Windows security alert on XP

[Roxey]

Today I got a security alert telling me that firewall, automatic updates and
Virus protection was turned off. I have never seen this warning before.

I have managed to fix the firewall and virus protection by persuading Norton
that it had been activated (it seems to have forgot) but I cannot fix the
automatic updates.

I have used services.msc but automatic updates refuses to change from
disabled. I have followed the instructions to reinstall the automatic update
service but this fails because the right program cannot be found.

I have XP home edition with service pack 2 and all later security updates
installed.

Roxey

[TaurArian]

Considerations -

System may be infected with malware "Vundo"
http://www.microsoft.com/security/portal/Entry.aspx?name=Win32%2fVundo

Service does not start and displays "Error 1058"
http://support.microsoft.com/kb/241584

You cannot manually start the Automatic Updates service and you receive an "Error 1058"
error message on a computer that is running Windows XP or Windows XP Tablet PC Edition
2005
http://support.microsoft.com/kb/896224

"Could not start the Remote Procedure Call (RPC) Service. Error 1058" error message when
you manually start the Remote Procedure Call service
http://support.microsoft.com/kb/838428

--

TaurArian [MVP] 2005-2008 - Update Services
http://taurarian.mvps.org
======================================
How to ask a question: http://support.microsoft.com/kb/555375
Computer Maintenance: Acronis / Diskeeper / Paragon / Raxco

"Roxey" <Ro...@discussions.microsoft.com> wrote in message
news:A3EFC8E6-0B62-4039...@microsoft.com...

[PA Bear [MS MVP]]

Probably a Vundo-ZLOB-SDBot infection, all protected by a rootkit.

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

[Kwong]

I have the same problem as Roxey for the automatic updates. I still cannot
fix it.

[TaurArian]

Then read the responses to Roxey.

--

TaurArian [MVP] 2005-2008 - Update Services
http://taurarian.mvps.org
======================================
How to ask a question: http://support.microsoft.com/kb/555375
Computer Maintenance: Acronis / Diskeeper / Paragon / Raxco

"Kwong" <Kw...@discussions.microsoft.com> wrote in message
news:65A7D88D-0E21-43D9...@microsoft.com...

[RnG]

I have the same issues. I get this message when I try to force start the
automatic updates "Error 1058: The service cannot be started, either because
it is disabled or because it has no enabled devices associated with it. "

I did enable (after disabling and re-enabling)

I see there are a lot of Discussion in this Group on the subject, but no
solutions??

Please respond to my email at rngl...@comcast.net.
--
RnG

[Ash.oz]

Exactly i have the same issue. Windows defender and avg full cant fnd thos
cookies also. and more, i am unable to open those windows help sited given by
TaurArian. my previous restore checkpoints ae also all gone. rubbish sites
popping up automatically. what to do, really i am very disturbed.

[TaurArian]

There have been plenty postings regarding this issue. If you read them, the most common
cause is a virus - How could you miss all that ?

Start here: System may be infected with malware "Vundo"
http://www.microsoft.com/security/portal/Entry.aspx?name=Win32%2fVundo

other postings -

> Service does not start and displays "Error 1058"
> http://support.microsoft.com/kb/241584
>
> You cannot manually start the Automatic Updates service and you receive an "Error 1058"
> error message on a computer that is running Windows XP or Windows XP Tablet PC Edition
> 2005
> http://support.microsoft.com/kb/896224
>
> "Could not start the Remote Procedure Call (RPC) Service. Error 1058" error message when
> you manually start the Remote Procedure Call service
> http://support.microsoft.com/kb/838428
>

and postings from PA Bear MVP

Judging from similar posts here in the past month or so, the behavior may be
due to a Vundo-ZLOB-SDBot infection, all of which is protected by a rootkit.

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a thorough check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

==========================================

Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.

--
~Robear Dyer (PA Bear)

--

TaurArian [MVP] 2005-2009 - Update Services

http://taurarian.mvps.org
======================================
How to ask a question: http://support.microsoft.com/kb/555375
Computer Maintenance: Acronis / Diskeeper / Paragon / Raxco

"RnG" <rngl...@comcast.net.(donotspam)> wrote in message
news:38AE5B9F-9C23-4723...@microsoft.com...