B
bryan
I ran/posted to aumha with their special programs. They found no problems.
PA Bear said:HijackThis doesn't "scan" or "fix" anything.
Repost:--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/
Sorry for the delay in my follow-up. In addition to the Kaspersky scans, I
scanned with Bit Defender's on-line scanner, Ad-Aware and HijackThis. All
scans were clean. If you can think of any more ideas it would be greatly
appreciated. Thank you again for your assistance.
bryan said:I did a full scan and a rootkit scan with Kaspersky, both of which found
no
problems. I will take your advice and do other research including
hijackthis and some on-line scanners (I understand Panda has a good
on-line scanner) along with the suggestions in your links. I will post
back with the results hopefully within the next day or so depending on
whether I need to get Kaspersky tech support involved.
Thank you very much for your diligent help and timely responses. Your
expertise is always greatly appreciated.
Regards,
B
:
Deleting the SoftwareDistribution folder could not /possibly/ have
caused
any problems with KIS, Bryan.
Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315
Run a /thorough/ check for hijackware, including posting your hijackthis
log to an appropriate forum.
Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware
When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use
(in conjuction with some other utilities). HijackThis will NOT fix
anything on its own, but it will help you to both identify and remove
any
hijackware/spyware with assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for
review
by an expert in such matters, not here.**
If the procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair
shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/
bryan wrote:
This seems to have killed my AV. Here is what happened: after deleting
the
folder and restarting Auto Update service, the icon disappeared. I
decided to reboot my pc to make sure the notification icon would not
reappear. When
I rebooted, Kaspersky Internet Security (AV, firewall etc) was dead
saying the databases were corrupt. I could not restart Kaspersky so I
tried to restore the folder from my recycle bin which also failed. I
quickly went to
a restore point which I thankfully created yesterday and everything
(including the notification icon) came up. Any idea what happened?
:
Just follow the directions, Bryan.
I'm asking you to delete C:\Windows\SoftwareDistribution <=this
folder,
only, and not just its contents.
bryan wrote:
Sorry PA Bear: in addition to my question above, should I delete the
entire
folder or just delete the contents of the folder leaving it blank.
There is a softwaredistribution folder in c:\windows and also in
c:\windows\system32. Just want to be sure which one I should delete.
Maybe
I should copy it to a dvd first?
:
1. Stop the Automatic Updates service:
Start > Run > (type in) services.msc > [OK]
Double-click Automatic Updates > Click on Stop
(Stopping the service will take a moment)
NEW! => 2. Delete %windir%\SoftwareDistribution <=this folder
(typically
C:\Windows\SoftwareDistribution).
3. Start the Automatic Updates service:
Start > Run > (type in) services.msc > [OK]
Double-click Automatic Updates > Click on Start
(Starting the service will take a moment)
NB: Deleting the Software Distribution folder will also delete your
Update
History at Windows Update website (which is not a big deal).
bryan wrote:
It is set to notify only, do not download.
Is your Automatic Updates setting (still) "Download but Notify"
or
"Notify
Only"?
bryan wrote:
I followed your instructions and sp3 is still being offered. As
soon
as
I
re-enabled auto update (step 3), the icon popped up again in
systra.
I will take your advice and download the root certificates
update.
Thanks for hanging in with me.
:
WinXP SP3 was released to Windows Update the first week of May.
For
a
very
brief period, SP3 was then being offered to users who had
Automatic
Update
(AU) configured to 'Download But Notify' or 'Notify Only'
setting. After
its release to AU on 10 July, it's being offered to all WinXP
SP2
users who
have AU enabled.
Try this:
1. Stop the Automatic Updates service:
Start > Run > (type in) services.msc > [OK]
Double-click Automatic Updates > Click on Stop
(Stopping the service will take a moment)
2. Delete the contents of the Download folder:
Start > Run > (type in) %windir%\SoftwareDistribution > [OK]
Open the Download folder and delete its contents
Close the window.
3. Start the Automatic Updates service:
Start > Run > (type in) services.msc > [OK]
Double-click Automatic Updates > Click on Start
(Starting the service will take a moment)
4. Go to http://windowsupdate.microsoft.com | Select CUSTOM and
scan
for
updates | Tell me if SP3 is offered?
Tip: After doing the CUSTOM scan at Windows Update, see if the
OPTIONAL UPDATE category offers a Root Certificates Update. If
so,
install it to
take full advantage of IE7's enhanced security.
Tip: Configure KAV *not* to monitor or scan
%windir%\SoftwareDistribution
<=this folder (typically, C:\Windows\SoftwareDistribution).
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since
2002 AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/
bryan wrote:
I forgot to mention that I tried disabling auto update and
rebooting
but
the
problem persists. Thanks anyway.
Thank you again for your assistance. The update history shows
that
all
critical updates were downloaded successfully for July. In
fact, I
cannot
remember having a problem with any microsoft update (I
download
them
myself
each month and check to be sure that they download
successfully).
Your
comment regarding SP3 being released to the Microsoft update
site
July
10
surprised me. I started seeing the option to download SP3
back
in
May.
My
problem with the notification icon began last week so I am
under the
assumption that this problem is not caused by the
availability
of
SP3.
I
prefer to wait with SP3 until the bugs are worked out.
:
Check your WindowsUpdate.log or your Update History at
Windows
Update
website and tell us if all of the Jul-08 updates actually
installed.
Also be aware that WinXP SP3 was released to Automatic
Updates
on
10 Jul-08. While you can opt not to download/install it, you
cannot
"hide"
it.
bryan wrote:
Thanks for your reply. I am not using Windows Defender
(never
have).
MS
Auto
Updates is set to notify me of updates only. I do not want
the updates
downloaded at any time. I prefer to review them first and
then download
them
myself. I have always done it in this manner and never had
a
problem.
Even though there are no critical updates, the yellow icon
in
systrary
STILL will not go away.
:
Is Windows Defender installed?
Is Automatic Updates enabled?
Tip: Temporarily disable real-time protection by your
anti-virus
and/or
anti-spyware applications (e.g., CounterSpy, Spysweeper,
Spybot