10 replies to this topic

[lex200]

Hi and thanks in advance.

I have recently had a zero.access infection ive had help on another forum who was great.

But now im left with this issue of windows constantly tring to install malicious software removal tool. (november)

below is the thread of all work done by mods on the other site who reffered me to you.

http://forums.spybot...ead.php?t=64307

[Ztruker]

See this web site for some excellent tips and troubleshooting ideas: http://support.microsoft.com/kb/943144

Good information available here: http://winhlp.com/?q=node/36

Re-register the windows update components. This may help fix a corrupt installer

1. Click on Start and Run,
2. Type REGSVR32 WUAPI.DLL and press Enter.
3. Should get the message DllRegisterServer in WUAPI.DLL succeeded, Click OK.
4. Repeat for each of the following:

REGSVR32 WUAUENG1.DLL
REGSVR32 ATL.DLL
REGSVR32 WUPS2.DLL
REGSVR32 WUCLTUI.DLL
REGSVR32 WUPS.DLL
REGSVR32 WUWEB.DLL
REGSVR32 WUAUENG.DLL

5. Reboot

If not better, you can download the latest installer from MS and see if this helps: http://www.softwarep...ninstallnt.html

[lex200]

Hi Ztruker, Thanks for the reply i have tried the information you posted with no luck. Also tried to go to links provided to see if there is anything there but im not exactly the brightiest spark when it comes to computers. So as it stands im a little stuck any further help on this would be appreciated. symptoms are windows update malicious software tool downloads installs, with in a few minutes the update is there to install again, download history shows it has installed fine everytime. So far this is all i have noticed, if you need me to post any logs that is not a problem. thanks again

[Lee]

In the meantime until Ztrucker provides further advice, it might be a good idea to go to Control Panel and open "Windows update" to disabe auto-update. Disable auto-update by selecting "Check for updates but let me choose when to download and install them". This will temporarily stop windows update from trying to repeatedly install the Malicious Software removal tool.

Edited by Lee, 21 November 2011 - 08:55 AM.

[Ztruker]

Try the automated repair tool: Automatically diagnose and fix common problems with Windows Update

[lex200]

Try the automated repair tool: Automatically diagnose and fix common problems with Windows Update

I have tried that earlier this is the results of the log. Still not repairing it.



Windows UpdatePublisher details

Issues found
Windows Update components must be repairedWindows Update components must
be repaired
One or more Windows Update components are configured incorrectlyFixed
Repair Windows Update componentsSucceeded

Issues checked
Default Windows Update data locations have changedDefault Windows Update
data locations have changed
The location where Windows Update stores data has changed and must be
repairedChecked

Issues foundDetection details

6Windows Update components must be repairedFixed

One or more Windows Update components are configured incorrectly
Repair Windows Update componentsSucceeded

Repairing Windows Update components frequently resolves common
Windows Update errors


Issues checkedDetection details

6Default Windows Update data locations have changedChecked

The location where Windows Update stores data has changed and must be
repaired
Repair default Windows Update locationsNot Run

Change Windows Update locations to Windows default settings


Detection details

Collection information
Computer Name: SHEZ-DBZCKP2J
Windows Version:5.1
Architecture:x86
Time:11/21/2011 6:57:16 PM

Publisher details

Windows Update
Resolve problems that prevent you from updating Windows.
Package Version:4.0.2.20110411
Publisher:Microsoft Corporation

[Ztruker]

Okay, one more, this time it's manual steps, no automation. Looks like a lot but if you take it one step at a time it's not bad.

How do I reset Windows Update components?

Scroll down to the Resolution section called: Let me fix it myself
Click on Click here to view or hide detailed information

That expands the section that starts with "To reset the Windows Update components, follow these steps:"

In Step 6 where it says: "Reregister the BITS files and the Windows Update files. To do this, type the following commands at a command prompt. Press ENTER after you type each command."

Select all the regsvr32.exe entries with your mouse then paste them into a new Notepad window.
Save the file as ReRegisterBits.bat. Make sure you set Save as Type: to All Files (*.*) before saving to prevent Notepad from adding .txt to then end of the name.

Now when you get to that part, run the ReRegisterBits.bat file instead of doing each one individually. You can do it manually way if you want but a batch file is much easier and less prone to typos. ReRegisterBits.bat has to be in a directory defined in the PATH environment variable or you can save it in the %windir%\system32 directory. If you do, delete it when done or move it somewhere else if you want to save it. To see what directories are in the PATH environmental variable, enter path from a the Command Prompt window.

[lex200]

Ok where to begin this is a long and dull process ive tried this 3 times and no luck i will try and give as much info as possible as to were it fails.

Tried with and without step 4

step 1 to 3 no problems

1.Open a Windows Command Prompt. To open a command prompt, click Start and then click Run. Copy and paste (or type) the following command in the Open box and then press ENTER: cmd
2.Stop the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
◦net stop bits
◦net stop wuauserv
3.Delete the qmgr*.dat files. To do this, type the following command at a command prompt, and then press ENTER:
Del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"


step 4 cant get it to run, also tried to change folder name by going to folder no luck

4.If this is your first attempt at resolving your Windows Update issues by using the steps in this article, go to step 5 without carrying out the steps in step 4. The steps in step 4 should only be performed at this point in the troubleshooting if you cannot resolve your Windows Update issues after following all steps but step 4. The steps in step 4 are also performed by the "Aggressive" mode of the Fix it Solution above:
•Rename the following folders to *.BAK:
■%systemroot%\SoftwareDistribution\DataStore
■%systemroot%\SoftwareDistribution\Download
■%systemroot%\system32\catroot2
To do this, type the following commands at a command prompt. Press ENTER after you type each command.
■Ren %systemroot%\SoftwareDistribution\DataStore *.bak
■Ren %systemroot%\SoftwareDistribution\Download *.bak
■Ren %systemroot%\system32\catroot2 *.bak

however this part of 4 worked

•Reset the BITS service and the Windows Update service to the default security descriptor. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
■sc.exe sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
RC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
■sc.exe sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
RC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)


part 5 to 6 worked except for the files high lighted in red they failed to load (i think)


5.Type the following command at a command prompt, and then press ENTER:
cd /d %windir%\system326.Reregister the BITS files and the Windows Update files. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
◦regsvr32.exe atl.dll
◦regsvr32.exe urlmon.dll
◦regsvr32.exe mshtml.dll
◦regsvr32.exe shdocvw.dll
◦regsvr32.exe browseui.dll
◦regsvr32.exe jscript.dll
◦regsvr32.exe vbscript.dll
◦regsvr32.exe scrrun.dll
◦regsvr32.exe msxml.dll
◦regsvr32.exe msxml3.dll
◦regsvr32.exe msxml6.dll
◦regsvr32.exe actxprxy.dll
◦regsvr32.exe softpub.dll
◦regsvr32.exe wintrust.dll
◦regsvr32.exe dssenh.dll
◦regsvr32.exe rsaenh.dll
◦regsvr32.exe gpkcsp.dll
◦regsvr32.exe sccbase.dll
◦regsvr32.exe slbcsp.dll
◦regsvr32.exe cryptdlg.dll
◦regsvr32.exe oleaut32.dll
◦regsvr32.exe ole32.dll
◦regsvr32.exe shell32.dll
◦regsvr32.exe initpki.dll
◦regsvr32.exe wuapi.dll
◦regsvr32.exe wuaueng.dll
◦regsvr32.exe wuaueng1.dll
◦regsvr32.exe wucltui.dll
◦regsvr32.exe wups.dll
◦regsvr32.exe wups2.dll
◦regsvr32.exe wuweb.dll
◦regsvr32.exe qmgr.dll
◦regsvr32.exe qmgrprxy.dll
◦regsvr32.exe wucltux.dll
◦regsvr32.exe muweb.dll
◦regsvr32.exe wuwebv.dll


part 7 failed

7.Reset Winsock. To do this, type the following command at a command prompt, and then press ENTER:
netsh reset winsock

part 8 said somethig about direct access

8.If you are running Windows XP or Windows Server 2003, you have to set the proxy settings. To do this, type the following command at a command prompt, and then press ENTER:
proxycfg.exe -d

part 9 ran fine

9.Restart the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
◦net start bits
◦net start wuauserv

part 11 said allready installed

11.Install the latest Windows Update Agent. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
949104 (http://support.micro....com/kb/949104/ ) How to obtain the latest version of the Windows Update Agent to help manage updates on a computer

part 12 back to square 1

[Ztruker]

Not sure what' happening there. I have one last suggestion which is to upgrade to the latest update software from MS.

See here: How to obtain the latest version of the Windows Update Agent to help manage updates on a computer

[lex200]

Thanks for ur time and effort but i think I'm going to do a fresh install as I seem to be finding more and more issues with this. Thanks again.

[Ztruker]

Okay, good luck.