Virus blocking windows update??

Hi everyone,

For a few days now I have been unable to download windows updates, as well
as getting access to some antivirus websites pages... For windows (sp1) I get
the error code 80070424. I am unable to access mcafee.com, some pages of
trend micro.com etc.

AVG 7 and online trendmicro scan regularly find versions of Agobot worms,
but despite following eradication procedures and system32 registry/files
modifications I can't get the problem solved.

Your help would be hence greatly appreciated...
Thanks a lot.

Cyril

1) Download the following four items...

McAfee Stinger
http://vil.nai.com/vil/stinger/

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download SYSCLEAN.COM and place it in that directory.
Download the Trend Pattern File by obtaining the ZIP file.
For example; lpt281.zip

Extract the contents of the ZIP file and place the contents in the same directory as
SYSCLEAN.COM .

2) Update Adaware with the latest definitions.
3) Disable System Restore
http://vil.nai.com/vil/SystemHelpDoc...SysRestore.htm
4) Reboot your PC into Safe Mode [F8 key during boot]
5) Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using the three
utilities; Trend Sysclean, Stinger and Adaware
7) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) Create a new Restore point



* * * Please report your results ! * * *

Dave




"Cyril" <> wrote in message
news:FB0DDAB0-E9A0-4EDC-B3EA-...
| Hi everyone,
|
| For a few days now I have been unable to download windows updates, as well
| as getting access to some antivirus websites pages... For windows (sp1) I get
| the error code 80070424. I am unable to access mcafee.com, some pages of
| trend micro.com etc.
|
| AVG 7 and online trendmicro scan regularly find versions of Agobot worms,
| but despite following eradication procedures and system32 registry/files
| modifications I can't get the problem solved.
|
| Your help would be hence greatly appreciated...
| Thanks a lot.
|
| Cyril

Hi
Thanks for the advice
I was unable to access your trend micro pages but I ran the online scan
instead: it didn't detect anything. On the other hand stinger detected Qhosts
apd trojan in 2 locations and repaired the infected files. Adaware just
deleted one cookie. AVG7 didn't detect anything too.

Bur it is still not working...
What to do next...?
Thanks

Cyril

"David H. Lipman" wrote:

> 1) Download the following four items...
>
> McAfee Stinger
> http://vil.nai.com/vil/stinger/
>
> Trend Sysclean Package
> http://www.trendmicro.com/download/dcs.asp
>
> Latest Trend Pattern File.
> http://www.trendmicro.com/download/pattern.asp
>
> Adaware SE (free personal version v1.05)
> http://www.lavasoftusa.com/
>
> Create a directory.
> On drive "C:\"
> (e.g., "c:\New Folder")
> or the desktop
> (e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")
>
> Download SYSCLEAN.COM and place it in that directory.
> Download the Trend Pattern File by obtaining the ZIP file.
> For example; lpt281.zip
>
> Extract the contents of the ZIP file and place the contents in the same directory as
> SYSCLEAN.COM .
>
> 2) Update Adaware with the latest definitions.
> 3) Disable System Restore
> http://vil.nai.com/vil/SystemHelpDoc...SysRestore.htm
> 4) Reboot your PC into Safe Mode [F8 key during boot]
> 5) Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of your
> platform and clean/delete any infectors/parasites found.
> (a few cycles may be needed)
> 6) Restart your PC and perform a "final" Full Scan of your platform using the three
> utilities; Trend Sysclean, Stinger and Adaware
> 7) Re-enable System Restore and re-apply any System Restore preferences,
> (e.g. HD space to use suggested 400 ~ 600MB),
> 8) Reboot your PC.
> 9) Create a new Restore point
>
>
>
> * * * Please report your results ! * * *
>
> Dave
>
>
>
>
> "Cyril" <> wrote in message
> news:FB0DDAB0-E9A0-4EDC-B3EA-...
> | Hi everyone,
> |
> | For a few days now I have been unable to download windows updates, as well
> | as getting access to some antivirus websites pages... For windows (sp1) I get
> | the error code 80070424. I am unable to access mcafee.com, some pages of
> | trend micro.com etc.
> |
> | AVG 7 and online trendmicro scan regularly find versions of Agobot worms,
> | but despite following eradication procedures and system32 registry/files
> | modifications I can't get the problem solved.
> |
> | Your help would be hence greatly appreciated...
> | Thanks a lot.
> |
> | Cyril
>
>
>

Cyril wrote:

> Hi
> Thanks for the advice
> I was unable to access your trend micro pages but I ran the online scan
> instead: it didn't detect anything. On the other hand stinger detected Qhosts
> apd trojan in 2 locations and repaired the infected files. Adaware just
> deleted one cookie. AVG7 didn't detect anything too.
>
> Bur it is still not working...
> What to do next...?
Hi

For your browsing issues to different web sites:

Your hosts file could be compromised, edit the following
file with Notepad:

Win95/98/ME: %windir%\hosts
Windows NT/2000/XP: %windir%\system32\drivers\etc\hosts

Click Start >> Run >>
Type the follow command in the Open box.
"notepad %windir%\system32\drivers\etc\hosts" (w/o quotes)
Press Ok

If there is anything within the file, remove anything but the line

127.0.0.1 localhost

and the comment lines at the top.

Be sure to go to the end of the file, sometimes the bad
app have added a lot of blank lines before the host entries
added to the file.



--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

Hi guys,

I had the same problem, and solved.

My advice to you is:

- Restart your computer in the security mode with network;
- and than download the anti-virus that you want. In my case, I used the
avast anti-virus, and it solved the problem without dificulties.


"Torgeir Bakken (MVP)" wrote:

> Cyril wrote:
>
> > Hi
> > Thanks for the advice
> > I was unable to access your trend micro pages but I ran the online scan
> > instead: it didn't detect anything. On the other hand stinger detected Qhosts
> > apd trojan in 2 locations and repaired the infected files. Adaware just
> > deleted one cookie. AVG7 didn't detect anything too.
> >
> > Bur it is still not working...
> > What to do next...?
> Hi
>
> For your browsing issues to different web sites:
>
> Your hosts file could be compromised, edit the following
> file with Notepad:
>
> Win95/98/ME: %windir%\hosts
> Windows NT/2000/XP: %windir%\system32\drivers\etc\hosts
>
> Click Start >> Run >>
> Type the follow command in the Open box.
> "notepad %windir%\system32\drivers\etc\hosts" (w/o quotes)
> Press Ok
>
> If there is anything within the file, remove anything but the line
>
> 127.0.0.1 localhost
>
> and the comment lines at the top.
>
> Be sure to go to the end of the file, sometimes the bad
> app have added a lot of blank lines before the host entries
> added to the file.
>
>
>
> --
> torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/scr...r/default.mspx
>

Hi,

I am one of those users who had a momentary lapse of brainpower. I opened
an ecard greeting and ended up with a virus. (My friend does actually send
these now and then!) Anyway, I think it's might be the same one Cyril has.
I also cannot get to any security/anti-virus websites. I would like to try
your suggestion regarding the 'security mode with network', however I don't
know what this is, nor how to do it. I will say I have since learned more
about computers than I thought I'd ever need!

Looking forward to your help, Marcus, Kelly

"Marcus Guerra" wrote:

> Hi guys,
>
> I had the same problem, and solved.
>
> My advice to you is:
>
> - Restart your computer in the security mode with network;
> - and than download the anti-virus that you want. In my case, I used the
> avast anti-virus, and it solved the problem without dificulties.
>
>
> "Torgeir Bakken (MVP)" wrote:
>
> > Cyril wrote:
> >
> > > Hi
> > > Thanks for the advice
> > > I was unable to access your trend micro pages but I ran the online scan
> > > instead: it didn't detect anything. On the other hand stinger detected Qhosts
> > > apd trojan in 2 locations and repaired the infected files. Adaware just
> > > deleted one cookie. AVG7 didn't detect anything too.
> > >
> > > Bur it is still not working...
> > > What to do next...?
> > Hi
> >
> > For your browsing issues to different web sites:
> >
> > Your hosts file could be compromised, edit the following
> > file with Notepad:
> >
> > Win95/98/ME: %windir%\hosts
> > Windows NT/2000/XP: %windir%\system32\drivers\etc\hosts
> >
> > Click Start >> Run >>
> > Type the follow command in the Open box.
> > "notepad %windir%\system32\drivers\etc\hosts" (w/o quotes)
> > Press Ok
> >
> > If there is anything within the file, remove anything but the line
> >
> > 127.0.0.1 localhost
> >
> > and the comment lines at the top.
> >
> > Be sure to go to the end of the file, sometimes the bad
> > app have added a lot of blank lines before the host entries
> > added to the file.
> >
> >
> >
> > --
> > torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
> > Administration scripting examples and an ONLINE version of
> > the 1328 page Scripting Guide:
> > http://www.microsoft.com/technet/scr...r/default.mspx
> >

i think i have it too. currently doing an avast scan. it blocks
download.microsoft.com and update.microsoft.com as far as I know. I didnt
notice it till a couple days ago when I couldnt go to download.microsoft.com
on my computer, but i could on another.

It is called the Conficker

Backup your personal data, then do a format & clean install of Windows.
Please note that a Repair Install (AKA in-place upgrade) will NOT fix this!

After the clean install, you'll have the equivalent of a "new computer" so
take care of everything on the following page before otherwise connecting
the machine to the internet or a network and before using a USB key that
isn't brand-new or hasn't been freshly formatted:

5 steps to help protect your new computer before you go online
http://www.microsoft.com/protect/com...nced/xppc.mspx


fman23 wrote:
> It is called the Conficker

"PA Bear [MS MVP]" wrote:

> Backup your personal data, then do a format & clean install of Windows.
> Please note that a Repair Install (AKA in-place upgrade) will NOT fix this!
>
> After the clean install, you'll have the equivalent of a "new computer" so
> take care of everything on the following page before otherwise connecting
> the machine to the internet or a network and before using a USB key that
> isn't brand-new or hasn't been freshly formatted:
>
> 5 steps to help protect your new computer before you go online
> http://www.microsoft.com/protect/com...nced/xppc.mspx
>
>
> fman23 wrote:
> > It is called the Conficker
>
> I have the same thing, i'm pretty sure it's the router. For me i'm sure the router has the virus sites on it's cache and is downloading it each time i delete it. I need to flush the cache, ipconfig /flushdns