Computer Hope
Software => Computer viruses and spyware => Topic started by: gazza211 on November 24, 2009, 06:24:52 AM
-
Hi Guys, i have an issue on my laptop (windows XP, service pack 2, norton 2009 AV) i cannot install any windows security updates, earlier this year i think i had the Conficker virus because i couldn't access any anti virus sites or microsoft, at the time i had AVG Free antivirus which i assumed was causing the problem so i uninstalled it to install Norton instead,, anyway to cut a long story short i used another forum and by posting the hi-jack log and running combofix i was able to load Norton, get onto antivirus sites, Microsoft etc but am still unable to install windows updates and SP3, the help on the old forum seems to have dried up, so i hope some one on here may be able to finalise my problems
Thanks in advance Gary ;D
-
Welcome to Computer Hope Gazza211.
We need you to go here (http://www.computerhope.com/forum/index.php/topic,46313.0.html), follow the directions EXACTLY and post the log files as requested.
A specialist will be with you, but be patient, we are all volunteers.
-
Hi Thanks for replying so quickly, i will run all the scans / logs this evening and post them later.
Thank you Gary
-
Hi i have run all the scans / logs you requested and attached them below, hope you can help with my problem installing windows updates. Thank you Gary
[Saving space, attachment deleted by admin]
-
If you already have ComboFix be sure to delete it and download a new copy.
Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.
Link #1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link #2 (http://www.forospyware.com/sUBs/ComboFix.exe)
**Note: It is important that it is saved directly to your Desktop
Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.
Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link (http://www.bleepingcomputer.com/forums/topic114351.html) to see a list of security programs that should be disabled and how to disable them.
Double click combofix.exe & follow the prompts.
Vista users Right-Click on ComboFix.exe and select Run as administrator (you will receive a UAC prompt, please allow it)
When finished ComboFix will produce a log for you.
Post the ComboFix log in your next reply.
Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.
Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.
If you have problems with ComboFix usage, see How to use ComboFix (http://www.bleepingcomputer.com/combofix/how-to-use-combofix)
-
Hi Combofix log attached, Thanks for the help so far. Gary
[Saving space, attachment deleted by admin]
-
Hi, Also on my 'C' drive i have 19 folders called 'FOUND.000' up to FOUND.018 please can you let me know what these are.
Thanks again
-
Hi, Also on my 'C' drive i have 19 folders called 'FOUND.000' up to FOUND.018
Delete all of them and then empty the recycle bin.
Please download SystemLook from one of the links below and save it to your desktop.
Link #1 (http://jpshortstuff.247fixes.com/SystemLook.exe)
Link #2 (http://images.malwareremoval.com/jpshortstuff/SystemLook.exe)
Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link (http://www.bleepingcomputer.com/forums/topic114351.html) to see a list of security programs that should be disabled and how to disable them.
- Double-click SystemLook.exe to run it.
- Copy the contents of the following codebox into the main textfield.
:filefind
proquota.exe
- Click the Look button to start the scan.
- Note: The scan may take some time so please just let it do its work and be patient (or do something else unrelated to the computer).
- When finished, a notepad window will open with the results of the scan. Please post the log. The log can also be found on your desktop entitled SystemLook.txt
-
Hi Systemlook has been run, log attached, Thanks Gary
[Saving space, attachment deleted by admin]
-
1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C
KillAll::
FCopy::
C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\proquota.exe | c:\windows\system32\proquota.exe
Quit::
3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!
(http://i154.photobucket.com/albums/s258/evilfantasy69/CFScript-1.gif)
ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.
Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze
-
Hi Copied the CFScript via notepad into combofix, hopefully the Combofix logfile is located in the correct place,
http://www.filedropper.com/combofixlog1
<img src=http://www.filedropper.com/download_button.png width=127 height=145 border=0/> (http://www.filedropper.com/combofixlog1)
<div style=font-size:9px;font-family:Arial, Helvetica, sans-serif;width:127px;font-color:#44a854;> <a href=http://www.filedropper.com > FileDropper Free File Hosting[/url]</div>
Thanks Gary (If i have done this incorrectly please let me know) Thanks again
-
Okay now let's see what else might be hiding.
* Click START then RUN - Vista users press the Windows Key and the R keys for the Run box.
* Now type Combofix /Uninstall in the runbox
* Make sure there's a space between Combofix and /Uninstall
* Then hit Enter
* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.
----------
Clean out your temporary internet files and temp files.
Download TFC by OldTimer (http://oldtimer.geekstogo.com/TFC.exe) to your desktop.
Double-click TFC.exe to run it.
Note: If you are running on Vista, right-click on the file and choose Run As Administrator
TFC will close all programs when run, so make sure you have saved all your work before you begin.
* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.
Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
----------
ESET Online Scan
Scan your computer with the ESET FREE Online Virus Scan (http://eset.com/onlinescan)
* Click the ESET Online Scanner button.
* For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
* Click on the esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop
* Double click on the esetsmartinstaller_enu.exe icon on your desktop.
* Place a check mark next to YES, I accept the Terms of Use.
* Click the Start button.
* Accept any security warnings from your browser.
* Leave the check mark next to Remove found threats and place a check next to Scan archives.
* Click the Start button.
* ESET will then download updates, install, and begin scanning your computer. Please be patient as this can take some time.
* When the scan completes, click List of found threats.
* Next click Export to text file and save the file to your desktop using a name such as ESETScan. Include the contents of this report in your next reply.
* Click the <<Back button then click Finish.
In your next reply please include the ESET Online Scan Log
-
Hi, all the items carried out, the ESET scan showed no threats and left no log, please let me know if that is OK
Thanks Gary
-
As long as the computer is running good we can finish up now.
Use the Secunia Software Inspector (http://secunia.com/software_inspector) to check for out of date software.
- Click Start Now
- Check the box next to Enable thorough system inspection.
- Click Start
- Allow the scan to finish and scroll down to see if any updates are needed.
- Update anything listed.
.
----------
Go to Microsoft Windows Update (http://windowsupdate.microsoft.com/) and get all critical updates.
----------
I recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection so will not interfere with each other. They do not use any significant amount of resources (except a little disk space) until you run a scan.
I suggest using WOT - Web of Trust (http://www.mywot.com/). WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.
SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html) - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* (http://www.bleepingcomputer.com/tutorials/tutorial49.html)Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/forums/tutorial49.html)
* If you don't know what ActiveX controls are, see here (http://www.webopedia.com/TERM/A/ActiveX_control.html)
Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy (http://www.safer-networking.org/en/spybotsd/index.html). Guide: Use Spybot's Immunize Feature (http://www.bleepingcomputer.com/tutorials/tutorial43.html#immunize) to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ (http://www.safer-networking.org/en/faq/index.html)
Check out Keeping Yourself Safe On The Web (http://evilfantasy.wordpress.com/2008/05/20/keeping-yourself-safe-on-the-web/) for tips and free tools to help keep you safe in the future.
Also see Slow Computer? It May Not Be Malware (http://evilfantasy.wordpress.com/2008/05/24/slow-computer-it-may-not-be-malware/) for free cleaning/maintenance tools to help keep your computer running smooth.
-
Hi still got the same problem, can't install windows security updates and service pack 3, secunia says it is having a problem with loading JAVA applets to my browser, it is asking for JAVA 1.6.x i have JAVA 1.6.0_17 which i assumed was the latest level.
Secunia appears to be running but gives no run time in minutes and seconds of how long the scan has been ongoing. i have left it for over an hour with no outcome. i have tried to update SP3 and the 31 outstanding security updates but they are all cancelled half way through. Please see screenshots attached. hope you have some more ideas?
Thanks Gary
Added security updates that have failed as an attachment
[Saving space, attachment deleted by admin]
-
Try this. How to reset Internet Explorer settings http://support.microsoft.com/kb/923737
-
Hi. reset internet explorer as Microsoft bulletin, twice and rebooted between each one, tried to install SP3 and still getting the same installation failed message.
Gary
-
Please do the following:
1. Download this diagnostics tool MGADiag.exe (http://go.microsoft.com/fwlink/?linkid=52012) and save this to your Desktop.
2. Double-click on MGADiag.exe and click Continue
3. When the program has finished, click on Copy
4. Post the results in your next reply.
----------
Also try Dial-a-fix.
Download Dial-a-Fix (http://majorgeeks.com/Dial-a-fix_d4899.html) by djlizard, save it to the desktop then extract it to it's own folder.
- Open the folder and run Dial-a-fix.exe
- 2 windows will open. Close the one in the background labeled Restrictive Policies
- Check the box in section 1, Empty temp folders.
- Check the box in section 2, Fix Windows Installer.
- Check the box in section 3, Fix Windows Update.
- Check the box in section 4, labeled SSL/HTTPS/Cryptography. The 4 boxes under it should be pre-checked
- Check all boxes in section 5, labeled Registration Center.
- Click Go
- OK any error messages if received, but write them down and post them here.
- Restart the computer when done.
.
Is the problem fixed?
-
Hi Results from MGA scan attached, no threats / faults found on dial a fix, still getting SP3 installation cancelled after rebooting PC, Thanks for your help so far Gary
[Saving space, attachment deleted by admin]
-
Hi just doing a bit of web surfing and came across this site with a repair for windows update do you think it is worth trying? link attached,
http://windowssecrets.com/2007/09/27/03-Stealth-Windows-update-prevents-XP-repair
thanks Gary
-
Yes that link is worth a try.
If that doesn't work try starting a new topic in the Computer Help forum so others will reply with some new ideas. I'm sort of out of suggestions.
-
OK that link makes no difference :'(, thanks for your help so far, i will raise a new topic and see what can be done.
Thanks Gary