Have a host of issues, but figured I'd focus on one that I think will at least let me reset IIS.
On Windows Server 2019 Standard, uninstalling the Web-Server Feature from an elevated PowerShell session fails with a file not found error.
`Uninstall-WindowsFeature -Name Web-Server -Restart`
Error:
```
Uninstall-WindowsFeature:
The request to add or remove features on the specified server failed.
Removal of one or more roles, role services, or features failed.
The system cannot find the file specified. Error: 0x80070002
At line:1 char:1
+ Uninstall-WindowsFeature -Name Web-Server -Restart
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (@{Vhd=; Credent...Name=localhost}:PSObject) [Uninstall-WindowsFeature
], Exception
+ FullyQualifiedErrorId : DISMAPI_Error__Failed_Disabling_Updates,Microsoft.Windows.ServerManager.Commands.RemoveW
indowsFeatureCommand
```
This started when my CI/CD failed to work on a deploy. It is looking for the ApplicationHost.config file in:
`c:\Windows\system32\inetsrv\config\applicationHost.config`
I've tried to restore from history and fails too.
Windows update KB5060531 fails too, it reaches 100% for install, and fails at the end.
ApplicationHost.config is not in the directory it should be. Nothing I do can put a copy there.
```
Failed to deploy web package to IIS website.
Error: Filename: \\?\C:\Windows\system32\inetsrv\config\applicationHost.config
Error: Cannot read configuration file
Error count: 1.
Error: The process 'C:\azagent\A5\_work\_tasks\IISWebAppDeploymentOnMachineGroup_1b467810-6725-4b6d-accd-886174c09bba\0.257.0\node_modules\azure-pipelines-tasks-webdeployment-common\MSDeploy\M142\MSDeploy3.6\msdeploy.exe' failed with exit code 4294967295 (0xFFFFFFFF)
```
Just hoping somebody knows what to do here.
Unable to supprimer Feature Web-Server
Re: Unable to supprimer Feature Web-Server
This turned out to be a malware situation.
Larva-25003
It does a tricky thing in adding a driver to the system, in my case winkbj.sys and registers a bad IIS module IsapiCachesModule. Then makes the applicationhost, caches.dll, and winkbj.sys files not show in windows explorer (even when you state to show hidden and protected files).
All covered [here](https://asec.ahnlab.com/en/87804/).
What isn't covered is how to fix this.
- Get a clean copy of your applicationhost.config file, you can look in your c:\Inetpub\history folder, but be sure to open the file and remove any reference to the above module and dll (you'll have a few places to update). Save that file in a new folder that is easy to find (I did c:\temp).
- Log into your computer in SafeMode. This was problematic for me as I have a dedicated server. I had to find a 3rd party solution compatible with my host (Like TightVNC). If you use TightVNC be sure to do what is covered in the following [link](https://blog.wefixit.at/how-to-access-vnc-in-safe-mode/).
- Delete c:\windows\system32\drivers\winkbj.sys and c:\windows\system32\inetsrv\caches.dll.
- Move your fresh/safe ApplicationHost.config file to c:\windows\system32\inetsrv\config
As always, be sure to back up anything you are changing before hand.
Larva-25003
It does a tricky thing in adding a driver to the system, in my case winkbj.sys and registers a bad IIS module IsapiCachesModule. Then makes the applicationhost, caches.dll, and winkbj.sys files not show in windows explorer (even when you state to show hidden and protected files).
All covered [here](https://asec.ahnlab.com/en/87804/).
What isn't covered is how to fix this.
- Get a clean copy of your applicationhost.config file, you can look in your c:\Inetpub\history folder, but be sure to open the file and remove any reference to the above module and dll (you'll have a few places to update). Save that file in a new folder that is easy to find (I did c:\temp).
- Log into your computer in SafeMode. This was problematic for me as I have a dedicated server. I had to find a 3rd party solution compatible with my host (Like TightVNC). If you use TightVNC be sure to do what is covered in the following [link](https://blog.wefixit.at/how-to-access-vnc-in-safe-mode/).
- Delete c:\windows\system32\drivers\winkbj.sys and c:\windows\system32\inetsrv\caches.dll.
- Move your fresh/safe ApplicationHost.config file to c:\windows\system32\inetsrv\config
As always, be sure to back up anything you are changing before hand.