0x80072EE7 All The Time ???

I have been getting this message for weeks now and have done everything on
the web site and everything the Microsoft Support Site have asked me to do by
email.

I run Windows One care Live and that is also not connecting to Windows
Update although my system status is still green. The manual update site is
still also giving me the same error code ?

What I do find very strange is that my credit card company phoned me a few
days ago to check some transactions out and my card was being used in the
States last week but I live in the UK !!! and yes its the card I use on line.
I wonder if there is a connection at all, something more sinister afoot I
wonder

Views ?

Please read all the posts under display name zgaryep. One of them solved my
problem. I now can perform updates.
--
zgaryep


"KF_U2" wrote:

> I have been getting this message for weeks now and have done everything on
> the web site and everything the Microsoft Support Site have asked me to do by
> email.
>
> I run Windows One care Live and that is also not connecting to Windows
> Update although my system status is still green. The manual update site is
> still also giving me the same error code ?
>
> What I do find very strange is that my credit card company phoned me a few
> days ago to check some transactions out and my card was being used in the
> States last week but I live in the UK !!! and yes its the card I use on line.
> I wonder if there is a connection at all, something more sinister afoot I
> wonder
>
> Views ?

Not sure if you guys figured this out but I ran across the solution.
It is scamware that changes the DNS server details from automatically
obtaining to using there own ip.

Solution: Get to your Local Area Connection and click properties.
Click TCP/IP then properties. Click "Obtain DNS Automatically".

Also if you go to your reg. you will find this ip 85.255.115.18. This
ip leads directly to the scammers and they also give details how to
remove the software.


"zgaryep" wrote:

> Please read all the posts under display name zgaryep. One of them solved my
> problem. I now can perform updates.
> --
> zgaryep
>
>
> "KF_U2" wrote:
>
> > I have been getting this message for weeks now and have done everything on
> > the web site and everything the Microsoft Support Site have asked me to do by
> > email.
> >
> > I run Windows One care Live and that is also not connecting to Windows
> > Update although my system status is still green. The manual update site is
> > still also giving me the same error code ?
> >
> > What I do find very strange is that my credit card company phoned me a few
> > days ago to check some transactions out and my card was being used in the
> > States last week but I live in the UK !!! and yes its the card I use on line.
> > I wonder if there is a connection at all, something more sinister afoot I
> > wonder
> >
> > Views ?

> Also if you go to your reg. you will find this ip 85.255.115.18. This
> ip leads directly to the scammers and they also give details how to
> remove the software.

Please stop posting this.

Do NOT browse to that IP! It's a sign of a Wareout infection and you'll
need expert help in removing it and its "friends"!

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/



joeriswa wrote:
> Not sure if you guys figured this out but I ran across the solution.
> It is scamware that changes the DNS server details from automatically
> obtaining to using there own ip.
>
> Solution: Get to your Local Area Connection and click properties.
> Click TCP/IP then properties. Click "Obtain DNS Automatically".
>
> Also if you go to your reg. you will find this ip 85.255.115.18. This
> ip leads directly to the scammers and they also give details how to
> remove the software.
>
>
> "zgaryep" wrote:
>
>> Please read all the posts under display name zgaryep. One of them solved
>> my
>> problem. I now can perform updates.
>> --
>> zgaryep
>>
>>
>> "KF_U2" wrote:
>>
>>> I have been getting this message for weeks now and have done everything
>>> on
>>> the web site and everything the Microsoft Support Site have asked me to
>>> do by email.
>>>
>>> I run Windows One care Live and that is also not connecting to Windows
>>> Update although my system status is still green. The manual update site
>>> is
>>> still also giving me the same error code ?
>>>
>>> What I do find very strange is that my credit card company phoned me a
>>> few
>>> days ago to check some transactions out and my card was being used in
>>> the
>>> States last week but I live in the UK !!! and yes its the card I use on
>>> line. I wonder if there is a connection at all, something more sinister
>>> afoot I wonder
>>>
>>> Views ?

"joeriswa" wrote:

> Not sure if you guys figured this out but I ran across the solution.
> It is scamware that changes the DNS server details from automatically
> obtaining to using there own ip.
>
> Solution: Get to your Local Area Connection and click properties.
> Click TCP/IP then properties. Click "Obtain DNS Automatically".
>
> Also if you go to your reg. you will find this ip 85.255.115.18. This
> ip leads directly to the scammers and they also give details how to
> remove the software.
>
>
> "zgaryep" wrote:
>
> > Please read all the posts under display name zgaryep. One of them solved my
> > problem. I now can perform updates.
> > --
> > zgaryep
> >
> >
> > "KF_U2" wrote:
> >
> > > I have been getting this message for weeks now and have done everything on
> > > the web site and everything the Microsoft Support Site have asked me to do by
> > > email.
> > >
> > > I run Windows One care Live and that is also not connecting to Windows
> > > Update although my system status is still green. The manual update site is
> > > still also giving me the same error code ?
> > >
> > > What I do find very strange is that my credit card company phoned me a few
> > > days ago to check some transactions out and my card was being used in the
> > > States last week but I live in the UK !!! and yes its the card I use on line.
> > > I wonder if there is a connection at all, something more sinister afoot I
> > > wonder
> > >
> > > Views ?

AT LAST .... after three weeks of no updates its sorted and I'm back on
Windows Update

Thank You very Much SPYBOT ...............it found the little devil hiding
away

ZBLG DNS Changer ? I have no idea but its gone now

Thanks again all

"PA Bear [MS MVP]" wrote:

> > Also if you go to your reg. you will find this ip 85.255.115.18. This
> > ip leads directly to the scammers and they also give details how to
> > remove the software.
>
> Please stop posting this.
>
> Do NOT browse to that IP! It's a sign of a Wareout infection and you'll
> need expert help in removing it and its "friends"!
>
> Unexplained computer behavior may be caused by deceptive software
> http://support.microsoft.com/kb/827315
>
> Run a /thorough/ check for hijackware, including posting your hijackthis log
> to an appropriate forum.
>
> Checking for/Help with Hijackware
> http://aumha.org/a/parasite.htm
> http://aumha.org/a/quickfix.htm
> http://aumha.net/viewtopic.php?t=5878
> http://wiki.castlecops.com/Malware_R...:_Introduction
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
> http://inetexplorer.mvps.org/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://defendingyourmachine2.blogspot.com/
> http://www.elephantboycomputers.com/...moving_Malware
>
> When all else fails, HijackThis v2.0.2
> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
> It will help you to both identify and remove any hijackware/spyware with
> assistance from an expert. **Post your log to
> http://forums.spybot.info/forumdisplay.php?f=22,
> http://castlecops.com/forum67.html,
> http://forums.subratam.org/index.php?showforum=7,
> http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
> analysis, not here.**
>
> If the procedures look too complex - and there is no shame in admitting this
> isn't your cup of tea - take the machine to a local, reputable and
> independent (i.e., not BigBoxStoreUSA) computer repair shop.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE, OE, Security, Shell/User)
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
>
>
> joeriswa wrote:
> > Not sure if you guys figured this out but I ran across the solution.
> > It is scamware that changes the DNS server details from automatically
> > obtaining to using there own ip.
> >
> > Solution: Get to your Local Area Connection and click properties.
> > Click TCP/IP then properties. Click "Obtain DNS Automatically".
> >
> > Also if you go to your reg. you will find this ip 85.255.115.18. This
> > ip leads directly to the scammers and they also give details how to
> > remove the software.
> >
> >
> > "zgaryep" wrote:
> >
> >> Please read all the posts under display name zgaryep. One of them solved
> >> my
> >> problem. I now can perform updates.
> >> --
> >> zgaryep
> >>
> >>
> >> "KF_U2" wrote:
> >>
> >>> I have been getting this message for weeks now and have done everything
> >>> on
> >>> the web site and everything the Microsoft Support Site have asked me to
> >>> do by email.
> >>>
> >>> I run Windows One care Live and that is also not connecting to Windows
> >>> Update although my system status is still green. The manual update site
> >>> is
> >>> still also giving me the same error code ?
> >>>
> >>> What I do find very strange is that my credit card company phoned me a
> >>> few
> >>> days ago to check some transactions out and my card was being used in
> >>> the
> >>> States last week but I live in the UK !!! and yes its the card I use on
> >>> line. I wonder if there is a connection at all, something more sinister
> >>> afoot I wonder
> >>>
> >>> Views ?
>
>

Ok its now bad news and I do mean bad ............everytime I reboot my
system this Zlob DNS changer comes back, Spybot finds it fixes it and then I
can get into the Windows Update site but when I reboot again it locks me out
again. Everything eles on my PC is working fine but no other software finds
it

Although I am no expert on PCs I understand it to be a Zlob Rootkit
(although I have no idea what one is or what it does??) Can anyone on the
planet help before i throw my PC out of the window GGRRRRRRRRR

When I bought my PC a year ago with Windows XP Media Edition I read about
Windows One care which sounded like the only thing I would even need on my
system to protect it (how wrong was i).

Another Qusestion if any experts out their could buy one AV program to
protect their system what would you say the best on on the planet would be ?
my One Care runs out in a few month and I dont think I will be updating it
due to the fact that it did not protect my system nor does it find things
once they are on your system

Any advice to fix this would be great

Cheers


"KF_U2" wrote:

> AT LAST .... after three weeks of no updates its sorted and I'm back on
> Windows Update
>
> Thank You very Much SPYBOT ...............it found the little devil hiding
> away
>
> ZBLG DNS Changer ? I have no idea but its gone now
>
> Thanks again all
>
> "PA Bear [MS MVP]" wrote:
>
> > > Also if you go to your reg. you will find this ip 85.255.115.18. This
> > > ip leads directly to the scammers and they also give details how to
> > > remove the software.
> >
> > Please stop posting this.
> >
> > Do NOT browse to that IP! It's a sign of a Wareout infection and you'll
> > need expert help in removing it and its "friends"!
> >
> > Unexplained computer behavior may be caused by deceptive software
> > http://support.microsoft.com/kb/827315
> >
> > Run a /thorough/ check for hijackware, including posting your hijackthis log
> > to an appropriate forum.
> >
> > Checking for/Help with Hijackware
> > http://aumha.org/a/parasite.htm
> > http://aumha.org/a/quickfix.htm
> > http://aumha.net/viewtopic.php?t=5878
> > http://wiki.castlecops.com/Malware_R...:_Introduction
> > http://mvps.org/winhelp2002/unwanted.htm
> > http://inetexplorer.mvps.org/data/prevention.htm
> > http://inetexplorer.mvps.org/tshoot.html
> > http://www.mvps.org/sramesh2k/Malware_Defence.htm
> > http://defendingyourmachine2.blogspot.com/
> > http://www.elephantboycomputers.com/...moving_Malware
> >
> > When all else fails, HijackThis v2.0.2
> > (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
> > It will help you to both identify and remove any hijackware/spyware with
> > assistance from an expert. **Post your log to
> > http://forums.spybot.info/forumdisplay.php?f=22,
> > http://castlecops.com/forum67.html,
> > http://forums.subratam.org/index.php?showforum=7,
> > http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
> > analysis, not here.**
> >
> > If the procedures look too complex - and there is no shame in admitting this
> > isn't your cup of tea - take the machine to a local, reputable and
> > independent (i.e., not BigBoxStoreUSA) computer repair shop.
> > --
> > ~Robear Dyer (PA Bear)
> > MS MVP-Windows (IE, OE, Security, Shell/User)
> > AumHa VSOP & Admin http://aumha.net
> > DTS-L http://dts-l.net/
> >
> >
> >
> > joeriswa wrote:
> > > Not sure if you guys figured this out but I ran across the solution.
> > > It is scamware that changes the DNS server details from automatically
> > > obtaining to using there own ip.
> > >
> > > Solution: Get to your Local Area Connection and click properties.
> > > Click TCP/IP then properties. Click "Obtain DNS Automatically".
> > >
> > > Also if you go to your reg. you will find this ip 85.255.115.18. This
> > > ip leads directly to the scammers and they also give details how to
> > > remove the software.
> > >
> > >
> > > "zgaryep" wrote:
> > >
> > >> Please read all the posts under display name zgaryep. One of them solved
> > >> my
> > >> problem. I now can perform updates.
> > >> --
> > >> zgaryep
> > >>
> > >>
> > >> "KF_U2" wrote:
> > >>
> > >>> I have been getting this message for weeks now and have done everything
> > >>> on
> > >>> the web site and everything the Microsoft Support Site have asked me to
> > >>> do by email.
> > >>>
> > >>> I run Windows One care Live and that is also not connecting to Windows
> > >>> Update although my system status is still green. The manual update site
> > >>> is
> > >>> still also giving me the same error code ?
> > >>>
> > >>> What I do find very strange is that my credit card company phoned me a
> > >>> few
> > >>> days ago to check some transactions out and my card was being used in
> > >>> the
> > >>> States last week but I live in the UK !!! and yes its the card I use on
> > >>> line. I wonder if there is a connection at all, something more sinister
> > >>> afoot I wonder
> > >>>
> > >>> Views ?
> >
> >

Run a /thorough/ check for hijackware, including posting your
hijackthis log to an appropriate forum. You'll need expert assistance
to get the machine cleaned up.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2 (http://aumha.org/downloads/
hijackthis.exe) is the preferred tool to use. It will help you to
both identify and remove any hijackware/spyware with assistance from
an expert. **Post your log to http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for
expert analysis, not here.**

If the procedures look too complex - and there is no shame in
admitting this isn't your cup of tea - take the machine to a local,
reputable and independent (i.e., not BigBoxStoreUSA) computer repair
shop.
--
Robear Dyer (PA Bear)
MS-MVP Windows (IE/OE, Security, Shell/User)
AumHa VSOP/Admin; DTS-L.net


On Jan 10, 10:34*am, KF_U2 <K...@discussions.microsoft.com> wrote:
> Ok its now bad news and I do mean bad ............everytime I reboot my
> system this Zlob *DNS changer comes back, Spybot finds it fixes it and then I
> can get into the Windows Update site but when I reboot again it locks me out
> again. Everything eles on my PC is working fine but no other software finds
> it
>
> Although I am no expert on PCs I understand it to be a Zlob Rootkit
> (although I have no idea what one is or what it does??) Can anyone on the
> planet help before i throw my PC out of the window GGRRRRRRRRR
>
> When I bought my PC a year ago with Windows XP Media Edition I read about
> Windows One care which sounded like the only thing I would even need on my
> system to protect it (how wrong was i).
>
> Another Qusestion if any experts out their could buy one AV program to
> protect their system what would you say the best on on the planet would be?
> my One Care runs out in a few month and I dont think I will be updating it
> due to the fact that it did not protect my system nor does it find things
> once they are on your system
>
> Any advice to fix this would be great
>
> Cheers
>
>
>
> "KF_U2" wrote:
> > AT LAST .... after three weeks of no updates its sorted and I'm back on
> > Windows Update
>
> > Thank You very Much SPYBOT ...............it found the little devil hiding
> > away
>
> > ZBLG DNS Changer ? I have no idea but its gone now
>
> > Thanks again all
>
> > "PA Bear [MS MVP]" wrote:
>
> > > > Also if you go to your reg. you will find this ip 85.255.115.18. This
> > > > ip leads directly to the scammers and they also give details how to
> > > > remove the software.
>
> > > Please stop posting this.
>
> > > Do NOT browse to that IP! *It's a sign of a Wareout infection and you'll
> > > need expert help in removing it and its "friends"!
>
> > > Unexplained computer behavior may be caused by deceptive software
> > >http://support.microsoft.com/kb/827315
>
> > > Run a /thorough/ check for hijackware, including posting your hijackthis log
> > > to an appropriate forum.
>
> > > Checking for/Help with Hijackware
> > >http://aumha.org/a/parasite.htm
> > > * *http://aumha.org/a/quickfix.htm
> > > * *http://aumha.net/viewtopic.php?t=5878
> > >http://wiki.castlecops.com/Malware_R...:_Introduction
> > >http://mvps.org/winhelp2002/unwanted.htm
> > >http://inetexplorer.mvps.org/data/prevention.htm
> > > * *http://inetexplorer.mvps.org/tshoot.html
> > >http://www.mvps.org/sramesh2k/Malware_Defence.htm
> > >http://defendingyourmachine2.blogspot.com/
> > >http://www.elephantboycomputers.com/...moving_Malware
>
> > > When all else fails, HijackThis v2.0.2
> > > (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
> > > It will help you to both identify and remove any hijackware/spyware with
> > > assistance from an expert. ***Post your log to
> > >http://forums.spybot.info/forumdisplay.php?f=22,
> > >http://castlecops.com/forum67.html,
> > >http://forums.subratam.org/index.php?showforum=7,
> > >http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
> > > analysis, not here.**
>
> > > If the procedures look too complex - and there is no shame in admitting this
> > > isn't your cup of tea - take the machine to a local, reputable and
> > > independent (i.e., not BigBoxStoreUSA) computer repair shop.
> > > --
> > > ~Robear Dyer (PA Bear)
> > > MS MVP-Windows (IE, OE, Security, Shell/User)
> > > AumHa VSOP & Adminhttp://aumha.net
> > > DTS-Lhttp://dts-l.net/
>
> > > joeriswa wrote:
> > > > Not sure if you guys figured this out but I ran across the solution.
> > > > It is scamware that changes the DNS server details from automatically
> > > > obtaining to using there own ip.
>
> > > > Solution: Get to your Local Area Connection and click properties.
> > > > Click TCP/IP then properties. Click "Obtain DNS Automatically".
>
> > > > Also if you go to your reg. you will find this ip 85.255.115.18. This
> > > > ip leads directly to the scammers and they also give details how to
> > > > remove the software.
>
> > > > "zgaryep" wrote:
>
> > > >> Please read all the posts under display name zgaryep. One of them solved
> > > >> my
> > > >> problem. I now can perform updates.
> > > >> --
> > > >> zgaryep
>
> > > >> "KF_U2" wrote:
>
> > > >>> I have been getting this message for weeks now and have done everything
> > > >>> on
> > > >>> the web site and everything the Microsoft Support Site have asked me to
> > > >>> do by email.
>
> > > >>> I run Windows One care Live and that is also not connecting to Windows
> > > >>> Update although my system status is still green. The manual updatesite
> > > >>> is
> > > >>> still also giving me the same error code ?
>
> > > >>> What I do find very strange is that my credit card company phoned me a
> > > >>> few
> > > >>> days ago to check some transactions out and my card was being usedin
> > > >>> the
> > > >>> States last week but I live in the UK !!! and yes its the card I use on
> > > >>> line. I wonder if there is a connection at all, something more sinister
> > > >>> afoot I wonder