Windows Update service deleted!

I recently got hit by a bad slump of malware on my comp, which disabled
windows update, then it deleted the service. How can I get it back, I had to
uninstall sp1 just to get the ballon notification to take a hike.

Forgot to include the essentials, Vista 34 bit, if anyhting else is needed, I
can supply.

"Tundo" wrote:

> I recently got hit by a bad slump of malware on my comp, which disabled
> windows update, then it deleted the service. How can I get it back, I had to
> uninstall sp1 just to get the ballon notification to take a hike.

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Tundo wrote:
> I recently got hit by a bad slump of malware on my comp, which disabled
> windows update, then it deleted the service. How can I get it back, I had
> to
> uninstall sp1 just to get the ballon notification to take a hike.

yeah already read that, was looking for a more human reply, there is no
malware on my comp anymore.

"PA Bear [MS MVP]" wrote:

> Unexplained computer behavior may be caused by deceptive software
> http://support.microsoft.com/kb/827315
>
> Run a /thorough/ check for hijackware, including posting your hijackthis log
> to an appropriate forum.
>
> Checking for/Help with Hijackware
> http://aumha.org/a/parasite.htm
> http://aumha.org/a/quickfix.htm
> http://aumha.net/viewtopic.php?t=5878
> http://wiki.castlecops.com/Malware_R...:_Introduction
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
> http://inetexplorer.mvps.org/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://defendingyourmachine2.blogspot.com/
> http://www.elephantboycomputers.com/...moving_Malware
>
> When all else fails, HijackThis v2.0.2
> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
> conjuction with some other utilities). HijackThis will NOT fix anything on
> its own, but it will help you to both identify and remove any
> hijackware/spyware with assistance from an expert. **Post your log to
> http://aumha.net/viewforum.php?f=30,
> http://forums.spybot.info/forumdisplay.php?f=22,
> http://castlecops.com/forum67.html, or other appropriate forums for review
> by an expert in such matters, not here.**
>
> If the procedures look too complex - and there is no shame in admitting this
> isn't your cup of tea - take the machine to a local, reputable and
> independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
> Tundo wrote:
> > I recently got hit by a bad slump of malware on my comp, which disabled
> > windows update, then it deleted the service. How can I get it back, I had
> > to
> > uninstall sp1 just to get the ballon notification to take a hike.
>
>

I can assure you that you've not fully recovered from the hijackware
infection, my friend. If you don't want to seek the assistance of an expert
in such matters by posting in an appropriate forum (We don't deal with this
in public newsgroups, and certainly not in this newsgroup), best to wipe &
reload.

Good luck.
--
~PA Bear


Tundo wrote:
> yeah already read that, was looking for a more human reply, there is no
> malware on my comp anymore.
>
> "PA Bear [MS MVP]" wrote:
>
>> Unexplained computer behavior may be caused by deceptive software
>> http://support.microsoft.com/kb/827315
>>
>> Run a /thorough/ check for hijackware, including posting your hijackthis
>> log to an appropriate forum.
>>
>> Checking for/Help with Hijackware
>> http://aumha.org/a/parasite.htm
>> http://aumha.org/a/quickfix.htm
>> http://aumha.net/viewtopic.php?t=5878
>> http://wiki.castlecops.com/Malware_R...:_Introduction
>> http://mvps.org/winhelp2002/unwanted.htm
>> http://inetexplorer.mvps.org/data/prevention.htm
>> http://inetexplorer.mvps.org/tshoot.html
>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>> http://defendingyourmachine2.blogspot.com/
>> http://www.elephantboycomputers.com/...moving_Malware
>>
>> When all else fails, HijackThis v2.0.2
>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use
>> (in conjuction with some other utilities). HijackThis will NOT fix
>> anything on its own, but it will help you to both identify and remove any
>> hijackware/spyware with assistance from an expert. **Post your log to
>> http://aumha.net/viewforum.php?f=30,
>> http://forums.spybot.info/forumdisplay.php?f=22,
>> http://castlecops.com/forum67.html, or other appropriate forums for
>> review
>> by an expert in such matters, not here.**
>>
>> If the procedures look too complex - and there is no shame in admitting
>> this isn't your cup of tea - take the machine to a local, reputable and
>> independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair
>> shop.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>> AumHa VSOP & Admin http://aumha.net
>> DTS-L http://dts-l.net/
>>
>> Tundo wrote:
>>> I recently got hit by a bad slump of malware on my comp, which disabled
>>> windows update, then it deleted the service. How can I get it back, I
>>> had
>>> to
>>> uninstall sp1 just to get the ballon notification to take a hike.

bitdefender 2009 cant find anything left, malwarebytes scanner cant find
anything at all, windows liveone online scanner cant find anything left, f
force cant find anything left, i even did two rootkit scans, one scanner
found a rootkit, and got rid of it. i think its gone. It would be a miracle
for something to still be here. Now getting beck to my issue, how can I get
the windows update service back, clean reinstall, is there a hotfix for this
maybe, do I need to uninstall updates, then reinstall them?

"PA Bear [MS MVP]" wrote:

> I can assure you that you've not fully recovered from the hijackware
> infection, my friend. If you don't want to seek the assistance of an expert
> in such matters by posting in an appropriate forum (We don't deal with this
> in public newsgroups, and certainly not in this newsgroup), best to wipe &
> reload.
>
> Good luck.
> --
> ~PA Bear
>
>
> Tundo wrote:
> > yeah already read that, was looking for a more human reply, there is no
> > malware on my comp anymore.
> >
> > "PA Bear [MS MVP]" wrote:
> >
> >> Unexplained computer behavior may be caused by deceptive software
> >> http://support.microsoft.com/kb/827315
> >>
> >> Run a /thorough/ check for hijackware, including posting your hijackthis
> >> log to an appropriate forum.
> >>
> >> Checking for/Help with Hijackware
> >> http://aumha.org/a/parasite.htm
> >> http://aumha.org/a/quickfix.htm
> >> http://aumha.net/viewtopic.php?t=5878
> >> http://wiki.castlecops.com/Malware_R...:_Introduction
> >> http://mvps.org/winhelp2002/unwanted.htm
> >> http://inetexplorer.mvps.org/data/prevention.htm
> >> http://inetexplorer.mvps.org/tshoot.html
> >> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> >> http://defendingyourmachine2.blogspot.com/
> >> http://www.elephantboycomputers.com/...moving_Malware
> >>
> >> When all else fails, HijackThis v2.0.2
> >> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use
> >> (in conjuction with some other utilities). HijackThis will NOT fix
> >> anything on its own, but it will help you to both identify and remove any
> >> hijackware/spyware with assistance from an expert. **Post your log to
> >> http://aumha.net/viewforum.php?f=30,
> >> http://forums.spybot.info/forumdisplay.php?f=22,
> >> http://castlecops.com/forum67.html, or other appropriate forums for
> >> review
> >> by an expert in such matters, not here.**
> >>
> >> If the procedures look too complex - and there is no shame in admitting
> >> this isn't your cup of tea - take the machine to a local, reputable and
> >> independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair
> >> shop.
> >> --
> >> ~Robear Dyer (PA Bear)
> >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> >> AumHa VSOP & Admin http://aumha.net
> >> DTS-L http://dts-l.net/
> >>
> >> Tundo wrote:
> >>> I recently got hit by a bad slump of malware on my comp, which disabled
> >>> windows update, then it deleted the service. How can I get it back, I
> >>> had
> >>> to
> >>> uninstall sp1 just to get the ballon notification to take a hike.
>
>

You've not stated which malwares were involved and for all we know
there's still the possibility/likelihood of hidden malware. Your
description of the corruption and subsequent deletion of the Windows
Update service sounds as if it was a Zlob/Vundo/Virtumonde infection.
The latest variants of that 'malware cocktail' contain a rootkit-like
component.

Having a malware removal expert assist you at one of the reputable
anti-malware forums would be a wise move.
If/when you get the WU service restored and the system *still* has some
hidden 'guests', it will be corrupted/deleted again.

> Vista 34 bit

And BTW, Vista is 32 bit, there isn't any '34 bit' OS of anything.

It's your system, do what you want with it.


MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============



Tundo wrote:

> yeah already read that, was looking for a more human reply, there is no
> malware on my comp anymore.
>

>>Tundo wrote:
>>
>>>I recently got hit by a bad slump of malware on my comp, which disabled
>>>windows update, then it deleted the service. How can I get it back, I had
>>>to
>>>uninstall sp1 just to get the ballon notification to take a hike.
>>
>>

None of those tools/scans will help.

Repost:

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for review
by an expert in such matters, not here.**
--
~PA Bear

Tundo wrote:
> bitdefender 2009 cant find anything left, malwarebytes scanner cant find
> anything at all, windows liveone online scanner cant find anything left, f
> force cant find anything left, i even did two rootkit scans, one scanner
> found a rootkit, and got rid of it. i think its gone. It would be a
> miracle
> for something to still be here. Now getting beck to my issue, how can I
> get
> the windows update service back, clean reinstall, is there a hotfix for
> this
> maybe, do I need to uninstall updates, then reinstall them?
>
> "PA Bear [MS MVP]" wrote:
>
>> I can assure you that you've not fully recovered from the hijackware
>> infection, my friend. If you don't want to seek the assistance of an
>> expert in such matters by posting in an appropriate forum (We don't deal
>> with this in public newsgroups, and certainly not in this newsgroup),
>> best
>> to wipe & reload.
>>
>> Good luck.
>> --
>> ~PA Bear
>>
>>
>> Tundo wrote:
>>> yeah already read that, was looking for a more human reply, there is no
>>> malware on my comp anymore.
>>>
>>> "PA Bear [MS MVP]" wrote:
>>>
>>>> Unexplained computer behavior may be caused by deceptive software
>>>> http://support.microsoft.com/kb/827315
>>>>
>>>> Run a /thorough/ check for hijackware, including posting your
>>>> hijackthis
>>>> log to an appropriate forum.
>>>>
>>>> Checking for/Help with Hijackware
>>>> http://aumha.org/a/parasite.htm
>>>> http://aumha.org/a/quickfix.htm
>>>> http://aumha.net/viewtopic.php?t=5878
>>>> http://wiki.castlecops.com/Malware_R...:_Introduction
>>>> http://mvps.org/winhelp2002/unwanted.htm
>>>> http://inetexplorer.mvps.org/data/prevention.htm
>>>> http://inetexplorer.mvps.org/tshoot.html
>>>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>>>> http://defendingyourmachine2.blogspot.com/
>>>> http://www.elephantboycomputers.com/...moving_Malware
>>>>
>>>> When all else fails, HijackThis v2.0.2
>>>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to
>>>> use
>>>> (in conjuction with some other utilities). HijackThis will NOT fix
>>>> anything on its own, but it will help you to both identify and remove
>>>> any
>>>> hijackware/spyware with assistance from an expert. **Post your log to
>>>> http://aumha.net/viewforum.php?f=30,
>>>> http://forums.spybot.info/forumdisplay.php?f=22,
>>>> http://castlecops.com/forum67.html, or other appropriate forums for
>>>> review
>>>> by an expert in such matters, not here.**
>>>>
>>>> If the procedures look too complex - and there is no shame in admitting
>>>> this isn't your cup of tea - take the machine to a local, reputable and
>>>> independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair
>>>> shop.
>>>> --
>>>> ~Robear Dyer (PA Bear)
>>>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>>> AumHa VSOP & Admin http://aumha.net
>>>> DTS-L http://dts-l.net/
>>>>
>>>> Tundo wrote:
>>>>> I recently got hit by a bad slump of malware on my comp, which
>>>>> disabled
>>>>> windows update, then it deleted the service. How can I get it back, I
>>>>> had
>>>>> to
>>>>> uninstall sp1 just to get the ballon notification to take a hike.

i had the same problem i have tred everythng to get my windows updates to
work and no luck

"Tundo" wrote:

> I recently got hit by a bad slump of malware on my comp, which disabled
> windows update, then it deleted the service. How can I get it back, I had to
> uninstall sp1 just to get the ballon notification to take a hike.

u installed norton at that time and is ur window is windows vista extreme edition based on windows vista ultimate