URGENT: XPsp3 Windows Update Failure

[Papi]

I have a user that had the Vundo issue, all of which has been cleared up now
with Symantec End Point, however, we cannot get the Microsoft Update feature
to work at all.

This is on XPP sp3, and I have tried already reinstalling all the WU
components, as well as the BT service. However, the Automatic Updates Service
will turn itself back to disabled after you enable it and Start the service
from Services.msc

Needless to say, I am spinning wheels at this point.
I have run through all the KB's I can find, and tried all, but still no go.

Anyone have any ideas of hope?

[PA Bear [MS MVP]]

You probably have (much) more work to do.

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

2. Run this online scan (in safe mode w/networking, if need be):
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or other appropriate forums.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
=====================
Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

[Papi]

OK, MSRT will not run manually. I have updated it and tried.
Next, Spybot 1.6.2 w/latest Defs continues to pick up
TinyBar.C even though I went through the manual removal process three times.
It also picks up Smitfraud-C.and Virtumonde, and again, even after I ran
manually remove.

Yes, System Restore is off.

Next, I ran the OneCare tool, however Symantec Endpoint found all that and
repaired/quarant.

When Windows or Microsoft Update goes to Run, I get the same error page that
it couldn't start with all the things to check like BITS and so on, which has
been done over a dozen times now.

[Engel]

Hello Papi,

Because you had one piece of malware, the chances are also high that you had
others.

I recommend downloading and installing MalwareBytes' Antimalware (MBAM) and
SUPERAntiSpywaяe (SAS).

Do a full scan with MalwaяeBytes and SUPERAntiSpywaяe.

<http://www.superantispyware.com/>
-=-

<http://www.malwarebytes.org/mbam.php>
-=-
The programs are free. (There is a paid version but you don't need to buy it
to remove malware.)
-=-

Good luck
-=-

[Papi]

hi Engel-

Yes, I am running Malwarebyte right now.
It has found items so far, and I am waiting for it to finish.
My user is remote, so it is a little more painful to get through in a GTA
session, but I am getting there.

If you (or the Board) can think of anything else, please let me know.
I am anxious to get this user patched and updated.

[Shenan Stanley]

Papi wrote:
> Yes, I am running Malwarebyte right now.
> It has found items so far, and I am waiting for it to finish.
> My user is remote, so it is a little more painful to get through in
> a GTA session, but I am getting there.
>
> If you (or the Board) can think of anything else, please let me
> know.
> I am anxious to get this user patched and updated.

Standard spiel for a Windows XP machine that won't update properly (although
you probably won't be able to say the machine is clean without a wipe.)

Download, install, run, update and perform a full scan (separately) with the
following two applications (freeware versions are the ones to use for this):

SuperAntiSpyware
http://www.superantispyware.com/

MalwareBytes
http://www.malwarebytes.com/

After performing a full scan with one and then the other and removing
whatever they both find completely, you may uninstall these products,
if you wish.

Reboot.

Start button --> RUN and type in:
%SystemRoot%\system32\net stop wuauserv
--> Click OK.

Start button --> RUN and type in:
%SystemRoot%\system32\regsvr32 %SystemRoot%\system32\wups2.dll
--> Click OK.

Start button --> RUN and type in:
%SystemRoot%\system32\net start wuauserv
--> Click OK.

Download the latest version of the Windows Update agent from here (x86):
http://go.microsoft.com/fwlink/?LinkID=91237
... and save it to the root of your C:\ drive. After saving it to the root
of the C:\ drive, do the following:

Close all Internet Explorer windows and other applications.

Start button --> RUN and type in:
%SystemDrive%\windowsupdateagent30-x86.exe /WUFORCE
--> Click OK.

(If asked, select "Run.) --> Click on NEXT --> Select "I agree" and click on
NEXT --> When it finishes installing, click on "Finish"...

Reboot.

Download/Install the latest Windows Installer:
http://www.microsoft.com/downloadS/details.aspx?familyid=5A58B56F-60B6-4412-95B9-54D056D6F9F4&displaylang=en

Reboot.

Log on as a user with administrative rights and open Internet Explorer and
visit http://windowsupdate.microsoft.com/ and select to do a CUSTOM scan...
(Every time you are about to click on something while at these web pages -
first press and hold down the CTRL key while you click on it. You can
release the CTRL key after clicking each time.)

Once the scan is done, select just _ONE_ of the high priority updates
(deselect any others) and install it.

Reboot again.

If it did work - try the web page again - selecting no more than 3-5 at a
time.

The Optional Software updates are generally safe - although I recommend
against the "Windows Search" one. I would completely avoid the Optional
Hardware updates.

Come back - let us know if that worked.
... Really - come back and let everyone know if that worked.

If it seemed to have failed, do this:

Click Start, and then click Run.
In the Open box, type: %windir%\windowsupdate.log
and then click OK.

Scroll down towards the bottom for the latest entries to locate any error
code(s) or explanation as to why the page cannot be displayed.

You can copy/paste the last 50 or so lines here...

How to read the Windowsupdate.log file:
http://support.microsoft.com/kb/902093

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

[PA Bear [MS MVP]]

Move on to Step #3 or open a free support incident.