Weird behavior

Let's try re-installing the Update agent.

Click here to download the file from Microsoft: http://download.windowsupdate.com/WindowsU…Agent30-x86.exe
Once downloaded… double click on it to run.

Then let me know how it goes.

I downloaded it and ran it as instructed. It ended with the message "Install is not needed since Windows Update Agent is already installed." I tried running windows update again with the same results. "Validation not complete. ActiveX Error"

try this:

Download the diagnostic tool MGADiag and save it to your desktop.

• Double-click on MGADiag.exe.
• Click Run.
• Click Continue, then Copy.
• Paste the report in your next reply.

Here is my MGADiag report… Diagnostic Report (1.9.0027.0): —————————————– Windows Validation Data–> Validation Status: Genuine Validation Code: 0 Cached Validation Code: N/A Windows Product Key: *****-*****-RVF66-GP7VM-8CFT3 Windows Product Key Hash: tJB30tZY737ZFJYewUg2SpzsCb0= Windows Product ID: 76487-OEM-2211906-00825 Windows Product ID Type: 2 Windows License Type: OEM SLP Windows OS version: 5.1.2600.2.00010100.3.0.med ID: {7AD58066-FB97-431A-BEAB-5CFAA94DEECA}(3) Is Admin: Yes TestCab: 0x0 LegitcheckControl ActiveX: Registered, 1.9.42.0 Signed By: Microsoft Product Name: N/A Architecture: N/A Build lab: N/A TTS Error: N/A Validation Diagnostic: FCEE394C-458-80041014_025D1FF3-344-80041014_025D1FF3-229-80041014_025D1FF3-230-1_025D1FF3-238-2 Resolution Status: N/A Vista WgaER Data–> ThreatID(s): N/A Version: N/A Windows XP Notifications Data–> Cached Result: 0 File Exists: Yes Version: 1.9.40.0 WgaTray.exe Signed By: Microsoft WgaLogon.dll Signed By: Microsoft OGA Notifications Data–> Cached Result: N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 OGAExec.exe Signed By: N/A, hr = 0x80070002 OGAAddin.dll Signed By: N/A, hr = 0x80070002 OGA Data–> Office Status: 109 N/A OGA Version: Registered, 2.0.48.0 Signed By: Microsoft Office Diagnostics: FCEE394C-458-80041014_025D1FF3-344-80041014_025D1FF3-229-80041014_025D1FF3-230-1_025D1FF3-238-2 Browser Data–> Proxy settings: N/A User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32) Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe Download signed ActiveX controls: Prompt Download unsigned ActiveX controls: Disabled Run ActiveX controls and plug-ins: Allowed Initialize and script ActiveX controls not marked as safe: Disabled Allow scripting of Internet Explorer Webbrowser control: Disabled Active scripting: Allowed Script ActiveX controls marked as safe for scripting: Allowed File Scan Data–> Other data–> Office Details: {7AD58066-FB97-431A-BEAB-5CFAA94DEECA}1.9.0027.05.1.2600.2.00010100.3.0.medx32*****-*****-*****-*****-8CFT376487-OEM-2211906-008252S-1-5-21-514355335-4051444915-1532494702Dell System,Dell Computer,Dell System,Dell SystemE21732A70184606D04090409Central Standard Time(GMT-06:00)02Dell XPS DXPO51109 Licensing Data–> N/A Windows Activation Technologies–> N/A HWID Data–> N/A OEM Activation 1.0 Data–> BIOS string matches: yes Marker string from BIOS: 1ABDD:Dell Inc|1ABDD:Microsoft Corporation Marker string from OEMBIOS.DAT: Dell System,Dell Computer,Dell System,Dell System OEM Activation 2.0 Data–> N/A

Hmmm… well it says it's been validated. Let's try Microsoft's Fix IT solution.

Please go here: http://support.microsoft.com/kb/971058 and click on the Fix IT button. Then just follow the directions.

Let me know how it goes.

I ran the Fix IT solution in default mode. It still did not fix the problem. Every time I go to Microsoft Update it tells me I need to validate my copy of Windows. When I tell it to validate, the info bar never shows allowing for the install of the ActiveX control. When I try the alternative method I get the "Validation Not Completed: ActiveX Error" message. Should I re-eun it in agressive mode?

Yes please.

Well, that had no effect. I still have the same problem.

Tymont,

I'm out of ideas… and I was going to suggest that you post over in the Windows forum and give the Tech Team a crack at it… However, I just saw that you've already been over there.

I suggest that you follow Ztruker's advise and open a support ticket. I have a lot of faith in the "Zman" and if he (and the others who resoponded) don't see the solution… there isn't much chance that I'm going to stumble on the right fix.

Meanwhile, we have a little housekeeping to do:

• Click START then RUN
• Now type Combofix /Uninstall in the runbox and click OK
• Note the space between the X and the U, it needs to be there.

The above procedure will:

• Implement some cleanup procedures.
• Reset System Restore.

Now to remove most of the tools that we have used in fixing your machine:

• Make sure you have an Internet Connection.
• Download OTC to your desktop and run it
• A list of tool components used in the cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
• Click Yes to begin the cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.

Please re-enable any security that was disabled.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Re-opened at the request of the original poster.

Tymont,

It is possible that the infection you are trying to remove will not allow you to download files on the infected computer. If this is the case, then you will need to download the files
on another computer and then transfer them to the infected computer. You can transfer the files via a CD/DVD, external drive, or USB flash drive.

Download and run Rkill

Do not reboot your computer after running rkill as the malware programs will start again.

Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)
There are 5 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click and choose Run as Admin
You only need to get one of them to run, not all of them.

• rkill.exe
• rkill.com
• rkill.scr
• WiNlOgOn.exe
• uSeRiNiT.exe

Do not reboot your computer after running rkill as the malware programs will start again.


Download Malwarebytes-Anti-Malware

Click here

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware. and Launch Malwarebytes' Anti-Malware, then click Finish..
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Please include mbam.txt in your reply and describe how your computer is behaving now.

Well, I was finally able to get MBAM to run. I was unable to update the signature file but ran a full scan anyway. It reported 3 infections. I told it to remove them and rebooted. I was then able to update MBAM to the latest signature file. It is currently running another complete scan. Than you for your pateince with me on this computer.

Please post the logs.

After running MBAM twice the computer seems to be ok. I'll add the logs for you to look at. Here's the first log… Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6288 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 4/10/2011 5:59:38 PM mbam-log-2011-04-10 (17-59-38).txt Scan type: Full scan (C:\|D:\|E:\|H:\|I:\|J:\|K:\|W:\|X:\|) Objects scanned: 287946 Time elapsed: 1 hour(s), 52 minute(s), 53 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 3 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) And then the second one after the update… Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6328 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 4/10/2011 8:06:29 PM mbam-log-2011-04-10 (20-06-29).txt Scan type: Full scan (C:\|) Objects scanned: 270890 Time elapsed: 1 hour(s), 52 minute(s), 1 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\documents and settings\jill hadley\application data\Sun\Java\deployment\cache\6.0\32\4da51da0-268ca445 (Trojan.Agent) -> Quarantined and deleted successfully. c:\documents and settings\jill hadley\local settings\application data\pjg.exe (Trojan.Agent) -> Quarantined and deleted successfully.