URGENT: XPsp3 Windows Update Failure

I have a user that had the Vundo issue, all of which has been cleared up now
with Symantec End Point, however, we cannot get the Microsoft Update feature
to work at all.

This is on XPP sp3, and I have tried already reinstalling all the WU
components, as well as the BT service. However, the Automatic Updates Service
will turn itself back to disabled after you enable it and Start the service
from Services.msc

Needless to say, I am spinning wheels at this point.
I have run through all the KB's I can find, and tried all, but still no go.

Anyone have any ideas of hope?

You probably have (much) more work to do.

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/ma...e/default.mspx

2. Run this online scan (in safe mode w/networking, if need be):
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/...moving_Malware

**Seek expert assistance in
http://spywarehammer.com/simplemachi...php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or other appropriate forums.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
=====================
Start a free Windows Update support incident request:
https://support.microsoft.com/oas/de...spx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Papi wrote:
> I have a user that had the Vundo issue, all of which has been cleared up
> now
> with Symantec End Point, however, we cannot get the Microsoft Update
> feature
> to work at all.
>
> This is on XPP sp3, and I have tried already reinstalling all the WU
> components, as well as the BT service. However, the Automatic Updates
> Service will turn itself back to disabled after you enable it and Start
> the
> service from Services.msc
>
> Needless to say, I am spinning wheels at this point.
> I have run through all the KB's I can find, and tried all, but still no
> go.
>
> Anyone have any ideas of hope?

OK, MSRT will not run manually. I have updated it and tried.
Next, Spybot 1.6.2 w/latest Defs continues to pick up
TinyBar.C even though I went through the manual removal process three times.
It also picks up Smitfraud-C.and Virtumonde, and again, even after I ran
manually remove.

Yes, System Restore is off.

Next, I ran the OneCare tool, however Symantec Endpoint found all that and
repaired/quarant.

When Windows or Microsoft Update goes to Run, I get the same error page that
it couldn't start with all the things to check like BITS and so on, which has
been done over a dozen times now.



"PA Bear [MS MVP]" wrote:

> You probably have (much) more work to do.
>
> 1. See if you can download/run the MSRT manually:
> http://www.microsoft.com/security/ma...e/default.mspx
>
> 2. Run this online scan (in safe mode w/networking, if need be):
> http://onecare.live.com/site/en-us/center/howsafe.htm
>
> 3. Run a /thorough/ check for hijackware, including posting the requested
> logs in an appropriate forum.
>
> Checking for/Help with Hijackware
> http://aumha.net/viewtopic.php?f=30&t=4075
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
> http://inetexplorer.mvps.org/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://www.elephantboycomputers.com/...moving_Malware
>
> **Seek expert assistance in
> http://spywarehammer.com/simplemachi...php?board=10.0,
> http://forums.spybot.info/forumdisplay.php?f=22,
> http://aumha.net/viewforum.php?f=30, or other appropriate forums.**
>
> If the procedures look too complex - and there is no shame in admitting this
> isn't your cup of tea - take the machine to a local, reputable and
> independent (i.e., not BigBoxStoreUSA) computer repair shop.
> =====================
> Start a free Windows Update support incident request:
> https://support.microsoft.com/oas/de...spx?gprid=6527
>
> Support for Windows Update:
> http://support.microsoft.com/gp/wusupport
>
> For home users, no-charge support is available by calling 1-866-PCSAFETY in
> the United States and in Canada or by contacting your local Microsoft
> subsidiary. There is no-charge for support calls that are associated with
> security updates.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
> Papi wrote:
> > I have a user that had the Vundo issue, all of which has been cleared up
> > now
> > with Symantec End Point, however, we cannot get the Microsoft Update
> > feature
> > to work at all.
> >
> > This is on XPP sp3, and I have tried already reinstalling all the WU
> > components, as well as the BT service. However, the Automatic Updates
> > Service will turn itself back to disabled after you enable it and Start
> > the
> > service from Services.msc
> >
> > Needless to say, I am spinning wheels at this point.
> > I have run through all the KB's I can find, and tried all, but still no
> > go.
> >
> > Anyone have any ideas of hope?
>
>

Hello Papi,

Because you had one piece of malware, the chances are also high that you had
others.

I recommend downloading and installing MalwareBytes' Antimalware (MBAM) and
SUPERAntiSpywa�e (SAS).

Do a full scan with Malwa�eBytes and SUPERAntiSpywa�e.

<http://www.superantispyware.com/>
-=-

<http://www.malwarebytes.org/mbam.php>
-=-
The programs are free. (There is a paid version but you don't need to buy it
to remove malware.)
-=-



Good luck
-=-

"Papi" wrote:

> OK, MSRT will not run manually. I have updated it and tried.
> Next, Spybot 1.6.2 w/latest Defs continues to pick up
> TinyBar.C even though I went through the manual removal process three times.
> It also picks up Smitfraud-C.and Virtumonde, and again, even after I ran
> manually remove.
>
> Yes, System Restore is off.
>
> Next, I ran the OneCare tool, however Symantec Endpoint found all that and
> repaired/quarant.
>
> When Windows or Microsoft Update goes to Run, I get the same error page that
> it couldn't start with all the things to check like BITS and so on, which has
> been done over a dozen times now.
>
>
>
> "PA Bear [MS MVP]" wrote:
>
> > You probably have (much) more work to do.
> >
> > 1. See if you can download/run the MSRT manually:
> > http://www.microsoft.com/security/ma...e/default.mspx
> >
> > 2. Run this online scan (in safe mode w/networking, if need be):
> > http://onecare.live.com/site/en-us/center/howsafe.htm
> >
> > 3. Run a /thorough/ check for hijackware, including posting the requested
> > logs in an appropriate forum.
> >
> > Checking for/Help with Hijackware
> > http://aumha.net/viewtopic.php?f=30&t=4075
> > http://mvps.org/winhelp2002/unwanted.htm
> > http://inetexplorer.mvps.org/data/prevention.htm
> > http://inetexplorer.mvps.org/tshoot.html
> > http://www.mvps.org/sramesh2k/Malware_Defence.htm
> > http://www.elephantboycomputers.com/...moving_Malware
> >
> > **Seek expert assistance in
> > http://spywarehammer.com/simplemachi...php?board=10.0,
> > http://forums.spybot.info/forumdisplay.php?f=22,
> > http://aumha.net/viewforum.php?f=30, or other appropriate forums.**
> >
> > If the procedures look too complex - and there is no shame in admitting this
> > isn't your cup of tea - take the machine to a local, reputable and
> > independent (i.e., not BigBoxStoreUSA) computer repair shop.
> > =====================
> > Start a free Windows Update support incident request:
> > https://support.microsoft.com/oas/de...spx?gprid=6527
> >
> > Support for Windows Update:
> > http://support.microsoft.com/gp/wusupport
> >
> > For home users, no-charge support is available by calling 1-866-PCSAFETY in
> > the United States and in Canada or by contacting your local Microsoft
> > subsidiary. There is no-charge for support calls that are associated with
> > security updates.
> > --
> > ~Robear Dyer (PA Bear)
> > MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> > AumHa VSOP & Admin http://aumha.net
> > DTS-L http://dts-l.net/
> >
> > Papi wrote:
> > > I have a user that had the Vundo issue, all of which has been cleared up
> > > now
> > > with Symantec End Point, however, we cannot get the Microsoft Update
> > > feature
> > > to work at all.
> > >
> > > This is on XPP sp3, and I have tried already reinstalling all the WU
> > > components, as well as the BT service. However, the Automatic Updates
> > > Service will turn itself back to disabled after you enable it and Start
> > > the
> > > service from Services.msc
> > >
> > > Needless to say, I am spinning wheels at this point.
> > > I have run through all the KB's I can find, and tried all, but still no
> > > go.
> > >
> > > Anyone have any ideas of hope?
> >
> >

hi Engel-

Yes, I am running Malwarebyte right now.
It has found items so far, and I am waiting for it to finish.
My user is remote, so it is a little more painful to get through in a GTA
session, but I am getting there.

If you (or the Board) can think of anything else, please let me know.
I am anxious to get this user patched and updated.


"Engel" wrote:

> Hello Papi,
>
> Because you had one piece of malware, the chances are also high that you had
> others.
>
> I recommend downloading and installing MalwareBytes' Antimalware (MBAM) and
> SUPERAntiSpywa�e (SAS).
>
> Do a full scan with Malwa�eBytes and SUPERAntiSpywa�e.
>
> <http://www.superantispyware.com/>
> -=-
>
> <http://www.malwarebytes.org/mbam.php>
> -=-
> The programs are free. (There is a paid version but you don't need to buy it
> to remove malware.)
> -=-
>
>
>
> Good luck
> -=-
>

Papi wrote:
> Yes, I am running Malwarebyte right now.
> It has found items so far, and I am waiting for it to finish.
> My user is remote, so it is a little more painful to get through in
> a GTA session, but I am getting there.
>
> If you (or the Board) can think of anything else, please let me
> know.
> I am anxious to get this user patched and updated.

Standard spiel for a Windows XP machine that won't update properly (although
you probably won't be able to say the machine is clean without a wipe.)

Download, install, run, update and perform a full scan (separately) with the
following two applications (freeware versions are the ones to use for this):

SuperAntiSpyware
http://www.superantispyware.com/

MalwareBytes
http://www.malwarebytes.com/

After performing a full scan with one and then the other and removing
whatever they both find completely, you may uninstall these products,
if you wish.

Reboot.

Start button --> RUN and type in:
%SystemRoot%\system32\net stop wuauserv
--> Click OK.

Start button --> RUN and type in:
%SystemRoot%\system32\regsvr32 %SystemRoot%\system32\wups2.dll
--> Click OK.

Start button --> RUN and type in:
%SystemRoot%\system32\net start wuauserv
--> Click OK.

Download the latest version of the Windows Update agent from here (x86):
http://go.microsoft.com/fwlink/?LinkID=91237
.... and save it to the root of your C:\ drive. After saving it to the root
of the C:\ drive, do the following:

Close all Internet Explorer windows and other applications.

Start button --> RUN and type in:
%SystemDrive%\windowsupdateagent30-x86.exe /WUFORCE
--> Click OK.

(If asked, select "Run.) --> Click on NEXT --> Select "I agree" and click on
NEXT --> When it finishes installing, click on "Finish"...

Reboot.

Download/Install the latest Windows Installer:
http://www.microsoft.com/downloadS/d...displaylang=en

Reboot.

Log on as a user with administrative rights and open Internet Explorer and
visit http://windowsupdate.microsoft.com/ and select to do a CUSTOM scan...
(Every time you are about to click on something while at these web pages -
first press and hold down the CTRL key while you click on it. You can
release the CTRL key after clicking each time.)

Once the scan is done, select just _ONE_ of the high priority updates
(deselect any others) and install it.

Reboot again.

If it did work - try the web page again - selecting no more than 3-5 at a
time.

The Optional Software updates are generally safe - although I recommend
against the "Windows Search" one. I would completely avoid the Optional
Hardware updates.

Come back - let us know if that worked.
.... Really - come back and let everyone know if that worked.

If it seemed to have failed, do this:

Click Start, and then click Run.
In the Open box, type: %windir%\windowsupdate.log
and then click OK.

Scroll down towards the bottom for the latest entries to locate any error
code(s) or explanation as to why the page cannot be displayed.

You can copy/paste the last 50 or so lines here...

How to read the Windowsupdate.log file:
http://support.microsoft.com/kb/902093

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

Move on to Step #3 or open a free support incident.

Papi wrote:
> OK, MSRT will not run manually. I have updated it and tried.
> Next, Spybot 1.6.2 w/latest Defs continues to pick up
> TinyBar.C even though I went through the manual removal process three
> times.
> It also picks up Smitfraud-C.and Virtumonde, and again, even after I ran
> manually remove.
>
> Yes, System Restore is off.
>
> Next, I ran the OneCare tool, however Symantec Endpoint found all that and
> repaired/quarant.
>
> When Windows or Microsoft Update goes to Run, I get the same error page
> that
> it couldn't start with all the things to check like BITS and so on, which
> has been done over a dozen times now.
>
>
>
> "PA Bear [MS MVP]" wrote:
>
>> You probably have (much) more work to do.
>>
>> 1. See if you can download/run the MSRT manually:
>> http://www.microsoft.com/security/ma...e/default.mspx
>>
>> 2. Run this online scan (in safe mode w/networking, if need be):
>> http://onecare.live.com/site/en-us/center/howsafe.htm
>>
>> 3. Run a /thorough/ check for hijackware, including posting the requested
>> logs in an appropriate forum.
>>
>> Checking for/Help with Hijackware
>> http://aumha.net/viewtopic.php?f=30&t=4075
>> http://mvps.org/winhelp2002/unwanted.htm
>> http://inetexplorer.mvps.org/data/prevention.htm
>> http://inetexplorer.mvps.org/tshoot.html
>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>> http://www.elephantboycomputers.com/...moving_Malware
>>
>> **Seek expert assistance in
>> http://spywarehammer.com/simplemachi...php?board=10.0,
>> http://forums.spybot.info/forumdisplay.php?f=22,
>> http://aumha.net/viewforum.php?f=30, or other appropriate forums.**
>>
>> If the procedures look too complex - and there is no shame in admitting
>> this isn't your cup of tea - take the machine to a local, reputable and
>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>> =====================
>> Start a free Windows Update support incident request:
>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>
>> Support for Windows Update:
>> http://support.microsoft.com/gp/wusupport
>>
>> For home users, no-charge support is available by calling 1-866-PCSAFETY
>> in
>> the United States and in Canada or by contacting your local Microsoft
>> subsidiary. There is no-charge for support calls that are associated
>> with
>> security updates.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>> AumHa VSOP & Admin http://aumha.net
>> DTS-L http://dts-l.net/
>>
>> Papi wrote:
>>> I have a user that had the Vundo issue, all of which has been cleared up
>>> now
>>> with Symantec End Point, however, we cannot get the Microsoft Update
>>> feature
>>> to work at all.
>>>
>>> This is on XPP sp3, and I have tried already reinstalling all the WU
>>> components, as well as the BT service. However, the Automatic Updates
>>> Service will turn itself back to disabled after you enable it and Start
>>> the
>>> service from Services.msc
>>>
>>> Needless to say, I am spinning wheels at this point.
>>> I have run through all the KB's I can find, and tried all, but still no
>>> go.
>>>
>>> Anyone have any ideas of hope?