Automatic Updates Error

Discussion in 'Malware Help (A Specialist Will Reply)' started by sdeguzman, Aug 13, 2006.

  1. sdeguzman

    sdeguzman Private E-2

    Hi, everytime I turn my computer on, I get this dialog box that pops up and says:

    "Automatic Updates has encountered a problem and needs to close. We are sorry for the inconvenience."

    This dialog box keeps on occuring several times giving me the choice to either send an error report or not send. After about 10 times of the pop up, it stops until the next time i turn my computer on sometimes even occuring when I'm online and using the computer. Furthermore, the Error signature has:

    "Error Signature:
    szAppName : wuauclt.exe szAppVer : 5.8.0.2469 szModName : esent.dll
    szModVer : 5.1.2600.2780 offset : 0005783f"

    Technical Information about error report:
    "The Following files will be included in this error report:
    C:\DOCUME~1\SHERWI~1\LOCALS~1\Temp\WERfd44.dir00\w uauclt.exe.mdmp
    C:\DOCUME~1\SHERWI~1\LOCALS~1\Temp\WERfd44.dir00\a ppcompat.txt"

    Please Let me know if you would like a Hijackfile
     
  2. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Welcome to MajorGeeks.com, please follow the steps below:

    - Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
    • Make sure you check version numbers and get all updates.
    After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis:

    Downloading, Installing, and Running HijackThis

    Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

    When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
    • runkeys.txt - the log from GetRunKey.bat
    • newfiles.txt - the log from ShowNew.bat
    • CounterSpy - ONLY IF you were not able to run Windows Defender
    • Bitdefender - from step 6
    • Panda Scan - from step 6
    • HijackThis
     
  3. sdeguzman

    sdeguzman Private E-2

    I could not run microsoft defender and it wouldn't let me update it giving me the message: "Windows Defender was unable to complete the update: 0x80248011"

    Attached is the logs from I believe the getrun and shownew. I forgot which other logs you wanted me to post.
     

    Attached Files:

  4. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    I need the rest of the logs. Panda ActiveScan, HijackThis, GetRunKey and CounterSpy.
     
  5. sdeguzman

    sdeguzman Private E-2

    Okay, here is my hijacklog:

    ~ INLINE LOG ATTACHED ~ SPD

    I will attach the getrunkey, pandascan, counterspy logs as soon as i finish the scans.
     

    Attached Files:

    • HJT.log
      File size:
      11.1 KB
      Views:
      2
    Last edited by a moderator: Aug 16, 2006
  6. sdeguzman

    sdeguzman Private E-2

    I'm also receiving this error message:

    "Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry for the inconvenience."
    Error Report:
    szAppName : svchost.exe szAppVer : 5.1.2600.2180 szModName : esent.dll
    szModVer : 5.1.2600.2780 offset : 00050c08
    C:\DOCUME~1\SHERWI~1\LOCALS~1\Temp\WER3e89.dir00\svchost.exe.mdmp
    C:\DOCUME~1\SHERWI~1\LOCALS~1\Temp\WER3e89.dir00\appcompat.txt

    And everytime i have to close the box with "Send Error Report" or "Don't Send", the sound on my computer doesn't work and when I click on the taskbar for the sound i get a message stating that it doesn't detect and active sound drive. I don't know if this is related to my previous problem.
     
  7. sdeguzman

    sdeguzman Private E-2

    here are the rest of the logs.. thanks for all your help so far.

    I didn't know how to get a .txt file of counterspy so here is what i got:

    ~ INLINE LOG ATTACHED ~ SPD
     

    Attached Files:

    Last edited by a moderator: Aug 16, 2006
  8. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Download
    - Pocket Killbox
    - ExplorerXP

    << The installed version of Java on this compter is out-dated. Install Java Runtime Environment (JRE) 5.0 Update 8 available from http://java.sun.com/javase/downloads/index.jsp. Uninstall all older versions of Java on your computer, before installing the latest version of Java. >>

    HijackThis is not installed as directed. Move HijackTHis to C:\Program Files. Once HijackTHis has been moved to the required folder; rename hijackthis.exe to analyse.exe

    CounterSpy is reporting cookies. There is no concern there.

    Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop. DO NOT run it as this time we will do that later in Safe Mode.
    Close Notepad.

    Now run Pocket Killbox:

    Choose Tools -> Delete Temp Files and click Delete Selected Temp Files

    Then after it deletes the files click the Exit (Save Settings) button.

    NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue..

    Select:
    • Delete on Reboot
    • then Click on the All Files button.
    • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
    • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
    • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).
    If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

    Now boot into SAFE MODE

    Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

    Open ExplorerXP navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)
    Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

    Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
    Temporary Files
    Temporary Internet Files
    Recycle Bin


    And Click OK.

    REBOOT to Normal Mode.

    Post a fresh HijackThis log.
     
  9. sdeguzman

    sdeguzman Private E-2

    did you said, but when i was on Explorer XP, I couldn't find any of the files you ahve listed to delete. I odn' tknow if killbox deleted all of it. I also received an error message when I rebooted my computer on Normal Mode that said sb.exe could not run, or something of that sort. Here is the most recent hijackfile:

    ~ INLINE LOG ATTACHED ~ SPD
    Logs are not to be copy & pasted into your posts.

    Are you having problems attaching logs.
     
    Last edited by a moderator: Aug 16, 2006
  10. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Your log is clean.

    Reboot a couple of times. Do you still get the same error message?
     
  11. sdeguzman

    sdeguzman Private E-2

    ok... the popup doesn't appear anymore. THANK YOU SO MUCH!!! I was reading another forum with a person who had a similar problem who changed a .dll file to .dll.old, so I did that with my esent.dll file and changed it to esent.dll.old, so I was wondering if that would cause problems in the future. Should I change it back. In addition, is it okay to delete Fixreg.reg and uninstall killbox.exe, and explorerxp? I also have counterspy, adaware, and ccleaner. Sould I unistall 2 of them and keep one? If so which is the better out of the three? Thanks for all your help once again.
     
  12. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    esent.dll is a required by Visual Basic. If VB is not installed then there is no problem renaming the file and deleting it.

    You can delete both Fixreg.reg and killbox.exe; make suire you delete C:!Killbox folder also.

    You can uninstall ExplorerXP, and CounterSpy. CCleaner is a good tool for deleting temporary files on teh hard drive and is a keeper.

    Flush all your restore points and create a new clean one for your system.

    Disable And Enable System Restore
    How to Protect yourself from malware!

    Safe surfing.
     
  13. sdeguzman

    sdeguzman Private E-2

    hi,
    everything's been working fine so far and i haven't been having any of those pop ups lately, but as I was trying to go to network connections, it appearerd to be blank. I refreshed the page and I got this message:

    "The Network Connections Folder was unable to retrieve the list of network adaptors on your machine. Please make sure that the networks connections services is enabled and running"

    I am still able to connect online but I cannot check to see for any wireless networks. I don't know if this problem is connected to my previous problem, but i schecked on services.msc, and set it to automatic. When i try to press start, I get this message: "Could not start network services on local computer. Error:126 the specific module cannot be found"

    Please help me out on this problem. Thank you!!
     
  14. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Start -> Run
    type sfc /scannow
    Click 'OK'

    You may be asked your XP CD
     
  15. sdeguzman

    sdeguzman Private E-2

    I just went through the sfc /scannow, and it went through the whole thing. However, I'm still having the problem. I can't see the items in network connections. Could it be related to the problem i had before?:confused:
     
  16. Shadow_Puter_Dude

    Shadow_Puter_Dude MG Authorized Malware Fighter

    Start -> Run
    type cmd
    Click 'OK'

    The Command Terminal will open at the command prompt:
    type regsvr32 netshell.dll, press ENTER
    type regsvr32 netcfgx.dll, press ENTER
    type regsvr32 netman.dll, press ENTER
    type exit, press ENTER

    REBOOT

    Is Network Connections still blank?
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds