service.msc

How do I keep Automated updates enabled. I click on Automatic, then apply,
then start - okay but keeps going to disabled.
--
Have a great day
Jan

Hello Jan,

It seems possible that your Windows installation has
been deliberately damaged by a trojan
(Vundo, along any uninvited guests.
(SDBot and ZLOB, all protected by a rootkit.)) so as to prevent you updating
your system or
removing the trojan.


Scan your computer now online and clean it for free!
<http://onecare.live.com/site/en-us/tryscanner.htm>


A very good antimalware app are SUPERAntiSpyware (SAS)
and MalwareBytes Anti-Malware (MBAM) .

There is a free version (on demand scanning only:
<http://www.superantispyware.com/>
-=-
MalwareBytes Anti-Malware (MBAM) Same as above.
<http://www.malwarebytes.com/>
-=-



Unexplained computer behavior may be caused by deceptive software
<http://support.microsoft.com/kb/827315>
-=-


<http://www.bleepingcomputer.com/forums/topic34773.html>
-=-


Please follow the above sugestions

Please report back so it may assist others who have the same pÿoblem as you.



I hope this post is helpful.

Let us know how it works ºut.

Good luck


Ǝиçεl
-=-



"Jan" wrote:

> How do I keep Automated updates enabled. I click on Automatic, then apply,
> then start - okay but keeps going to disabled.
> --
> Have a great day
> Jan

Jan wrote:
> How do I keep Automated updates enabled. I click on Automatic, then
> apply, then start - okay but keeps going to disabled.

Suggestion:
Disinfect/infest your machine and cleanup/update your Windows Update
Components.

Would tell you a list of things to help you do that, but, you left out vital
information...

What is the operating system you are currently running and what service pack
level is that operating system currently?

How do you find out?

Start button --> RUN
(no "RUN"? Press the "Windows Key" + R on your keyboard) --> type in:
winver
--> Click OK.

The picture at the top of the window that opens will give you the general
(Operating System name) while the line starting with the word "version" will
give you the rest of the story.

Post *_both_* in full in response to this message verbatim. ;-)

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

Hi
When MacAfee ran it normal scan, it quarantined a trojan "vundo"
My system is
Windows XP
Version 5.1 (Build2600.xpsp_sp3_gdr.090206-1234 Service Pack 3)

How do I get rid of vundo?
Thanks for any help
--
Have a great day
Jan


"Shenan Stanley" wrote:

> Jan wrote:
> > How do I keep Automated updates enabled. I click on Automatic, then
> > apply, then start - okay but keeps going to disabled.
>
> Suggestion:
> Disinfect/infest your machine and cleanup/update your Windows Update
> Components.
>
> Would tell you a list of things to help you do that, but, you left out vital
> information...
>
> What is the operating system you are currently running and what service pack
> level is that operating system currently?
>
> How do you find out?
>
> Start button --> RUN
> (no "RUN"? Press the "Windows Key" + R on your keyboard) --> type in:
> winver
> --> Click OK.
>
> The picture at the top of the window that opens will give you the general
> (Operating System name) while the line starting with the word "version" will
> give you the rest of the story.
>
> Post *_both_* in full in response to this message verbatim. ;-)
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>

Jan wrote:
> How do I keep Automated updates enabled. I click on Automatic, then
> apply, then start - okay but keeps going to disabled.

Shenan Stanley wrote:
> Suggestion:
> Disinfect/infest your machine and cleanup/update your Windows Update
> Components.
>
> Would tell you a list of things to help you do that, but, you left
> out vital information...
>
> What is the operating system you are currently running and what
> service pack level is that operating system currently?
>
> How do you find out?
>
> Start button --> RUN
> (no "RUN"? Press the "Windows Key" + R on your keyboard) --> type
> in: winver
> --> Click OK.
>
> The picture at the top of the window that opens will give you the
> general (Operating System name) while the line starting with the
> word "version" will give you the rest of the story.
>
> Post *_both_* in full in response to this message verbatim. ;-)

Jan wrote:
> When MacAfee ran it normal scan, it quarantined a trojan "vundo"
>
> My system is
> Windows XP
> Version 5.1 (Build2600.xpsp_sp3_gdr.090206-1234 Service Pack 3)
>
> How do I get rid of vundo?
> Thanks for any help

The picture at the top *did not* say "Windows XP", it said "Windows XP Home
Edition" or "Windows XP Professional" or something along those lines.
"Verbatim". ;-)

Anyway - time to cleanup, eh?

If at anytime you have question about what you are about to do, don't do
it.. Come and ask for clarification if you need to or if you know someone
good with computers - have them help you. If not take it to a
professional.

I hope your backups are up to date - if not - you might as well get an
external media of some sort and at least get your files (documents, emails,
contacts, pictures, music, email, internet favorites/bookmarks, installation
executables, installation product keys/serial numbers, etc) backed up.

Download, install, run, update and perform a full scan (separately) with the
following two applications (freeware versions are the ones to use for this):

SuperAntiSpyware
http://www.superantispyware.com/

MalwareBytes
http://www.malwarebytes.com/

After performing a full scan with one and then the other and removing
whatever they both find completely, you may uninstall these products,
if you wish.

Download and run the MSRT manually:
http://www.microsoft.com/security/ma...e/default.mspx

Reboot.

Fix your file/registry permissions...

Ignore the title and follow the sub-section under "Advanced Troubleshooting"
titled, "Method 1: Reset the registry and the file permissions"
http://support.microsoft.com/kb/949377
*will take time
(Ignore the 6th step!)

Reboot and ...

Search your registry for %fystem and replace the "f" with an "s". May be
three or four matches, may be none. You may even have to take ownership
(even after doing the above) of the keys in order to make the change.

Reboot.

Download/install this:
http://support.microsoft.com/kb/290301

After installing, do the following:

Start button --> RUN --> type in:
"%ProgramFiles%\Windows Installer Clean Up\msizap.exe" g!
--> Click OK.

(The quotation marks and percentage signs and spacing should be exact.)

Reboot.

Download/Install the latest Windows Installer (for your OS):
( Windows XP 32-bit : WindowsXP-KB942288-v3-x86.exe )
http://www.microsoft.com/downloadS/d...displaylang=en

Reboot.

and...

Download the latest version of the Windows Update agent from here (x86):
http://go.microsoft.com/fwlink/?LinkID=91237
.... and save it to the root of your C:\ drive. After saving it to the root
of the C:\ drive, do the following:

Close all Internet Explorer windows and other applications.

Start button --> RUN and type in:
%SystemDrive%\windowsupdateagent30-x86.exe /WUFORCE
--> Click OK.

(If asked, select "Run.) --> Click on NEXT --> Select "I agree" and click on
NEXT --> When it finishes installing, click on "Finish"...

Reboot.

Then follow the instructions here:

How do I reset Windows Update components?
http://support.microsoft.com/kb/971058

Reboot.

CHKDSK
How to scan your disks for errors
http://support.microsoft.com/kb/315265
* will take time

Defragment
How to Defragment your hard drives
http://support.microsoft.com/kb/314848
* will take time

Ensure your hardware drivers are up to date (from the hardware
manufacturer's respective web pages.)

Reboot.

Log on as an user with administrative rights and open Internet Explorer
and visit http://windowsupdate.microsoft.com/ and select to do a
CUSTOM scan...

Every time you are about to click on something while at these web pages -
first press and hold down the CTRL key while you click on it. You can
release the CTRL key after clicking each time.

Once the scan is done, select just _ONE_ of the high priority updates
(deselect any others) and install it.

Reboot again.

If it did work - try the web page again - selecting no more than 3-5 at a
time. Rebooting as needed.

The Optional Software updates are generally safe - although I recommend
against the "Windows Search" one and any of the "Office Live" ones or
"Windows Live" ones fornow. I would completely avoid the
Optional Hardware updates. Also - I do not see any urgent need to install
Internet Explorer 8 at this time.

** If you are installing Microsoft Office updates - it helps to have your
installation media in the CD/DVD drive when installing it.

Come back - let us know if that worked.
.... Really - come back and let everyone know if that worked.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/ma...e/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
(only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/...moving_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachi...php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002
www.banthecheck.com


Jan wrote:
> Hi
> When MacAfee ran it normal scan, it quarantined a trojan "vundo"
> My system is
> Windows XP
> Version 5.1 (Build2600.xpsp_sp3_gdr.090206-1234 Service Pack 3)
>
> How do I get rid of vundo?
> Thanks for any help
>
>> Jan wrote:
>>> How do I keep Automated updates enabled. I click on Automatic, then
>>> apply, then start - okay but keeps going to disabled.
>>
>> Suggestion:
>> Disinfect/infest your machine and cleanup/update your Windows Update
>> Components.
>>
>> Would tell you a list of things to help you do that, but, you left out
>> vital information...
>>
>> What is the operating system you are currently running and what service
>> pack level is that operating system currently?
>>
>> How do you find out?
>>
>> Start button --> RUN
>> (no "RUN"? Press the "Windows Key" + R on your keyboard) --> type in:
>> winver
>> --> Click OK.
>>
>> The picture at the top of the window that opens will give you the general
>> (Operating System name) while the line starting with the word "version"
>> will give you the rest of the story.
>>
>> Post *_both_* in full in response to this message verbatim. ;-)
>>
>> --
>> Shenan Stanley
>> MS-MVP
>> --
>> How To Ask Questions The Smart Way
>> http://www.catb.org/~esr/faqs/smart-questions.html

Hi
I would just like to say thank you for all the help. I did have Vundo trojan.
I have McAfee but it did not get rid of it. I then tried RegCure it helped,
then I was informed by people here of SuperantiSpyware. I worked with all
three and great success. Vundo gone. Already had McAFee, RegCure $50.00 used
the free AntiSpyware then saw how great it was purchased it for $9.99. So for
$60.00 a year of protection and alot of experience was well worth it. Learned
you need more than McAfee or Norton now.
Thank you all so much
--
Have a great day
Jan


"PA Bear [MS MVP]" wrote:

> NB: If you had no anti-virus application installed or the subscription had
> expired *when the machine first got infected* and/or your subscription has
> since expired and/or the machine's not been kept fully-patched at Windows
> Update, don't waste your time with any of the below: Format & reinstall
> Windows. A Repair Install will NOT help!
>
> 1. See if you can download/run the MSRT manually:
> http://www.microsoft.com/security/ma...e/default.mspx
>
> NB: Run the FULL scan, not the QUICK scan! You may need to download the
> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
> machine and rename it to SCAN.EXE before running it.
>
> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
> (only!) in Safe Mode with Networking, if need be:
> http://onecare.live.com/site/en-us/center/howsafe.htm
>
> 3. Run a /thorough/ check for hijackware, including posting the requested
> logs in an appropriate forum, not here.
>
> Checking for/Help with Hijackware
> http://aumha.net/viewtopic.php?f=30&t=4075
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
> http://inetexplorer.mvps.org/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://www.elephantboycomputers.com/...moving_Malware
>
> **Chances are you will need to seek expert assistance in
> http://spywarehammer.com/simplemachi...php?board=10.0,
> http://www.spywarewarrior.com/viewforum.php?f=5,
> http://www.dslreports.com/forum/cleanup,
> http://www.bluetack.co.uk/forums/index.php,
> http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**
>
> If these procedures look too complex - and there is no shame in admitting
> this isn't your cup of tea - take the machine to a local, reputable and
> independent (i.e., not BigBoxStoreUSA) computer repair shop.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Client - since 2002
> www.banthecheck.com
>
>
> Jan wrote:
> > Hi
> > When MacAfee ran it normal scan, it quarantined a trojan "vundo"
> > My system is
> > Windows XP
> > Version 5.1 (Build2600.xpsp_sp3_gdr.090206-1234 Service Pack 3)
> >
> > How do I get rid of vundo?
> > Thanks for any help
> >
> >> Jan wrote:
> >>> How do I keep Automated updates enabled. I click on Automatic, then
> >>> apply, then start - okay but keeps going to disabled.
> >>
> >> Suggestion:
> >> Disinfect/infest your machine and cleanup/update your Windows Update
> >> Components.
> >>
> >> Would tell you a list of things to help you do that, but, you left out
> >> vital information...
> >>
> >> What is the operating system you are currently running and what service
> >> pack level is that operating system currently?
> >>
> >> How do you find out?
> >>
> >> Start button --> RUN
> >> (no "RUN"? Press the "Windows Key" + R on your keyboard) --> type in:
> >> winver
> >> --> Click OK.
> >>
> >> The picture at the top of the window that opens will give you the general
> >> (Operating System name) while the line starting with the word "version"
> >> will give you the rest of the story.
> >>
> >> Post *_both_* in full in response to this message verbatim. ;-)
> >>
> >> --
> >> Shenan Stanley
> >> MS-MVP
> >> --
> >> How To Ask Questions The Smart Way
> >> http://www.catb.org/~esr/faqs/smart-questions.html
>
>

Jan wrote:
> I would just like to say thank you for all the help. I did have
> Vundo trojan. I have McAfee but it did not get rid of it. I then
> tried RegCure it helped, then I was informed by people here of
> SuperantiSpyware. I worked with all three and great success. Vundo
> gone. Already had McAFee, RegCure $50.00 used the free AntiSpyware
> then saw how great it was purchased it for $9.99. So for $60.00 a
> year of protection and alot of experience was well worth it.
> Learned you need more than McAfee or Norton now.
> Thank you all so much

IMO - RegCure is worthless.

Opinions may vary.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

If you think your Registry needs to be "cleaned" or "repaired," read
http://aumha.net/viewtopic.php?t=28099 and draw your own conclusions.

Jan wrote:
> Hi
> I would just like to say thank you for all the help. I did have Vundo
> trojan. I have McAfee but it did not get rid of it. I then tried RegCure
> it helped, then I was informed by people here of SuperantiSpyware. I
> worked
> with all three and great success. Vundo gone. Already had McAFee, RegCure
> $50.00 used the free AntiSpyware then saw how great it was purchased it
> for
> $9.99. So for $60.00 a year of protection and alot of experience was well
> worth it. Learned you need more than McAfee or Norton now.
> Thank you all so much
>
> PA Bear wrote:
>> NB: If you had no anti-virus application installed or the subscription
>> had
>> expired *when the machine first got infected* and/or your subscription
>> has
>> since expired and/or the machine's not been kept fully-patched at Windows
>> Update, don't waste your time with any of the below: Format & reinstall
>> Windows. A Repair Install will NOT help!
>>
>> 1. See if you can download/run the MSRT manually:
>> http://www.microsoft.com/security/ma...e/default.mspx
>>
>> NB: Run the FULL scan, not the QUICK scan! You may need to download the
>> MSRT on a non-infected machine, then transfer MRT.EXE to the infected
>> machine and rename it to SCAN.EXE before running it.
>>
>> 2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
>> scan
>> (only!) in Safe Mode with Networking, if need be:
>> http://onecare.live.com/site/en-us/center/howsafe.htm
>>
>> 3. Run a /thorough/ check for hijackware, including posting the requested
>> logs in an appropriate forum, not here.
>>
>> Checking for/Help with Hijackware
>> http://aumha.net/viewtopic.php?f=30&t=4075
>> http://mvps.org/winhelp2002/unwanted.htm
>> http://inetexplorer.mvps.org/data/prevention.htm
>> http://inetexplorer.mvps.org/tshoot.html
>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>> http://www.elephantboycomputers.com/...moving_Malware
>>
>> **Chances are you will need to seek expert assistance in
>> http://spywarehammer.com/simplemachi...php?board=10.0,
>> http://www.spywarewarrior.com/viewforum.php?f=5,
>> http://www.dslreports.com/forum/cleanup,
>> http://www.bluetack.co.uk/forums/index.php,
>> http://aumha.net/viewforum.php?f=30 or other appropriate forums as
>> well.**
>>
>> If these procedures look too complex - and there is no shame in admitting
>> this isn't your cup of tea - take the machine to a local, reputable and
>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>> www.banthecheck.com
>>
>>
>> Jan wrote:
>>> Hi
>>> When MacAfee ran it normal scan, it quarantined a trojan "vundo"
>>> My system is
>>> Windows XP
>>> Version 5.1 (Build2600.xpsp_sp3_gdr.090206-1234 Service Pack 3)
>>>
>>> How do I get rid of vundo?
>>> Thanks for any help
>>>
>>>> Jan wrote:
>>>>> How do I keep Automated updates enabled. I click on Automatic, then
>>>>> apply, then start - okay but keeps going to disabled.
>>>>
>>>> Suggestion:
>>>> Disinfect/infest your machine and cleanup/update your Windows Update
>>>> Components.
>>>>
>>>> Would tell you a list of things to help you do that, but, you left out
>>>> vital information...
>>>>
>>>> What is the operating system you are currently running and what service
>>>> pack level is that operating system currently?
>>>>
>>>> How do you find out?
>>>>
>>>> Start button --> RUN
>>>> (no "RUN"? Press the "Windows Key" + R on your keyboard) --> type in:
>>>> winver
>>>> --> Click OK.
>>>>
>>>> The picture at the top of the window that opens will give you the
>>>> general
>>>> (Operating System name) while the line starting with the word "version"
>>>> will give you the rest of the story.
>>>>
>>>> Post *_both_* in full in response to this message verbatim. ;-)
>>>>
>>>> --
>>>> Shenan Stanley
>>>> MS-MVP
>>>> --
>>>> How To Ask Questions The Smart Way
>>>> http://www.catb.org/~esr/faqs/smart-questions.html