Jump to content

Why doesn't Apache httpd HTTPD service no longer auto-start?


Recommended Posts

Alert: Maiden post (here). Please be kind to me!

 

I've been running Apache httpd (as a service) under Windows for many years.  Recently, on my Windows 7 x64, it has ceased starting automatically. It had been working for years.

 

The service has two dependencies, "Ancillary Function Driver for Winsock" and "TCP/IP Protocol Driver" but both of these seem to be running. (Nirsoft told me about the Winsock service, but nothing about the Protocol service.  Device Manager found no error in the TCP/IP Protocol Driver)

 

HTTPD is also set to  "Automatic (Delayed Start)".  A little research on this showed that delayed services are started after all the non-delayed automatic services have started.  Might the problem be that one or more of the non-delayed automatic services is failing to start?

 

Or maybe I'm just being a bit impatient? What's a reasonable time to wait until the delayed services get started?  My PC is no sluggard, it was the fastest PC I could find (consistent with being quiet) when I retired in 2012. So it has four i7 processors (8 with hyperthreading), 16Gb RAM, and a 256Gb SSD C: drive.

 

Is there some way to display the service "Fail Count"? For all I know, it may be trying to start, but failing. I suspect I'd notice this, one way or another. 

 

HTTPD service does start manually, so there seems to be nothing fundamentally wrong.

Link to post
Share on other sites

Coo! A bug. The post (above) showed "1 posts". Needs a fix (pseudo code):

  If N = 1 then print "1 post"

  Else print N "posts"

 

I've applied my own bypass... should now show "2 posts"...

 

Incidentally, I use a function to cater for this situation, called plural(); my code would look like this:

 

  Say plural(N,"post")

 

... plural() is one of my most frequently used functions.

Link to post
Share on other sites

You may be lucky and find someone who could assist you here, but for the most part, we are focused on problems related to Malwarebytes anti-malware and anti-exploit software, and those pesky critters that we try to snuff out.  You may want to try over on this forum instead:

 

http://www.bleepingcomputer.com/forums/

 

Not trying to discourage you, but you may have better luck there.  

Link to post
Share on other sites

I've attached the three logs as requested.

 

I really appreciate your help.  Note that the problem (Apache httpd 2.4 service not starting) is easily circumvented by starting it manually, so don't spend too much effort on this.

 

In  the meantime, I'll reboot my system and wait for up to 30 minutes to see if the Apache2.4 service starts eventually. I've never been that patient before!

Addition.txt

CheckResults.txt

FRST.txt

Link to post
Share on other sites

  • Root Admin

I know you're doing things a bit more advanced than other average users but do you really need/want these set? This not a best practice anymore and it's use frowned upon by Microsoft though some users and vendors do continue to use it.

 

 

IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\browsersafeguard.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\searchinstaller.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\searchsettings.exe: [Debugger] tasklist.exe
IFEO\searchsettings64.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\taskmgr.exe: [Debugger] "C:\$USER\TOOLS\PROCEXP.EXE"
IFEO\umbrella.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
IFEO\websteroids.exe: [Debugger] tasklist.exe
IFEO\websteroidsservice.exe: [Debugger] tasklist.exe

 

 

This could be a valid file that may be locked so that accurate information cannot be gathered but the log thinks it's 0 byte size. Please double check the file is valid and what it's for.

 

U3 a9qwjm9b; C:\Windows\System32\Drivers\a9qwjm9b.sys

 

 

Verify this file is valid and is needed as its run as a task

System32\Tasks\Digital Sites => C:\Users\Steve\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE

Task: C:\Windows\Tasks\Digital Sites.job => C:\Users\Steve\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE

 

These could be valid but without checking further its hard to save. Could be good or bad.

AlternateDataStreams: C:\ProgramData\TEMP:4FC01C57
AlternateDataStreams: C:\ProgramData\TEMP:9A870F8B

 

This needs to be fixed as it will cause all sorts of odd behavior

Error: (05/22/2015 07:36:10 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: The Windows Search Service is being stopped because there is a problem with the indexer: The catalog is corrupt.

 

Please visit the following site and run the fixit tool from Microsoft.
Fix Windows Desktop Search when it crashes or not showing results
 

You're loading a driver that appears to not be supported on your version of Windows

 

Error: (05/26/2015 08:26:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The PMEM service failed to start due to the following error:
%%1275

Error: (05/26/2015 08:26:47 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Windows\SysWOW64\drivers\pmemnt.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
 

You should look at trying to correct these errors as well.

 

Error: (05/23/2015 03:51:42 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureCommand with the following error:
%%5

Error: (05/23/2015 03:51:18 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for Start with the following error:
%%5

Error: (05/22/2015 04:27:20 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk3\DR3.

 

I'd recommend a full disk check first and then go from there to fix the other issues.

 

From an elevated admin command prompt you can run the following. Then press Y to run after reboot and restart.

 

CHKDSK   C:  /R

 

What it finds or fixes can be found in the Event Logs

Link to post
Share on other sites

I know you're doing things a bit more advanced than other average users but do you really need/want these set? This not a best practice anymore and it's use frowned upon by Microsoft though some users and vendors do continue to use it.

 

 

IFEO\bitguard.exe: [Debugger] tasklist.exe

IFEO\bprotect.exe: [Debugger] tasklist.exe

IFEO\bpsvc.exe: [Debugger] tasklist.exe

IFEO\browserdefender.exe: [Debugger] tasklist.exe

IFEO\browserprotect.exe: [Debugger] tasklist.exe

IFEO\browsersafeguard.exe: [Debugger] tasklist.exe

IFEO\dprotectsvc.exe: [Debugger] tasklist.exe

IFEO\jumpflip: [Debugger] tasklist.exe

IFEO\protectedsearch.exe: [Debugger] tasklist.exe

IFEO\searchinstaller.exe: [Debugger] tasklist.exe

IFEO\searchprotection.exe: [Debugger] tasklist.exe

IFEO\searchprotector.exe: [Debugger] tasklist.exe

IFEO\searchsettings.exe: [Debugger] tasklist.exe

IFEO\searchsettings64.exe: [Debugger] tasklist.exe

IFEO\snapdo.exe: [Debugger] tasklist.exe

IFEO\stinst32.exe: [Debugger] tasklist.exe

IFEO\stinst64.exe: [Debugger] tasklist.exe

IFEO\taskmgr.exe: [Debugger] "C:\$USER\TOOLS\PROCEXP.EXE"

IFEO\umbrella.exe: [Debugger] tasklist.exe

IFEO\utiljumpflip.exe: [Debugger] tasklist.exe

IFEO\volaro: [Debugger] tasklist.exe

IFEO\vonteera: [Debugger] tasklist.exe

IFEO\websteroids.exe: [Debugger] tasklist.exe

IFEO\websteroidsservice.exe: [Debugger] tasklist.exe

 

...

 

Thanks for the analysis, I'll do my best with it.

 

Unfortunately, my intellect is on the downhill slope, and I have no idea what the above IFEO represents, nor how to correct/remove it.  I don't recognise any of  the executables, with the exception of tasklist.exe and procexp.exe, so these entries must have been added by something other than me.

 

I searched for IFEO and found a page about Image File Execution Options. It suggested Gflags.exe, so I ran that.  Presumably, I just clear the "Debugger" flag for each of the executables in the list?

 

I'll work through the rest, one at a time, as my natural state is confused, and I don't cope well with multiple tasks. 

Link to post
Share on other sites

  • Root Admin

No probably best not to just run things you read on the Internet without more research. I'll go ahead and move your topic into the malware removal forum and help you clean some of this up. May not fix the system but hopefully should clean it up a bit.

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Link to post
Share on other sites

Again, thank you for your help. 

 

Here is my resultant fixlog.txt

 

Before I go any further, Apache httpd started automatically on my system restart. I doubt we'll ever determine what fixed this, I'm sceptical that the removal of some debugging flags, and some temporary files did the trick, but I won't complain! It worked. It also recovered 13Gb space, which on a 256Gb SSD is a huge bonus.  The downside is that I now have to revisit my scheduled task which deletes temporary files based on time since last used…

 

The entry in fixlog.txt:

   HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bitguard.exe => key not found.

... is a result of my using Gflags.exe to turn off "debugging" for bitguard.exe - I did that one, and realised that I was in dangerous territory, and one slip might compromise my system.  So I stopped.

 

Your "fixlist.txt" was helpful by itself. The entry:

   DeleteJunctionsInDirectory: C:\Program Files\Windows Defender

... reminded me how these junctions came about.  It is/was an effort to suppress the "are you  sure you want to run this" popups that I was getting from some programs.  I read that moving the exe file outside the windows directory, and under something like C:\Users\Steve would avoid the popups.  I didn't want to move anything from under \Windows* so I created Junctions or HardLinks as appropriate.  Shortcuts pointing to the "moved" exe run without the prompt. More or less. Success was patchy, but I managed to avoid the popups most of the time.

 

I'll press on with the other recommendations, as my system is not devoid of strange happenings.  I have no reason to think that I'm infected (I used to work in PC/Windows support, in IBM, so I'm cautious) so progress will be leisurely from here onwards.

 

"One slip" should be my nickname, see my website at http://www.swiftys.org.uk/wiz?1113 as an example.

Fixlog.txt

Link to post
Share on other sites

  • Root Admin

No, overall the computer does not "appear" to be infected but did have some items that are not common or in some cases not correct. If all is okay at this time then I'll hold off till Monday and you let me know then if you want to look at anything else or not.

 

Thanks

Link to post
Share on other sites

My progress: Slow but very useful!

  • Apache httpd service continues to start after reboots, so original problem rectified.
  • I rebuilt my search index (it had been flagged as corrupt... I have the FIFA version, it seems).
    This also prompted me to check the "Indexing Options". I was indexing two sets of "Offline Files" but I'd disabled Offline Files after discovering what it was doing to my SSD C: drive (huge writes, lifetime risk)
    I also enabled the  extension ".rex" as indexable, file and content.  This is the extension for Open Object REXX, my language of choice. I've already used the search facility, to find the program I wrote yesterday which contains the word "balloon". Losing my own memory is less frightening when I can find stuff stored in my PC. :-)
Link to post
Share on other sites

The only loose end that I'm aware of is that pmemnt.sys incompatible driver that was found.  It is a component of Lotus SmartSuite, and I installed an old version of this that I had when I worked for IBM. That was in the XP days (32 bit) hence the imcompatibility.

 

I couldn't find a way of uninstalling it (short of uninstalling SmartSuite, and I still have some SmartSuite documents which are of interest), but I found a way of preventing it from starting - using Regedit to set the service as Disabled. So pmemnt.sys is still on my system, but dormant.

 

I'm happy to have the topic closed. Thank you for your help. I trained in high energy nuclear physics.  If ever you need my skills, I'd be willing to help... but I'm a bit rusty.

Link to post
Share on other sites

  • Root Admin

Start an elevated Admin command prompt. Click on START and type in CMD.EXE and when it shows on the menu right click and choose "Run as administrator"
Then type the following and it should remove the service.


SC DELETE PMEM

 

 

Then restart the computer and that service should be gone now..

Let me know

Link to post
Share on other sites

  • Root Admin

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.