Windows updates wont work properly

stretchelsburt · Aug 19, 2008

Hi there

I was downloading some software from an unauthorised site (even though I should know better ) and shortly afterwards my wallpaper showed active desktop recovery, Norton reported a trojan it couldnt fix and my windows update balloon popped up telling me I they were turned off. I checked and control panel says they are on. When I try to go to the windows update site, it keeps erroring.

I followed all your instructions to the latter and they removed about 4 million virus's / trojans, but I still have the same problem.

Please can you help?!! I've attached the logs as you requested in the other posts...
View attachment combofix.txt

View attachment mbam-log-08-18-2008 (21-24-13).txt

stretchelsburt · Aug 19, 2008

the remaining files are below

View attachment SASlog..txt

View attachment MGlogs.zip

TimW · Aug 19, 2008

Interesting.....let's do this:

Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\689776c3]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BM6ba4455f]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\My Web Search Bar Search Scope Monitor]
Click to expand...

Now use windows explorer to find and delete:
C:\Documents and Settings\All Users\Application Data\AVG8
C:\Program Files\AVG
C:\68610d2173ef06a16c

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\Temp
C:\Documents and Settings\%username%\Local Settings\Temp

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file.

stretchelsburt · Aug 20, 2008

Thank you so much for looking into this.

I did exactly what you asked and the new MGlogs.zip file is attached.

When trying to clear out my c:\WINDOWS\temp folder I couldn't get delete a file called "Perflib_Perfdata_480.dat". I kept getting a pop up telling me it was being used by another program, even though I had NOTHING else open.

I look forward to hearing from you!

Cheers
View attachment MGlogs.zip

TimW · Aug 20, 2008

Looks good....let's do some clean up:

Run this: Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[-HKEY_CURRENT_USER\Software\Kazaa]
[-HKEY_LOCAL_MACHINE\SOFTWARE\knight]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"HideLegacyLogonScripts"=-
"HideLogoffScripts"=-
"RunLogonScriptSync"=-
"RunStartupScriptSync"=-
"HideStartupScripts"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"HideLegacyLogonScripts"=-
"HideLogoffScripts"=-
"RunLogonScriptSync"=-
"RunStartupScriptSync"=-
"HideStartupScripts"=-
Click to expand...

Tell me what other malware issues you may have.

stretchelsburt · Aug 21, 2008

I've done everything you asked, but I still get the windows balloon error! It says windows update is off, but when I try to turn it on it says it cant. Even when I go to the windows update website, it errors with ref 0x80070424

Thanks for you continuing support!

TimW · Aug 21, 2008

First try this:

1. Click Start, click Run, type services.msc, and then click OK.

2. In the list of services, right-click Automatic Updates, and then click Properties.

3. In the Startup type list, click Automatic, and then click Apply.

4. If Service status is set to Stopped, click Start, and then click OK.

5. Right-click Background Intelligent Transfer Service, and then click Properties.

6. In the Startup type list, click Manual, and then click Apply.

7. If Service status is set to Stopped, click Start, and then click OK.

Then see if you can set your updates.

stretchelsburt · Aug 22, 2008

I've just tried what you said and there is not "Automatic Updates" in the list!

Can you help?

TimW · Aug 22, 2008

Please try this MS article: http://support.microsoft.com/kb/916261

stretchelsburt · Aug 22, 2008

All done - fantastic! Thank you so much for your help, I am really grateful.

Can I assume I am virus free now?

TimW · Aug 23, 2008

LOL...yes you may assume...

If you are not having any other malware problems, it is time to do our final steps:

You can uninstall SUPERAntiSpyware now.

We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combo-fix folder from combofix.

If we had you run Avenger, you can delete all files related to Avenger now.

If we had you run RenV.exe, you can delete it and the Log.txt file on your Desktop.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

stretchelsburt · Aug 24, 2008

Fantastic! All done. Thanks very much again, you boys are legends!

TimW · Aug 24, 2008

You are most welcome....safe surfing.

Log in or Sign up

Windows updates wont work properly

stretchelsburt Private E-2

stretchelsburt Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

stretchelsburt Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

stretchelsburt Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

stretchelsburt Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

stretchelsburt Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

stretchelsburt Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Log in or Sign up

Windows updates wont work properly

stretchelsburt Private E-2

stretchelsburt Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

stretchelsburt Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

stretchelsburt Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

stretchelsburt Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

stretchelsburt Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

stretchelsburt Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches