Windows update won't work (Vista)

[indy777]

 Evilfantasy has been helping me with some malware issues. I have one problem left to fix and he thought I might better find the solution in this forum.
 I've had this problem for the last 5 days and don't think it has anything to do with my malware problem and neither does Kevin. Window update started a update and froze at 11% completed.
This is what the icon on the task bar says. When I go to Windows update in the control panel it shows 3 updates waiting to install. When I hit install the screen it freezes every time. No error messages. Also when I shut down it says "Do not turn off computer, configuring updates" When I start it says "Configuring 1 of 3 updates". I am running Vista Home edition Premium. I have tried every thing I can find on the Microsoft forms but nothing helps.
Any suggestions.

[Broni]

and froze at 11% completed

Here?

"Configuring 1 of 3 updates"

or?

Is the computer stuck there, or you did something about it?

[indy777]

No, I didn't do any about it. I couldn't find any thing like my problem on Microsoft update forums or troubleshooting. So I have to do a hard shut down every time I want to shut the computer down. It won't progress past the "configuring updates" message.

[Broni]

We'll try figure something out, but couple more questions first.
After hard shutdown, you have no problem to boot back to Windows?
I assume, after restart same 3 updates show up as needed to be installed, right?

[indy777]

No problems booting back up and yes the 3 updates are still there. From the Windows update screen when I hit Install, the screen freezes and I have to go to task manager to close the window.

[Broni]

I assume, when you're done with evil in malware forum, you guys created fresh restore point, correct?
If so, can you restore your system to that date, so we can start fresh?
What's the link to your malware thread?

[indy777]

I don't know how to show you the link

[Broni]

I got it: http://www.computerhope.com/forum/index.php/topic,84857.0.html

What about my questions?

[indy777]

No not that I know of. We did a lot of changes so I suppose there is a restore point there some where. This problem has been there before my malware problem so a restore point would put me back where I am now.

[JJ 3000]

give this a look
http://support.microsoft.com/kb/958046

This should delete those updates and let you start over.

[Broni]

This problem has been there before my malware problem

Alrighty then. It's very possible, that malware actually caused the problem.
In any case....

If you have HijackThis installed, run it, and paste its log here.
If you don't have it...

Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
by clicking on Download HijackThis Installer
Install, and run it.
Post HijackTHis log.
Do NOT attempt to fix anything!

NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator

===============================================================================

Give me the above log, and you....

Download WUFix.
Double click on WUFix.bat file to run it.
Vista users: right click on WUFix.bat, and click Run as Administrator.
After successful run, restart computer.

Try Windows Updates.

[indy777]

I will try that in the morning, and let you know if it works.
Thanks

[Broni]

No problem

[indy777]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:14:07 PM, on 6/9/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\WINDOWS\RtHDVCpl.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\java\jre6\bin\jusched.exe
C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\William Michels\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Webshots\webshots.scr
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Windows\Explorer.EXE
L:\sniper.exe.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PCH Search & Win Toolbar - {4E7BD74F-2B8D-469E-C8ED-EA2EFAD2ED61} - C:\PROGRA~1\SEARCH~1\SEARCH~1.DLL
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Webshots Toolbar - {C17590D2-ECB4-4b15-8820-F58798DCC118} - (no file)
O3 - Toolbar: PCH Search & Win Toolbar - {4E7BD74F-2B8D-469E-C8ED-EA2EFAD2ED61} - C:\PROGRA~1\SEARCH~1\SEARCH~1.DLL
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [PCDrProfiler] C:\Program Files\PC-Doctor 5 for Windows\RunProfiler.exe -r
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SansaDispatch] C:\Users\William Michels\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1238037238405
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238036811723
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10373 bytes

[indy777]

Downloaded the WUFix.bat file, ran it and shut down.
Shut down and start up were normal.
Now I have 19 important updates,
I checked only the important updates and hit install, this time it got to 16% and stopped. The update screen froze, wouldn't let me do anything in that window.
I ran the WUfix batch file again, rebooted.
This time I didn't try to Install.
The icon on the task bar says "Windows is downloading updates 11%" and there it stays as before.
 I won't try to do anything else till I hear from you.

[Broni]

Next step. Try to install updates one at a time.

[indy777]

I tried one and it got to 23% and stopped.
Shut down and started over with a different update and it went to 99% and didn't progress any further. Froze the windows update screen. Shut down.

Some thing else happened earlier when I was trying to run the WUFix.bat, when I tried to Run as Administrator the whole computer froze, the only thing that worked was the cursor. Don't know if that has any bearing on what we are trying to do now.

[Broni]

Did the WUFix.bat run successfully at all?
I mean, when you did run it as administrator, CMD window should open for a moment, and then, it supposed to close by itself.

[indy777]

Yes it ran successfully but not from "right click, Run as Administrator"
When I just double click (left mouse button) it ran. It had to have worked that way because it unfroze the Update window. No matter what I have tried to use the right click, run as administrator, has worked. This was part of my original problem that never got fixed.

[Broni]

OK. Delete that bat file, because you don't need to play with it anymore.

Next step...

Go Start>Run (Start Search in Vista), type in:
msconfig
Click OK (hit Enter in Vista).

Click on Startup tab.
Click Disable all

Click Services tab.
Put checkmark in Hide all Microsoft services
Click Disable all.

Click OK.
Restart computer in Normal Mode.

NOTE. If you use different firewall, than Windows firewall, turn Windows firewall on, just for this test, since your regular firewall won't be running.
If you use Windows firewall, you're fine.

Try to install just one update.

[indy777]

I tried 2X
Typed msconfig in search, hit enter, nothing happened. The start window froze up, had to reboot.
 Second time tried, Accessories, run window, typed msconfig, nothing happens.

[Broni]

Open Windows Explorer, navigate to C:\Windows\System32, see, if msconfig.exe is there.
Don't use "search". It sucks, and finds nothing.

[indy777]

Yes I found it and double clicked on it and the screen froze. Had to go to task manager to shut that screen down.

[Broni]

I'm attaching my zipped msconfig.exe. Unzip it
Rename yours to msconfig.old, and paste mine msconfig.exe into C:\Windows\System32 folder.
You may need to do it in Safe Mode. Try normal mode, first.

[attachment deleted by admin]

[indy777]

Just to be sure I am renaming the correct one,

I found 2 files:
msconfig.exe.mui

3 files:
msconfig.exe
These are all application files,

[Broni]

The only one, you need to rename, is the one in C:\Windows\System32.

[indy777]

I tried and waited a long time. The screen says it's copying but nothing is happening.
Stupid computer.
And again I had to go to task manager to shut down that screen. Could this have something to do with Administration rights?

[Broni]

I doubt.
I think, you may have some serious system files corruption, and short of reinstall, I'm not sure, what else we can do here.
I'm sorry...

[indy777]

I believe you are right. Something really weird is happening here. The computer is running fine with the exception of what we have been working on and I hate to have to restore to original configuration but that may be the only answer.
I really appreciate all your help, Thank you

[Broni]

You're welcome
I wish, I was of more help....

[indy777]

Just a follow up on my post, I spent days on line with HP trying to solve this problem. They also gave up so don't feel bad. Anyway I ended up doing a system restore, just what I was trying to avoid but it's working now.
Thanks again for trying to help me.

[Broni]

Thank you for posting back