sure that its startup status is not disabled. In addition, you can also try the following steps, alternatively.
  • Open the Task Scheduler.
  • Then go to Microsoft > Windows > TextServicesFramework.
  • And on the MsCtfMonitor, right-click and enable the task.
  • Now restart your computer.
This will ensure that all the text boxes will start to work again. And if the task MsCtfMonitor is missing from the list of tasks, you can import it with the XML file from basics.net. Then download and create a task to run it each time you log in to your PC.

Option 2 – Use the Windows Store Apps Troubleshooter

You might also try running the Windows Store Apps Troubleshooter as it can help in resolving issues with the Windows Store apps. This built-in tool can resolve most of the app-related problems. To use it, go to Settings > Update & Security > Troubleshooting > Windows Store Apps and from there, click the start the troubleshooter button. The Windows Store Apps Troubleshooter will scan the computer for any issues with the Windows store apps and will automatically fix them if it finds any.

Option 3 – Re-register all the Windows 10 UWP apps using PowerShell

  • First, make sure to close all the running applications on your computer.
  • Next, in the Start search, type in PowerShell and right click on the result, and select the “Run as administrator” option.
  • After that, type the following commands to re-register the Windows 10 apps. Make sure to hit Enter on each line:
    • reg delete "HKCUSoftwareMicrosoftWindows NTCurrentVersionTileDataModelMigrationTileStore" /va /f
    • get-appxpackage -packageType bundle |% {add-appxpackage -register -disabledevelopmentmode ($_.installlocation + "appxmetadataappxbundlemanifest.xml")}
    • $bundlefamilies = (get-appxpackage -packagetype Bundle).packagefamilyname
    • get-appxpackage -packagetype main |? {-not ($bundlefamilies -contains $_.packagefamilyname)} |% {add-appxpackage -register -disabledevelopmentmode ($_.installlocation + "appxmanifest.xml")}

Option 4 – Try to run the DISM tool

You can also run the DISM Tool as it helps in repairing the Windows System Image as well as the Windows Component Store in Windows 10. Using this built-in tool, you have various options such as the “/ScanHealth”, “/CheckHealth”, and “/RestoreHealth” which could help in fixing the problem.
  • Open the Command Prompt with admin privileges.
  • Then type in the following commands and make sure to hit Enter right after you type each one of them:
    • Dism /Online /Cleanup-Image /CheckHealth
    • Dism /Online /Cleanup-Image /ScanHealth
    • exe /Online /Cleanup-image /Restorehealth
  • Do not close the window if the process takes a while as it will probably take a few minutes to finish.

Option 5 – Run the System File Checker Scan

System File Checker or SFC is a built-in command utility that helps in restoring corrupted files as well as missing files. It replaces bad and corrupted system files to good system files. To run the SFC command, follow the steps given below.
  • Tap Win + R to launch Run.
  • Type in cmd in the field and tap Enter.
  • After opening Command Prompt, type in sfc /scannow
The command will start a system scan which will take a few whiles before it finishes. Once it’s done, you could get the following results:
  1. Windows Resource Protection did not find any integrity violations.
  2. Windows Resource Protection found corrupt files and successfully repaired them.
  3. Windows Resource Protection found corrupt files but was unable to fix some of them.
  • Restart your PC.
Read More
Google docs crush with repeating a word

A newfound bug in Google docs is causing it to crush and upon reopening it will crush again making it very difficult to re-access your document. The bug is manifested when a series of the same word is typed into a document and Show grammar suggestion is turned on.

google doc bug

How was it found

A Google Docs user, Pat Needham brought up the issue on Google Docs Editors Help forum.

"I've only tried in Google Chrome, with documents from three separate Google accounts (personal, G Suite Basic, and work one which might be enterprise). All three experience this same issue".

"It's case-sensitive. So trying with 'and. and. And. and. And.' doesn't cause it to crash."

While Needham publicly reported the bug, it appears that the issue was discovered by Eliza Callahan who was writing a poem novel for her novel using Google Docs.

Needham's findings have also been confirmed by other users running Firefox 99.0.1

Another user, Sergii Dymchenko, said strings like "But. But. But. But. But." triggered the same response. Some also noticed putting any of the terms like "Also, Therefore, And, Anyway, But, Who, Why, Besides, However," in the same format achieved the outcome.

A YCombinator HackerNews reader suspected the cause to be the "Show grammar suggestion" option in Google Docs.

A Google spokesperson confirmed the presence of the issue adding, "we're aware of this issue and the team is working on a fix."

How to recover your document

First thing first, turn off Show grammar suggestions so you do not run into issue by accident. In order to turn it off go to Tools and then into Spelling and grammar and untick Show grammar suggestions.

Now, if you already have a document that has been crushed, fear not because there is a workaround to access it. For some strange reason this bug does not manifest on Google Docs mobile app, so you can open the crushed document in the mobile app, delete words that have caused the bug and reopen the document on your desktop.

Until Google comes up with the solution this is currently the only way to address the issue.

Read More
The system found unauthorized changes
If your Windows computer is not booting up and displays Secure Boot Violation – The system found unauthorized changes on the firmware, operating system, or UEFI drivers error message on the screen, then you can follow this tutorial to troubleshoot the problem. When you encounter this kind of problem on your computer, you will get the following error message on your screen:
“Secure Boot Violation The system found unauthorized changes on the firmware, operating system, or UEFI drivers. Press [OK] to run the next boot device or enter directly to BIOS Setup if there are no other boot devices installed. Go to BIOS Setup > Advanced > Boot and change the current boot device into other secured boot devices.”
This kind of error message pops up due to the Secure Boot that protects your computer from running any non-OEM signed boot software during startup. In other words, the Secure Boot firmware is the one that scans for non-signed boot software each time your computer boots up and if it detects anything strange, it will block the boot and will display the error message. To fix this error, there are two things you can try. You can try to disable the Secure Boot or try using a System Restore Point. For more detailed instructions, refer to each one of the options provided below.

Option 1 – Disable the Secure Boot in the BIOS

Disabling the Secure Boot in the BIOS settings is definitely recommended to resolve the issue. To disable Secure Boot, here’s what you have to do:
  • First, boot your computer into Windows 10.
  • Next, go to Settings > Windows Update. From there, check if there is anything that you have to download and install if you see any available updates. Usually, OEMs send and update the list of trusted hardware, drivers, and operating systems for your computer.
  • After that, go to the BIOS of your computer.
  • Then go to Settings > Update & Security > Advanced Startup options. If you click on Restart Now, it will restart your computer and give you all the advanced options.
  • Next, select Troubleshoot > Advanced Options. As you can see, this screen offers you further options including System restore, Startup repair, Go back to the previous version, Command Prompt, System Image Recovery, and UEFI Firmware Settings.
  • Select the UEFI Firmware Settings which will take you to the BIOS.
  • From there, go to the Security > Boot > Authentication tab where you should see Secure Boot. Note that every OEM has its own way of implementing the options so it varies.
  • Next, set Secure Boot to Disabled and set Legacy Support to On or Enabled.
  • Save the changes made and exit. Afterward, your computer will reboot.

Option 2 – Try running System Restore in Advanced Startup Options

Since you probably can’t boot into your Windows 10 computer, you can try to run System Restore again in the Advanced Startup Options.
  • Boot your computer into the Advanced Startup Options screen.
  • From there, you will see some options to troubleshoot when you can’t log in to Windows in the usual way.
  • Now select Troubleshoot > Advanced Options > Command Prompt.
  • After that, type “rstrui” and hit Enter to execute the command which will start the System Restore process.

Option 3 – Make a proper bootable USB Drive/Stick

To make a proper bootable USB drive, you need to use the Windows Media Creation tool. The Media Creation tool in Windows allows you to use the ISO installation file to make a bootable device that you can use to install Windows on your PC. Note that this is kind of different from the usual installation process as it could erase your computer’s current settings and data on the primary drive. Thus, before you proceed, you need to backup all your data into some removable drive and then use the Media Creation Tool to make a bootable drive.
  • After making the bootable drive, you need to plug it into your computer and then reboot.
  • Next, tap the F10 or Esc key to open the boot options.
  • Now set the boot priority of the removable drive the highest. Once the setup comes forth, follow the next onscreen instructions and install Windows without any problems.
Read More
Fix GWXUX has stopped working in Windows
If your Windows 10 computer is downloading or installing updates but suddenly an error pops up saying, “GWXUX has stopped working”, read on as this post will show you what you can do to resolve the problem. GWXUX is a process responsible for downloading and installing Windows updates and is installed on your computer via Windows Updates. That particular update is known as “KB3035583”. Through this process, the “Get Windows 10” pop-ups are installed and initiated by Microsoft. This process is also capable of checking the compatibility of your PC to run Windows 10 as well as preparing it for installation. However, this process might also result in excessive usage of Disk and sometimes, CPU. So in this post, you will be guided on how you can fix the issue with the GWXUX. Follow the instructions given below carefully.

Option 1 – Disable GWXUX in the Task Scheduler

You will have to disable the gwxux.exe process to run from the Task Scheduler. Thus, you need to follow the steps below to do so.
  • Open the Cortana Search box and then type “task scheduler” in the field.
  • Then click on Task Scheduler from the related search results that appear to open it.
  • After opening the Task Scheduler, navigate to Microsoft > Windows > Setup > gwx on the left panel from the Task Scheduler Library.
  • Once you select the GWX folder, you will see two tasks that are listed under that folder. Select both of these tasks and permanently disable them.
  • Restart your computer to apply the changes made and check if the issue is now fixed or not.

Option 2 – Uninstall the KB3035583 Windows Update

  • To uninstall the KB3035583 Windows Update, you need to go to Control Panel, and for you to do that, type “control panel” in the Cortana Search box.
  • After that, click on Control Panel from the related search results given.
  • Once Control Panel is pulled up, search for “View Installed Updates” in the search field from the top right part of the window.
  • Next, click on a link labeled, “View Installed Updates” under the Programs and Features menu.
  • After clicking the link, you will see the list of all the installed updates in your computer from the Windows Updates.
  • Now look for an update named “KB3035583” and select it.
  • You should notice the Uninstall button located at the top portion of the sub-menu ribbon as you can see on the snippet below. Click on that button to uninstall the KB3035583 Windows Update.
  • After uninstalling the update, make sure to restart your computer to apply the changes made.

Option 3 – Try using the System File Checker

System File Checker or SFC is a built-in command utility that helps in restoring corrupted files as well as missing files. It replaces bad and corrupted system files with good system files that might be causing the error 0x80200056. To run the SFC command, follow the steps given below.
  • Tap Win + R to launch Run.
  • Type in cmd in the field and tap Enter.
  • After opening Command Prompt, type in sfc /scannow
The command will start a system scan which will take a few whiles before it finishes. Once it’s done, you could get the following results:
  1. Windows Resource Protection did not find any integrity violations.
  2. Windows Resource Protection found corrupt files and successfully repaired them.
  3. Windows Resource Protection found corrupt files but was unable to fix some of them.
After running the System File Checker, restart your computer and check if the error with the GWXUX.exe file is now fixed or not.
Read More
A Quick Guide to Repair User32.dll Error Code

User32.dll Error Code - What is it?

User32.dll is a Dynamic Link Library file. Windows stores instructions for graphical elements such as dialog boxes and Windows in this file. This file is a crucial file, necessary to run Windows operations. If this file is damaged, deleted, or removed from the system you may not be able to run the programs on your system that use and share the User32.dll file thereby causing you inconvenience. The User32.dll file error is displayed in the following format:

“This application has failed to start because USER32.dll was not found. Reinstalling the application may fix this problem.”

Or

“[Program] illegal system DLL relocation”

Program here refers to the name of a program that caused the User32.dll error message.

Solution

Restoro box imageError Causes

User32.dll errors are triggered by the following reasons:
  • Missing and damaged .dll files
  • Viral infection
  • Registry corruption
User32.dll error is also referred to as C0000135 blue screen of death error. When the User32.dll error occurs it not only locks you out of your desired program but also turns your computer screen blue. If the error is not repaired timely it may expose your PC to serious threats such as abrupt system shutdowns, system failure, and crash.

Further Information and Manual Repair

To resolve the User32.dll error on your PC, try the following solutions:

1. Reinstall Programs Causing User32.dll errors

Sometimes User32.dll error may occur due to missing DLL files.  This happens when you delete a program from your PC and accidentally the DLL file also gets deleted which is shared by other programs on your system. Therefore to resolve this first find out what programs on your system use User32.dll to load and run on your system. To do this use the Tasklist command-line tool. It displays the names of all the programs that currently use the User32.dll file. After this, reinstall the programs that use User32.dll files on your system. This will hopefully resolve the error.

2. Install and Run Restoro

If it doesn’t, then this probably means that the damage is deep-rooted. It is related to the damaged DLL files, registry corruption, or viral infection. To resolve all of these causes in one go, it is best to download Restoro instead of downloading 3 different software to resolve each cause for the error separately. This is basically an advanced, innovative, and multi-functional PC repair tool embedded with multiple powerful utilities including a registry cleaner, and a system optimizer. It is a one-stop solution for all your PC-related problems including the User32.dll error. The registry cleaner wipes the clutter and obsolete files damaging the hard disk and simultaneously repairs the DLL files and the registry. The antivirus feature removes all the viruses on your system while the system stability utility boosts the PC speed significantly. It is safe, user-friendly, and compatible with all Windows versions including Windows Vista, XP, Windows 7, 8, 8.1, and 10. Click here to download Total System Care to resolve the User32.dll error right away.
Read More
Hive ransomware on Exchange servers

Hive ransomware has been targeting Microsoft exchange servers lately vulnerable to ProxyShell security issues in order to deploy various backdoors. Once the backdoor has been placed various attacks can be performed including but not limited to network reconnaissance, stealing admin accounts, taking valuable data, and even installing and deploying file-encrypting algorithms.

hive ransomware

ProxyShell wide abuse

ProxyShell is a set of three vulnerabilities in the Microsoft Exchange Server that allows remote code execution without authentication on vulnerable deployments. The flaw has been used in past by various ransomware like Conti, BlackByte, Babuk, Cuba, and LockFile.

Security vulnerabilities have been reported to be fully patched on May 2021 but how Hive was able to still be successful in exploiting PowerShell and infiltrating into the system there seems to be still some unpatched and open issues.

Hive

Hive has gone a long way since it was first observed in the wild back in June 2021, having a successful start that prompted the FBI to release a dedicated report on its tactics and indicators of compromise.

In October 2021, the Hive gang added Linux and FreeBSD variants, and in December it became one of the most active ransomware operations in attack frequency.

Last month, researchers at Sentinel Labs reported on a new payload-hiding obfuscation method employed by Hive, which indicates active development.

Read More
Fatal error occurred while trying to sysprep
There are several kinds of errors you could encounter when you are running Windows 10 on a virtual machine. The Windows OS knows the difference between booting up in a standalone computer or in a virtual machine. This is why some specific drivers and system capabilities are used while emulating the Windows OS on software and during this phase, there are times when the System Preparation may throw up an error that says, “A fatal error occurred while trying to sysprep the machine”. This kind of error arises due to a race condition wherein the Sysprep command tries to stop the Microsoft Distributed Transaction Coordinator or MSDTC service and the VMware tool tries to start the MSDTC service. You may also see the following messages logged in the Setuperr.log file:
  • [0x0f0082] SYSPRP LaunchDll:Failure occurred while executing ‘C:Windowssystem32msdtcprx.dll,SysPrepDtcCleanup’, returned error code -2146434815[gle=0x000000b7]
  • [0x0f0070] SYSPRP RunExternalDlls:An error occurred while running registry sysprep DLLs, halting sysprep execution. dwRet = -2146434815[gle=0x000000b7]
  • [0x0f00a8] SYSPRP WinMain:Hit failure while processing sysprep cleanup providers; hr = 0x80100101[gle=0x000000b7]
To fix the 0x0f0082, 0x0f0070, 0x0f00a8 Sysprep errors, you can check out two potential fixes. First, you have to check the status of the MSDTC service and the second one is to check the settings in the Windows Registry. Note that these fixes are proven to be effective on many users and apply to several versions of Windows, including Windows 10.

Option 1 – Check the status of the MSDTC service via Command Prompt

As mentioned, the error could be caused by the malfunctioning of the MSDTC service or it. Thus, you have to uninstall and reinstall the MSDTC service to resolve the problem and you can do that using Command Prompt. Follow the steps below.
  • In the Start Search, type “command prompt” and from the results, right-click on Command Prompt and then select the “Run as administrator” option to open it with admin privileges.
  • If a User Account Control or UAC prompt appears, just click on Yes to proceed.
  • Once you’ve opened Command Prompt, execute this command: msdtc –uninstall
  • The command you just entered will uninstall the MSDTC service. After that, you need to execute this second command to reinstall the service: msdtc –install
  • Now exit Command Prompt and check if the error is now fixed.

Option 2 – Check the Registry settings

  • Tap the Win + R keys to open the Run dialog box and type “Regedit” in the field and click OK or hit Enter to open the Registry Editor.
  • After opening the Registry Editor, navigate to this registry path: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSoftwareProtectionPlatform
  • From there, look for a DWORD value that’s named “SkipRearm” and double click on it.
  • Then change its value data to “1”.
  • Restart your computer to apply successfully apply the changes made and check if it was able to fix the error.
Read More
1 2 3 171
Logo
Copyright © 2023, ErrorTools. All Rights Reserved
Trademark: Microsoft Windows logos are registered trademarks of Microsoft. Disclaimer: ErrorTools.com is not affiliated with Microsoft, nor claims direct affiliation.
The information on this page is provided for information purposes only.
DMCA.com Protection Status