Spyware / Malware / Virus Removal

[Resolved] WINDOWS UPDATES WONT COMPLETE/VIRUS?

19 min read

Looking for the outcome? Ask AI

jbray4280

Post #16May 23, 2010, 2:42 PM UTC

Hi Conspire:

Here is the ComboFix log and the add/remove program listing. The file c:\windows\isRS-000.tmp is not shown in the "windows" directory anymore. I did go in and change the folder options as you stated and still does not show up. Thanks for your help again.

ComboFix 10-05-22.03 - THOMAS 05/23/2010 7:00.10.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3002.1737 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\THOMAS\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\programdata\ezsidmv.dat"
"c:\users\THOMAS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\758b1bff-3289745f"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\ezsidmv.dat
c:\users\THOMAS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\758b1bff-3289745f
c:\users\THOMAS\AppData\Roaming\Microsoft\HTML Help\hh.dat

.
((((((((((((((((((((((((( Files Created from 2010-04-23 to 2010-05-23 )))))))))))))))))))))))))))))))
.

2010-05-23 14:05 . 2010-05-23 14:08 ——– d—–w- c:\users\THOMAS\AppData\Local\temp
2010-05-23 14:05 . 2010-05-23 14:05 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-05-23 14:05 . 2010-05-23 14:05 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-05-23 13:56 . 2010-05-23 13:57 ——– d—–w- C:\32788R22FWJFW
2010-05-16 18:58 . 2004-08-10 07:42 77824 ——w- c:\windows\system32\brlmw03a.dll
2010-05-16 18:58 . 2010-05-16 18:58 ——– d—–w- c:\program files\Brownie
2010-05-16 18:55 . 2007-08-19 16:34 94208 —-a-w- c:\windows\system32\BRRBTOOL.EXE
2010-05-16 18:55 . 2004-09-23 15:00 24223 —-a-w- c:\windows\system32\BRLM03A.DLL
2010-05-16 18:55 . 2010-05-16 18:58 ——– d—–w- c:\program files\Brother
2010-05-16 18:55 . 2007-04-24 08:30 192512 ——w- c:\windows\system32\Pdrvinst.dll
2010-05-16 06:49 . 2010-05-16 06:49 ——– d—–w- c:\program files\QuickTime
2010-05-16 06:49 . 2010-05-16 06:49 ——– d—–w- c:\programdata\Apple Computer
2010-05-16 06:47 . 2010-05-16 06:47 ——– d—–w- c:\program files\Common Files\Apple
2010-05-16 06:47 . 2010-05-16 06:47 ——– d—–w- c:\users\THOMAS\AppData\Local\Apple
2010-05-16 06:47 . 2010-05-16 06:47 ——– d—–w- c:\program files\Apple Software Update
2010-05-16 06:47 . 2010-05-16 06:47 ——– d—–w- c:\programdata\Apple
2010-05-06 03:02 . 2010-05-06 03:02 ——– d—–w- c:\programdata\SupportSoft
2010-05-06 03:02 . 2010-05-06 03:02 ——– d—–w- c:\program files\Comcast
2010-05-06 03:00 . 2010-05-06 12:26 ——– d—–w- c:\users\THOMAS\AppData\Local\SupportSoft
2010-05-06 02:59 . 2010-05-06 02:59 ——– d—–w- c:\program files\ComcastUI
2010-04-29 03:40 . 2010-04-29 03:40 ——– d—–w- c:\programdata\HP
2010-04-29 02:50 . 2010-04-29 02:50 ——– d—–w- c:\programdata\WindowsSearch

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-23 06:27 . 2010-01-25 01:46 ——– d—–w- c:\users\THOMAS\AppData\Roaming\Skype
2010-05-23 05:38 . 2010-03-22 05:56 0 —-a-w- c:\users\THOMAS\AppData\Local\prvlcl.dat
2010-05-23 02:50 . 2009-07-02 03:32 3207 —-a-w- c:\programdata\Intuit\QuickBooks 2009\qbbackup.sys
2010-05-23 02:41 . 2010-01-25 01:49 ——– d—–w- c:\users\THOMAS\AppData\Roaming\skypePM
2010-05-22 15:26 . 2009-12-19 15:46 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-20 03:21 . 2009-04-22 14:01 ——– d—–w- c:\programdata\Norton
2010-05-16 18:55 . 2009-04-22 13:59 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-05-15 04:02 . 2009-08-08 03:21 ——– d—–w- c:\program files\Google
2010-05-12 18:21 . 2009-10-03 14:35 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-05-12 10:02 . 2009-04-22 14:57 ——– d—–w- c:\programdata\Microsoft Help
2010-05-12 10:00 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-05-06 03:02 . 2009-07-02 03:27 ——– d—–w- c:\program files\Common Files\supportsoft
2010-04-29 22:39 . 2009-12-19 15:46 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 22:39 . 2009-12-19 15:46 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-21 05:17 . 2009-06-29 03:50 242896 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-04-06 13:33 . 2009-07-02 03:41 211720 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\IntuitSyncManagerPatch.exe
2010-04-06 13:33 . 2009-07-02 03:41 1352968 —-a-w- c:\programdata\Intuit\QuickBooks 2009\Components\SyncMgr\OCD\IntuitSyncManager.exe
2010-04-05 19:01 . 2009-04-22 15:02 ——– d—–w- c:\program files\Common Files\Adobe
2010-04-02 14:03 . 2009-04-22 15:14 ——– d—–w- c:\program files\Common Files\Java
2010-04-02 14:03 . 2009-04-22 15:14 ——– d—–w- c:\program files\Java
2010-03-12 16:16 . 2010-03-12 16:16 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-03-12 16:16 . 2009-06-29 03:50 29512 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-03-12 16:15 . 2009-06-29 03:50 216200 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-03-09 11:28 . 2009-10-10 15:39 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-02-27 01:13 . 2010-03-14 22:44 17160 —-a-w- c:\windows\Help\OEM\scripts\HPHCDisableObject.exe
2010-02-22 21:28 . 2010-03-07 23:07 1282824 —-a-w- c:\windows\Help\OEM\scripts\SamsungHDDFW1HC.exe
2009-04-22 14:18 . 2009-04-22 14:09 8192 –sha-w- c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

— c:\users\THOMAS\AppData\Local\Temp\jkos-THOMAS\binaries\ScanningProcess.exe —
Company: Kaspersky Lab.
File Description: ScanningProcess
File Version: 5, 0, 1, 86
Product Name: Kaspersky Lab. ScanningProcess
Copyright: Copyright © 2008
Original Filename: ScanningProcess.exe
File size: 139264
Created time: 2010-05-22 15:33
Modified time: 2010-05-22 15:36
MD5: 4AC6CFDCECC72D49C964B9C6041E246D
SHA1: C6AC2A0242B50FA9A1B8405748C9E3939AB5ED83

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-01-28 2387968]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2008-09-30 972080]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
"MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe" [2001-07-25 184376]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-27 3883856]
"Desktop Software"="c:\program files\Common Files\SupportSoft\bin\bcont.exe" [2009-04-24 1025320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-10 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-10 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-10 145944]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-10-07 210216]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2009-12-22 1092872]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2009-03-11 468264]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"WorksFUD"="c:\program files\Microsoft Works\wkfud.exe" [2001-10-06 24576]
"Microsoft Works Portfolio"="c:\program files\Microsoft Works\WksSb.exe" [2007-06-21 1099104]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 28738]
"MoneyStartUp10.0"="c:\program files\Microsoft Money\System\Activation.exe" [2001-07-25 241714]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"BrStsWnd"="c:\program files\Brownie\BrstsWnd.exe" [2007-08-01 815104]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Works Calendar Reminders.lnk - c:\program files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-8-7 24633]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2010-2-2 984352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(

:ac,a8,59,9e,3f,18,ca,01

R2 gupdate1ca17d77c1ff8b0;Google Update Service (gupdate1ca17d77c1ff8b0);c:\program files\Google\Update\GoogleUpdate.exe [2009-08-08 133104]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2010-03-12 216200]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2010-04-21 242896]
S2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [2010-03-12 916760]
S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-03-12 308064]
S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-10-06 365952]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-06-29 112128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-01-28 05:28 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-05-23 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-08-08 03:21]

2010-05-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-08 03:22]

2010-05-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-08 03:22]

2010-04-27 c:\windows\Tasks\HPCeeScheduleForTHOMAS.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2009-04-22 18:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=91&bd;=Pavilion&pf;=cnnb
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll
FF - ProfilePath - c:\users\THOMAS\AppData\Roaming\Mozilla\Firefox\Profiles\sdzeh1nz.default\
FF - prefs.js: browser.startup.homepage - WWW.YAHOO.COM
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-23 07:07
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
———————— Other Running Processes ————————
.
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files\Google\Update\1.2.183.23\GoogleCrashHandler.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Comcast\Desktop Doctor\bin\sprtsvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
.
**************************************************************************
.
Completion time: 2010-05-23 07:15:59 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-23 14:15
ComboFix2.txt 2010-05-22 05:51
ComboFix3.txt 2010-05-21 05:33

Pre-Run: 224,188,891,136 bytes free
Post-Run: 224,068,325,376 bytes free

- - End Of File - - 8A5C89BFA6D5A9FED0265C2D4BD3BDD4

Acrobat.com
Activation Assistant for the 2007 Microsoft Office suites
ActiveCheck component for HP Active Support Library
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.2
Adobe Shockwave Player
AnswerWorks 4.0 Runtime - English
AnswerWorks 5.0 English Runtime
Apple Application Support
Apple Software Update
Atheros Driver Installation Program
AVG Free 9.0
Brother HL-2140
Comcast Desktop Software (v1.2.0.9)
Compatibility Pack for the 2007 Office system
Conexant HD Audio
CyberLink DVD Suite
CyberLink YouCam
Desktop Doctor
ERUNT 1.1j
ESET Online Scanner v3
ESU for Microsoft Vista
Google Chrome
Google Earth
Google Update Helper
Google Updater
HDAUDIO Soft Data Fax Modem with SmartCP
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Customer Experience Enhancements
HP Doc Viewer
HP DVD Play 3.7
HP Help and Support
HP Quick Launch Buttons 6.40 H2
HP Total Care Advisor
HP Total Care Setup
HP Update
HP User Guides 0118
HP Wireless Assistant
HPAsset component for HP Active Support Library
HPNetworkAssistant
Intel® Graphics Media Accelerator Driver
Java Auto Updater
Java™ 6 Update 19
Java™ 6 Update 7
Junk Mail filter update
Juno Preloader
LabelPrint
LightScribe System Software
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Live Search Toolbar
Microsoft Money 2002
Microsoft Money 2002 System Pack
Microsoft Office 2007 Primary Interop Assemblies
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Live Add-in 1.4
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual Studio 2005 Tools for Office Runtime
Microsoft Works
Microsoft Works 2002 Setup Launcher
Microsoft Works 6.0
Mozilla Firefox (3.6.3)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
muvee Reveal
My HP Games
NetWaiting
NetZero Preloader
OGA Notifier 2.0.0048.0
Power2Go
PowerDirector
QuickBooks
QuickBooks Pro 2009
QuickTime
Realtek 8169 8168 8101E 8102E Ethernet Driver
Realtek USB 2.0 Card Reader
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for 2007 Microsoft Office System (KB978380)
Security Update for Microsoft Office Excel 2007 (KB978382)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Skype web features
Skype™ 4.1
Spelling Dictionaries Support For Adobe Reader 9
SPORE Creature Creator Trial Edition
SupportSoft Assisted Service
Synaptics Pointing Device Driver
TurboTax 2008
TurboTax 2008 wcaiper
TurboTax 2008 WinPerFedFormset
TurboTax 2008 WinPerProgramHelp
TurboTax 2008 WinPerReleaseEngine
TurboTax 2008 WinPerTaxSupport
TurboTax 2008 WinPerUserEducation
TurboTax 2008 wrapper
TurboTax 2009
TurboTax 2009 wcaiper
TurboTax 2009 WinPerFedFormset
TurboTax 2009 WinPerReleaseEngine
TurboTax 2009 WinPerTaxSupport
TurboTax 2009 woriper
TurboTax 2009 wrapper
TurboTax Premier 2007
Update for 2007 Microsoft Office System (KB967642)
Update for 2007 Microsoft Office System (KB981715)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office InfoPath 2007 (KB976416)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 (KB974561)
Update for Microsoft Office Word 2007 Help (KB963665)
Visual Studio 2005 Tools for Office Second Edition Runtime
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
Works Suite OS Pack
Works Synchronization
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Software Update

Conspire

Post #17May 24, 2010, 5:09 AM UTC

Are you able to perform the update now?

jbray4280

Post #18May 24, 2010, 5:33 AM UTC

Conspire: I checked the windows update log and as of today the updates are all successful, so that seems to be working again, thank you. I am worried about a Java update keeps popping up for me to install and i noticed that some of my problems may have been with a Java file. Should i let this update? Thank you for your help in advance.

Conspire

Post #19May 24, 2010, 12:50 PM UTC

Hi,

Conspire:

I checked the windows update log and as of today the updates are all successful, so that seems to be working again, thank you. I am worried about a Java update keeps popping up for me to install and i noticed that some of my problems may have been with a Java file. Should i let this update?

Thank you for your help in advance.

Your Java is now clean and you need to update it as soon as possible for fixing vulnerabilities that it has on the version you are using now.

With that being said, your log appears to be clean.

Your java is out of date. Click your start button, open Control panel.

Locate the Java icon (it looks like a coffee cup)
double click it to open it
click the Update tab
Click update now

After the java is updated, reboot your computer if not prompted to.

Next, clear the java cache

To clear the Java Plug-in cache:

Click Start > Control Panel.
Double-click the Java icon in the control panel.
On the General tab, Click Settings under Temporary Internet Files.
On the Temporary Files Settings screen, Click Delete Files.
check all boxes
Click OK

===================================================

Follow these steps to uninstall Combofix

Click START then RUN
Now copy/paste the code into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

Combofix /Uninstall

[external image: Posted Image]

===================================================

Now to remove most of the tools that we have used in fixing your machine:

Make sure you have an Internet Connection.
Download OTC to your desktop and run it
A list of tool components used in the cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
Click Yes to begin the cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.

===================================================

Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

1. Create a new Restore Point

Click on the Start button to open your Start Menu.
Click on the Control Panel menu option.
Click on the System and Maintenance menu option.
Click on the System menu option.
Click on System Protection in the left-hand task list.
Create the manual restore point you should click on the Create button. When you press this button a prompt will appear asking you to provide a title for this manual restore point.
Type in a title for the manual restore point and press the Create button.
Close the System window after you have been advised that the procedure has been successfully completed.

.
2. Clear your existing system restore points except for the new clean restore point you just created:

Go to Start > Run and type in cleanmgr
Select the More options tab
Next to System Restore click Clean up
This will remove all restore points except the new one you just created.

Here are some tips to reduce the potential for spyware infection in the future:

Make your Internet Explorer More Secure
- From within Internet Explorer click on the Tools menu and then click on Options.
- Click once on the Security tab.
- Click once on the Internet icon so it becomes highlighted.
- Click once on the Custom Level button.
  - Change the Download signed ActiveX controls to Prompt.
  - Change the Download unsigned ActiveX controls to Disable.
  - Change the Initialise and script ActiveX controls not marked as safe to Disable.
  - Change the Installation of desktop items to Prompt.
  - Change the Launching programs and files in an IFRAME to Prompt.
  - Change the Navigate sub-frames across different domains to Prompt.
  - When all these settings have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

See this link for a listing of some online & their stand-alone antivirus programs:

Virus, Spyware, and Malware Protection and Removal Resources
Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Malwarebytes' Anti-Malware - This is another good tool to be used on a regular basis to minimize the risk of getting infected badly, and always be sure to remember to update the file definitions prior to scanning.
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware
Consider a custom hosts file such as MVPS HOSTS - This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Please also read Tony Klein's excellent article:
How I got
Infected in the First Place

Follow this list and your potential for being infected again will reduce dramatically.

Hopefully this should take care of your problems! Good luck.

Do you have any questions or problems to ask? Please do not hesitate to do so.

**Please respond this one more time to ensure it is resolved.

jbray4280

Post #20May 26, 2010, 2:48 AM UTC

Hi Conspire: It's back again…. Just tried to do 18 updates when i logged on and all are failing again…and the same thing as before…says it is configuring but cannot finish. And it always say "3" updates and 0% done even if there were actually more like today. And i tried it twice…same thing. Any help again is appreciated..

Conspire

Post #21May 27, 2010, 3:27 AM UTC last edited May 27, 2010, 12:12 PM UTC

Go to this site : http://support.microsoft.com/kb/949358

Tell me if that solves the problem.

jbray4280

Post #22May 28, 2010, 1:52 PM UTC

Hi Conspire: Yes, this is exactly my problem. I cannot use method 1 as i dont have disks, none provided with my laptop. And method 2 did not work, my restore points are only since this problem began. Any ideas??? thanks for your help

Conspire

Post #23May 28, 2010, 2:58 PM UTC

Do you happen to have any friend of yours has Vista Home Premium installation disk that you can borrow? Alternatively, you could call up Microsoft to send you the installation disk for a nominal fee as long as you have the license key.

jbray4280

Post #24May 29, 2010, 7:17 PM UTC

Hi Conspire: I will contact them on Tuesday…Closed on weekends and Monday is a holiday here in the USA. I will let you know what they say. Thanks

Conspire

Post #25May 30, 2010, 3:09 AM UTC

Thanks

jbray4280

Post #26June 7, 2010, 5:01 AM UTC

Hi Conspire: Just wanted to let you know i found i had a copy of Vista on a "recovery drive" on my laptop, so i had to back everything up to a external hard drive and reinstalled Vista. Updates ran fine after that, of course it took about 3 hours to get Windows updates current and the rest of the day reinstalling other software, so no fun, wish there had been an easier way. But thank you for all of your help again.

Conspire

Post #27June 7, 2010, 5:23 AM UTC

No problem

CatByte

Post #28June 7, 2010, 7:56 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] WINDOWS UPDATES WONT COMPLETE/VIRUS?

✨ Ask AI

Ask AI