automatic windows update service

[tango13]

hi i have xp prof sp3 (freshly repaired) but the problem happens after a
trojan raid my pc.
if i try to start the automatic update service or the intelligent background
transmission service. it tells me no file found.
so no manual update via ms webpage.
if i look in update.log some veresion seems too low.
FATAL: Update required for C:\WINDOWS\system32\cdm.dll: target version =
5.5.3790.5512, required version = 7.2.6001.788
FATAL: Update required for C:\WINDOWS\system32\wuapi.dll: target version =
5.4.3790.5512, required version = 7.2.6001.788
FATAL: Update required for C:\WINDOWS\system32\wuauclt.exe: target version =
5.4.3790.5512, required version = 7.2.6001.788
FATAL: Update required for C:\WINDOWS\system32\wuaucpl.cpl: target version =
5.4.3790.5512, required version = 7.2.6001.788
FATAL: Update required for C:\WINDOWS\system32\wuaueng.dll: target version =
5.4.3790.5512, required version = 7.2.6001.788
FATAL: Update required for C:\WINDOWS\system32\wucltui.dll: target version =
5.4.3790.5512, required version = 7.2.6001.788
FATAL: Update required for C:\WINDOWS\system32\wups.dll: target version =
5.4.3790.5512, required version = 7.2.6001.788
FATAL: Update required for C:\WINDOWS\system32\wups2.dll: target version =
0.0.0.0, required version = 7.2.6001.788
Setup * IsUpdateRequired = Yes

the mui files seem ok!
more important is the following:
Registering binary: C:\WINDOWS\system32\regsvr32.exe /s
"C:\WINDOWS\system32\wuaueng.dll"
2009-06-22 22:58:06:125 4056 cc4 Misc =========== Logging initialized
(build: 7.2.6001.788, tz: +0200) ===========
2009-06-22 22:58:06:125 4056 cc4 Misc = Process:
C:\WINDOWS\system32\regsvr32.exe
2009-06-22 22:58:06:125 4056 cc4 Misc = Module:
C:\WINDOWS\system32\wuaueng.dll
2009-06-22 22:58:06:125 4056 cc4 Service FATAL: ChangeServiceConfig failed
with error 0x80070005
2009-06-22 22:58:06:125 4056 cc4 Service FATAL: WU client fail to create WU
service with error 0x80070005

can you help?
thanks Thomas

[Shenan Stanley]

Download, install, run, update and perform a full scan (separately) with the
following two applications (freeware versions are the ones to use for this):

SuperAntiSpyware
http://www.superantispyware.com/

MalwareBytes
http://www.malwarebytes.com/

After performing a full scan with one and then the other and removing
whatever they both find completely, you may uninstall these products,
if you wish.

Download and run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

Reboot.

Search your registry for %fystem and replace the "f" with an "s". May be
three or four matches.

Download/Install the latest Windows Installer (for your OS):
( Windows XP 32-bit : WindowsXP-KB942288-v3-x86.exe )
http://www.microsoft.com/downloadS/details.aspx?familyid=5A58B56F-60B6-4412-95B9-54D056D6F9F4&displaylang=en

and...

Download the latest version of the Windows Update agent from here (x86):
http://go.microsoft.com/fwlink/?LinkID=91237
... and save it to the root of your C:\ drive. After saving it to the root
of the C:\ drive, do the following:

Close all Internet Explorer windows and other applications.

Start button --> RUN and type in:
%SystemDrive%\windowsupdateagent30-x86.exe /WUFORCE
--> Click OK.

(If asked, select "Run.) --> Click on NEXT --> Select "I agree" and click on
NEXT --> When it finishes installing, click on "Finish"...

Reboot.

Then follow the instructions here:

How do I reset Windows Update components?
http://support.microsoft.com/kb/971058

and..

Log on as an user with administrative rights and open Internet Explorer and
visit http://windowsupdate.microsoft.com/ and select to do a CUSTOM scan...
(Every time you are about to click on something while at these web pages -
first press and hold down the CTRL key while you click on it. You can
release the CTRL key after clicking each time.)

Once the scan is done, select just _ONE_ of the high priority updates
(deselect any others) and install it.

Reboot again.

If it did work - try the web page again - selecting no more than 3-5 at a
time.

The Optional Software updates are generally safe - although I recommend
against the "Windows Search" one and any of the "Office Live" ones for
now. I would completely avoid the Optional Hardware updates. Also - I do
not see any urgent need to install Internet Explorer 8 at this time.

Come back - let us know if that worked.
... Really - come back and let everyone know if that worked.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

[PA Bear [MS MVP]]

A Repair Install will NOT resolve a Trojan/hijackware infection! You have
more work to do.

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. Another Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
(only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

=====================
Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002

tango13 wrote:
> hi i have xp prof sp3 (freshly repaired) but the problem happens after a
> trojan raid my pc.
> if i try to start the automatic update service or the intelligent
> background
> transmission service. it tells me no file found.
> so no manual update via ms webpage.

<snip>

[tango13]

"PA Bear [MS MVP]" wrote:

> A Repair Install will NOT resolve a Trojan/hijackware infection! You have
> more work to do.
>
>

stop stop, the pc is clean ! it was cleaned by hijackthis team.
a newvirusscanner is also installed. i feared something was
broken/eliminated in windows during the cleaning, therefor i started the
repair.

i wll follow you advice but these malware tools are all done
sincerely thomas

[tango13]

Hi Stanley,
to be 100% clear.
after calling services.msc i tried to start these 2 services (automatic

update service or the intelligent

> > background transmission service). allways message comes back "file not found -error 2-"

also a manula net start wuauserv gives failure.

registering the services or looking for missing DLL files (which were listed
in the download page of the MS update service software) does not help.
if this additional info does change your instructions , please respond
otherwise i will execute them.....

thanks thomas
"Shenan Stanley" wrote:

> .... and save it to the root of your C:\ drive. After saving it to the root

> .... Really - come back and let everyone know if that worked.

[Shenan Stanley]

tango13 wrote:
> Hi Stanley,
> to be 100% clear.
> after calling services.msc i tried to start these 2 services
> (automatic update service or the intelligent
> background transmission service). allways message comes back
> "file not found -error 2-"
>
> also a manula net start wuauserv gives failure.
>
> registering the services or looking for missing DLL files (which
> were listed in the download page of the MS update service software)
> does not help.
> if this additional info does change your instructions , please
> respond otherwise i will execute them.....
>
> thanks thomas

( I wonder if I should swap my last name/first name instead of putting it
like everyone else - or if the last name referral thing is just more common
than I know about. ;-) )

Nothing changes. You need to cleanup your system. It sounds to me like you
were infected and infested. You may think you are clean - and the actual
infection/infestation *may* be gone (and thus the first three scans may find
nothing, but they wouldn't hurt) and I still suggest (strognly) you search
your registry for %fystem (specifically %fystemRoot% - changing it to
%SystemRoot%.) It's not the first time I have seen this on a system -
firsthand with customers or through the newsgroups. Maybe I am wrong - so
be it - but doing the search certainly does you no harm. *grin*

Doing the extra scans will not harm your computer. In fact - nothing I
suggested will harm your computer. You'll notice it is a pretty good ways
in before I suggest any DLL registration. This cleanup is standard for me
whether or not they report issues with the updating system in Windows XP -
usually before i do any other updates.

[tango13]

hi shenan,
different culture different names.
stanley is in europe also a firstname. its not easy to recognize it for
foreign people :-)
and nicknames in a forum not handled like official names. for example whats
PA Bear
pa like father? or 2 firstnames= peter-alex Bear?
anyway i have both tools on the pc and will run again.

sincerely thomas

[PA Bear [MS MVP]]

If the PC was clean, it'd be functioning properly...which would include
being able to use Windows Update and Automatic Updates.

Please post a link to the forum thread where your machine was declared
clean.

If you had IE7 and/or IE8 installed and then did a Repair Install without
having first uninstalled IE7 and/or IE8, you're ONLY choice now is a format
& clean install. See...

How to perform a repair installation of Windows XP if a later version of
Internet Explorer is installed:
http://support.microsoft.com/kb/917964

[tango13]

Hi it was a german language forum. hijackthis is well known here. the people
are professional.

http://www.hijackthis-forum.de/hijackthis-logfiles/41175-malware-tr-crypt-xpack-gen-2.html#post294564

the repair was done with an IE 6.0 . After this i updated to ie 7.x, because
i hoped it will better work with auto update together. ;-]

[tango13]

Hi shenan,
my feedback:

> > SuperAntiSpyware = 16 adware cookies
> > MalwareBytes = 1TRACE.Pandex finding

> > Download and run the MSRT manually:
> > http://www.microsoft.com/security/malwareremove/default.mspx

full scan = nothing found

> > Search your registry for %fystem and replace the "f" with an "s".

> > May be three or four matches. = YES, mostly on keys for BITS and wuauserv

i will progress in the way you described.

thanks thomas

[tango13]

Hi PA,
we worked with Hijackthis guy on cleaning the PC the whole week
and execute some software:
RSIT
combofix
malwarebytes
superantispyware
kaspersky online scan
etc....

all scans found nothing more in the log files.

sincerely thomas

[Scot]

This is exactly what fixed my problem.
Shenan Stanley's suggestion to search for %fystem and replace with %system
I found 4 of them and had to fix the registry permissions as well to change
them - even though I had already fixed the registry permissions the day
before at the HKLM, HKCU, etc root level with child inherited changes
selected.

"Shenan Stanley" wrote:

>
> Download, install, run, update and perform a full scan (separately) with the
> following two applications (freeware versions are the ones to use for this):
>
> SuperAntiSpyware
> http://www.superantispyware.com/
>
> MalwareBytes
> http://www.malwarebytes.com/
>
> After performing a full scan with one and then the other and removing
> whatever they both find completely, you may uninstall these products,
> if you wish.
>
> Download and run the MSRT manually:
> http://www.microsoft.com/security/malwareremove/default.mspx
>
> Reboot.
>
> Search your registry for %fystem and replace the "f" with an "s". May be
> three or four matches.
>
> Download/Install the latest Windows Installer (for your OS):
> ( Windows XP 32-bit : WindowsXP-KB942288-v3-x86.exe )
> http://www.microsoft.com/downloadS/details.aspx?familyid=5A58B56F-60B6-4412-95B9-54D056D6F9F4&displaylang=en
>
> and...
>
> Download the latest version of the Windows Update agent from here (x86):
> http://go.microsoft.com/fwlink/?LinkID=91237

> .... and save it to the root of your C:\ drive. After saving it to the root

> .... Really - come back and let everyone know if that worked.

[tango13]

Hi Shenan,
all worked fine for me. it tells me i have already the newest win installer,
but i executed anyway what you told me (Start button --> RUN and type in:
> > %SystemDrive%\windowsupdateagent30-x86.exe /WUFORCE
> > --> Click OK.)

all updates work fine (i missed 36 recommended ones)
system is now uptodate!
thanks very much to you both !
i appreciated your help.

sincerely thomas