update failure

[Donald Eagle]

I posted the message below from Motzarella yesterday. Apparently it did not
appear, so I am trying again from a different server. I hope this works and
I haven't double posted.

I run XP Home, SP3, with Avast anti-virus, Zone Alarm free, Windows Defender
, MalwareBytes, Spyware Blaster and other anti-malware software. A few days
ago, I noticed that I was being notified about Windows updates, but they did
not seem to be downloading and installing. I cannot download updates either
automatically or manually from the Windows Update website. The error code I
get is 0x80246008 . A Google search leads me to a MS document that tells me
that I need to run services.msc and verify that BITS is correctly
configured. When I try to do that, I cannot start BITS. I get error 126,
module cannot be found. MS does not give me any correcting procedure for
that errror. Can anyone here help? Everything worked fine up until Tuesday
of this week.

 

[PA Bear [MS MVP]]

There is a very good chance that you are seeing the effects of a hijackware
infection (i.e., infections that cannot be detected by your AV app, MBAM,
and/or anti-spware applications, which, in fact, may be totally disabled due
to the infections)!

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
(only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

=====================
Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.

 

[Jose]

I posted the message below from Motzarella yesterday.  Apparently it did not
appear, so I am trying again from a different server.  I hope this works and
I haven't double posted.

I run XP Home, SP3, with Avast anti-virus, Zone Alarm free, Windows Defender
, MalwareBytes, Spyware Blaster and other anti-malware software.  A fewdays
ago, I noticed that I was being notified about Windows updates, but they did
not seem to be downloading and installing.  I cannot download updates either
automatically or manually from the Windows Update website.  The error code I
get is 0x80246008 .  A Google search leads me to a MS document that tells me
that I need to run services.msc and verify that BITS is correctly
configured.  When I try to do that, I cannot start BITS.  I get error126,
module cannot be found.  MS does not give me any correcting procedure for
that errror.  Can anyone here help?  Everything worked fine up until Tuesday
of this week.

BITS - again.

There is probably something in the Event Log about this problem with
more clues.

When you are finished doing all your malware scanning, and if you
still have a problem, search the registry for:

fystem

This of course should be:

system

Some of those malwares (or some people think updates) like to pick on
this registry value when it is part of a %...system...% construct,
usually in the BITS service section.

Rather than post all the keys, just search and replace since it is
obviously wrong.

If you find some and this works, please let us know some details.

 

[TaurArian]

You may receive an error message that contains the "0x8DDD0018" code or the
"0x80246008" code when you try to download updates from the Microsoft Windows
Update Web site or from the Microsoft Update Web site
http://support.microsoft.com/kb/910337

You receive an error message when you try to download updates from the
Windows Update Web site or from the Microsoft Update Web site, or when you
try to start the Background Intelligent Transfer Service
http://support.microsoft.com/kb/916251/en-us?spid=6527

You receive a "The necessary services are disabled or unavailable" error
message when you connect to the Microsoft Windows Update Web site or to the
Microsoft Update Web site
http://support.microsoft.com/kb/883822

 

[Donald Eagle]

Thank you, Robear, for the prompt reply. My AV is up to date, and still
updates itself automatically. My machine was fully patched at Windows
Update until this problem occurred. The only update I refused was IE8.

I'm sorry about the delay in replying, but running MSRT and Onecare
protection was a struggle. Each took 3 to 4 hours to run, and both failed 3
times with BSODs. The error messages varied. from IRQ_NOT_LESS_THAN to
PFN_LIST_CORRUPTED to one PAGE fault. I finally got both to run through
over successive nights from Safe Mode with Networking, but my DSL modem
turned off after the software started. MSRT found no problems. In one of
the failed protection scans, Onecare told me drive C: was clear, but Drive
D: had 3 infected items and one other problem whose message I have
forgotten. When Onecare did finish last night, it said it had fixed some
problems, but did not say what they were.

I still can't download updates from MS Updates because the BITS module
cannot be found. I can download anti-spyware updates other than Windows
Defender, and Avast AV still updates automatically.

The registry key mentioned in TaurArian's reference does exist.

I guess later today I will see if I understand the help enough to run
Hijackthis software.

Thanks again.
--
Don Eagle
To reply personally, drop the Latin "not more"

There is a very good chance that you are seeing the effects of a
hijackware infection (i.e., infections that cannot be detected by your AV
app, MBAM, and/or anti-spware applications, which, in fact, may be totally
disabled due to the infections)!

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
scan (only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

=====================
Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY
in the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002

I posted the message below from Motzarella yesterday. Apparently it did
not
appear, so I am trying again from a different server. I hope this works
and
I haven't double posted.

I run XP Home, SP3, with Avast anti-virus, Zone Alarm free, Windows
Defender
, MalwareBytes, Spyware Blaster and other anti-malware software. A few
days
ago, I noticed that I was being notified about Windows updates, but they
did
not seem to be downloading and installing. I cannot download updates
either
automatically or manually from the Windows Update website. The error
code I
get is 0x80246008 . A Google search leads me to a MS document that tells
me
that I need to run services.msc and verify that BITS is correctly
configured. When I try to do that, I cannot start BITS. I get error
126,
module cannot be found. MS does not give me any correcting procedure for
that errror. Can anyone here help? Everything worked fine up until
Tuesday
of this week.

 

[PA Bear [MS MVP]]

Reposting:

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as well.**

Thank you, Robear, for the prompt reply. My AV is up to date, and still
updates itself automatically. My machine was fully patched at Windows
Update until this problem occurred. The only update I refused was IE8.

I'm sorry about the delay in replying, but running MSRT and Onecare
protection was a struggle. Each took 3 to 4 hours to run, and both failed
3
times with BSODs. The error messages varied. from IRQ_NOT_LESS_THAN to
PFN_LIST_CORRUPTED to one PAGE fault. I finally got both to run through
over successive nights from Safe Mode with Networking, but my DSL modem
turned off after the software started. MSRT found no problems. In one of
the failed protection scans, Onecare told me drive C: was clear, but Drive
D: had 3 infected items and one other problem whose message I have
forgotten. When Onecare did finish last night, it said it had fixed some
problems, but did not say what they were.

I still can't download updates from MS Updates because the BITS module
cannot be found. I can download anti-spyware updates other than Windows
Defender, and Avast AV still updates automatically.

The registry key mentioned in TaurArian's reference does exist.

I guess later today I will see if I understand the help enough to run
Hijackthis software.

Thanks again.

There is a very good chance that you are seeing the effects of a
hijackware infection (i.e., infections that cannot be detected by your AV
app, MBAM, and/or anti-spware applications, which, in fact, may be
totally
disabled due to the infections)!

NB: If you had no anti-virus application installed or the subscription
had
expired *when the machine first got infected* and/or your subscription
has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
scan (only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as
well.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

=====================
Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY
in the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated
with
security updates.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002

I posted the message below from Motzarella yesterday. Apparently it did
not
appear, so I am trying again from a different server. I hope this works
and
I haven't double posted.

I run XP Home, SP3, with Avast anti-virus, Zone Alarm free, Windows
Defender
, MalwareBytes, Spyware Blaster and other anti-malware software. A few
days
ago, I noticed that I was being notified about Windows updates, but they
did
not seem to be downloading and installing. I cannot download updates
either
automatically or manually from the Windows Update website. The error
code I
get is 0x80246008 . A Google search leads me to a MS document that
tells
me
that I need to run services.msc and verify that BITS is correctly
configured. When I try to do that, I cannot start BITS. I get error
126,
module cannot be found. MS does not give me any correcting procedure
for
that errror. Can anyone here help? Everything worked fine up until
Tuesday
of this week.

 

[Donald Eagle]

No "fystem" was found in the registry.
--
Don Eagle
To reply personally, drop the Latin "not more"

I posted the message below from Motzarella yesterday. Apparently it did
not
appear, so I am trying again from a different server. I hope this works
and
I haven't double posted.

I run XP Home, SP3, with Avast anti-virus, Zone Alarm free, Windows
Defender
, MalwareBytes, Spyware Blaster and other anti-malware software. A few
days
ago, I noticed that I was being notified about Windows updates, but they
did
not seem to be downloading and installing. I cannot download updates
either
automatically or manually from the Windows Update website. The error code
I
get is 0x80246008 . A Google search leads me to a MS document that tells
me
that I need to run services.msc and verify that BITS is correctly
configured. When I try to do that, I cannot start BITS. I get error 126,
module cannot be found. MS does not give me any correcting procedure for
that errror. Can anyone here help? Everything worked fine up until Tuesday
of this week.

BITS - again.

There is probably something in the Event Log about this problem with
more clues.

When you are finished doing all your malware scanning, and if you
still have a problem, search the registry for:

fystem

This of course should be:

system

Some of those malwares (or some people think updates) like to pick on
this registry value when it is part of a %...system...% construct,
usually in the BITS service section.

Rather than post all the keys, just search and replace since it is
obviously wrong.

If you find some and this works, please let us know some details.

 

[Donald Eagle]

Output of HijackThis has been put on aumha.net, but no post has yet
appeared.
In following leads from TaurArian's post, I have some new info:
The installation check in the registry to verify installation by displaying
the key ...\hotfix\KB842773 shows that that key does not exist I went to
the download site and downloaded the update KB842773. When I try to install
it, I get a message that I have a newer version as part of a service pack,
presumably SP3, and the installation will not proceed. When I go to the
folder Windows\system32, I do find the dll files listed in the support paper
KB842773. What now? Do I dare add a key to the registry?
--
Don Eagle
To reply personally, drop the Latin "not more"

Reposting:

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as
well.**

Thank you, Robear, for the prompt reply. My AV is up to date, and still
updates itself automatically. My machine was fully patched at Windows
Update until this problem occurred. The only update I refused was IE8.

I'm sorry about the delay in replying, but running MSRT and Onecare
protection was a struggle. Each took 3 to 4 hours to run, and both
failed 3
times with BSODs. The error messages varied. from IRQ_NOT_LESS_THAN to
PFN_LIST_CORRUPTED to one PAGE fault. I finally got both to run through
over successive nights from Safe Mode with Networking, but my DSL modem
turned off after the software started. MSRT found no problems. In one of
the failed protection scans, Onecare told me drive C: was clear, but
Drive
D: had 3 infected items and one other problem whose message I have
forgotten. When Onecare did finish last night, it said it had fixed some
problems, but did not say what they were.

I still can't download updates from MS Updates because the BITS module
cannot be found. I can download anti-spyware updates other than Windows
Defender, and Avast AV still updates automatically.

The registry key mentioned in TaurArian's reference does exist.

I guess later today I will see if I understand the help enough to run
Hijackthis software.

Thanks again.

There is a very good chance that you are seeing the effects of a
hijackware infection (i.e., infections that cannot be detected by your
AV
app, MBAM, and/or anti-spware applications, which, in fact, may be
totally
disabled due to the infections)!

NB: If you had no anti-virus application installed or the subscription
had
expired *when the machine first got infected* and/or your subscription
has
since expired and/or the machine's not been kept fully-patched at
Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
scan (only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the
requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as
well.**

If these procedures look too complex - and there is no shame in
admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

=====================
Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY
in the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated
with
security updates.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002

Donald Eagle wrote:
I posted the message below from Motzarella yesterday. Apparently it
did
not
appear, so I am trying again from a different server. I hope this
works
and
I haven't double posted.

I run XP Home, SP3, with Avast anti-virus, Zone Alarm free, Windows
Defender
, MalwareBytes, Spyware Blaster and other anti-malware software. A few
days
ago, I noticed that I was being notified about Windows updates, but
they
did
not seem to be downloading and installing. I cannot download updates
either
automatically or manually from the Windows Update website. The error
code I
get is 0x80246008 . A Google search leads me to a MS document that
tells
me
that I need to run services.msc and verify that BITS is correctly
configured. When I try to do that, I cannot start BITS. I get error
126,
module cannot be found. MS does not give me any correcting procedure
for
that errror. Can anyone here help? Everything worked fine up until
Tuesday
of this week.

 

[Tim Meddick]

Because you have the Service Pack, the single Update 'Hotfix' package is
not needed as you yourself have verified the files are present in your
system directory.

The fact that you don't have that particular 'Hotfix' package registered
is neither here nor there as what you do have registered is the fact you
have (presumably) SP3 installed.

As the 'Hotfix' package you are talking about is part of this 'Service
Pack' it makes the need for a multitude of minor fixes *redundant* as
they are part of it [SP3]


==

Cheers, Tim Meddick, Peckham, London.

Output of HijackThis has been put on aumha.net, but no post has yet
appeared.
In following leads from TaurArian's post, I have some new info:
The installation check in the registry to verify installation by
displaying the key ...\hotfix\KB842773 shows that that key does not
exist I went to the download site and downloaded the update
KB842773. When I try to install it, I get a message that I have a
newer version as part of a service pack, presumably SP3, and the
installation will not proceed. When I go to the folder
Windows\system32, I do find the dll files listed in the support paper
KB842773. What now? Do I dare add a key to the registry?
--
Don Eagle
To reply personally, drop the Latin "not more"

Reposting:

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as
well.**

Thank you, Robear, for the prompt reply. My AV is up to date, and
still
updates itself automatically. My machine was fully patched at
Windows
Update until this problem occurred. The only update I refused was
IE8.

I'm sorry about the delay in replying, but running MSRT and Onecare
protection was a struggle. Each took 3 to 4 hours to run, and both
failed 3
times with BSODs. The error messages varied. from IRQ_NOT_LESS_THAN
to
PFN_LIST_CORRUPTED to one PAGE fault. I finally got both to run
through
over successive nights from Safe Mode with Networking, but my DSL
modem
turned off after the software started. MSRT found no problems. In
one of
the failed protection scans, Onecare told me drive C: was clear, but
Drive
D: had 3 infected items and one other problem whose message I have
forgotten. When Onecare did finish last night, it said it had fixed
some
problems, but did not say what they were.

I still can't download updates from MS Updates because the BITS
module
cannot be found. I can download anti-spyware updates other than
Windows
Defender, and Avast AV still updates automatically.

The registry key mentioned in TaurArian's reference does exist.

I guess later today I will see if I understand the help enough to
run
Hijackthis software.

Thanks again.

There is a very good chance that you are seeing the effects of a
hijackware infection (i.e., infections that cannot be detected by
your AV
app, MBAM, and/or anti-spware applications, which, in fact, may be
totally
disabled due to the infections)!

NB: If you had no anti-virus application installed or the
subscription had
expired *when the machine first got infected* and/or your
subscription has
since expired and/or the machine's not been kept fully-patched at
Windows
Update, don't waste your time with any of the below: Format &
reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to
download the
MSRT on a non-infected machine, then transfer MRT.EXE to the
infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's
'Protection'
scan (only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the
requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as
well.**

If these procedures look too complex - and there is no shame in
admitting
this isn't your cup of tea - take the machine to a local, reputable
and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

=====================
Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling
1-866-PCSAFETY
in the United States and in Canada or by contacting your local
Microsoft
subsidiary. There is no-charge for support calls that are
associated with
security updates.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002

Donald Eagle wrote:
I posted the message below from Motzarella yesterday. Apparently
it did
not
appear, so I am trying again from a different server. I hope this
works
and
I haven't double posted.

I run XP Home, SP3, with Avast anti-virus, Zone Alarm free,
Windows
Defender
, MalwareBytes, Spyware Blaster and other anti-malware software.
A few
days
ago, I noticed that I was being notified about Windows updates,
but they
did
not seem to be downloading and installing. I cannot download
updates
either
automatically or manually from the Windows Update website. The
error
code I
get is 0x80246008 . A Google search leads me to a MS document
that tells
me
that I need to run services.msc and verify that BITS is correctly
configured. When I try to do that, I cannot start BITS. I get
error
126,
module cannot be found. MS does not give me any correcting
procedure for
that errror. Can anyone here help? Everything worked fine up
until
Tuesday
of this week.

 

[Donald Eagle]

This problem goes back 2 weeks, but has been fixed with help from Microsoft.
Thanks to all who replied, and apologies to PA Bear for my senior moment
brain glitch in not reading all the aumha forum requirements. Why I stopped
at item 5, I do not know. Anyway, what fixed the background update (BITS)
problem was the following procedure from Sean Qiu:


Based on the current situation, the BITS issue can be caused if the related
components are corrupted. I suggest we refer to following steps to reinstall
BITS services.



Step 1: Reinstall the BITS service

==========================

1. Click Start, click Run, type: Inf and press Enter. A folder will be
opened.

2. Locate the file "qmgr.inf" in the opened folder (you can type q to locate
this file), right click on the file and choose "Install".



Note: The file extension ".inf" may be hidden; we may only see the file
named "qmgr".



3. The setup process will try to restore the registry branches
automatically. You may not receive any notification. However, if some files
cannot be located automatically, we will be prompted to select the
installation source. Please click browse, and go to this location:



C:\Windows\ServicePackFiles\i386



If this folder is not available, please choose the folder
C:\Windows\System32.



Step 2: Register BITS related Dll

======================

1. Click Start, click Run, type Regsvr32 qmgr.dll in the Open box, and then
click OK.

2. Click OK.

3. Click Start, click Run, type Regsvr32 qmgrprxy.dll in the Open box, and
then click OK.

4. Click OK.

5. Click Start, click Run, type cmd and press Enter.



In the Command Prompt window, input the following command. Press Enter after
each command.



Net stop bits (If you receive any error message here, we can safely ignore)



6. Click Start, click Run, in the Command Prompt window, and input the
following commands. Press Enter after each command.



%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader NB: this
did not work.



7. In the open window, delete all files in the open folder directory. NB:
therre were no files displayed here



8. Click Start, click Run, type cmd and press Enter.



In the Command Prompt window, input the following command. Press Enter after
each command.



Net start bits NB: This did start BITS



Note: You can copy each command and right click the command prompt window,
select paste and press Enter to Run.



Step 3: Restart the BITS service

==================================

1. Click Start, click Run and type in "services.msc" (without quotation
marks); click OK.

2. Double-click the service "Background Intelligent Transfer Service".

3. Click on the Log On tab, please ensure the option "Local System account"
is selected and the option "Allow service to interact with desktop" is
unchecked.

4. Check if this service has been enabled on the listed Hardware Profile. If
not, please click the Enable button to enable it.

5. Click on the tab "General "; make sure the "Startup Type" is "Automatic".
Then please click the button "Start" under "Service Status" to start the
service.



BITS starting type was changed to automatic, and this am, it all worked.

--
Don Eagle
To reply personally, drop the Latin "not more"

Because you have the Service Pack, the single Update 'Hotfix' package is
not needed as you yourself have verified the files are present in your
system directory.

The fact that you don't have that particular 'Hotfix' package registered
is neither here nor there as what you do have registered is the fact you
have (presumably) SP3 installed.

As the 'Hotfix' package you are talking about is part of this 'Service
Pack' it makes the need for a multitude of minor fixes *redundant* as they
are part of it [SP3]


==

Cheers, Tim Meddick, Peckham, London.

Output of HijackThis has been put on aumha.net, but no post has yet
appeared.
In following leads from TaurArian's post, I have some new info:
The installation check in the registry to verify installation by
displaying the key ...\hotfix\KB842773 shows that that key does not exist
I went to the download site and downloaded the update KB842773. When I
try to install it, I get a message that I have a newer version as part of
a service pack, presumably SP3, and the installation will not proceed.
When I go to the folder Windows\system32, I do find the dll files listed
in the support paper KB842773. What now? Do I dare add a key to the
registry?
--
Don Eagle
To reply personally, drop the Latin "not more"

Reposting:
**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as
well.**


Donald Eagle wrote:
Thank you, Robear, for the prompt reply. My AV is up to date, and
still
updates itself automatically. My machine was fully patched at Windows
Update until this problem occurred. The only update I refused was
IE8.

I'm sorry about the delay in replying, but running MSRT and Onecare
protection was a struggle. Each took 3 to 4 hours to run, and both
failed 3
times with BSODs. The error messages varied. from IRQ_NOT_LESS_THAN to
PFN_LIST_CORRUPTED to one PAGE fault. I finally got both to run
through
over successive nights from Safe Mode with Networking, but my DSL modem
turned off after the software started. MSRT found no problems. In one
of
the failed protection scans, Onecare told me drive C: was clear, but
Drive
D: had 3 infected items and one other problem whose message I have
forgotten. When Onecare did finish last night, it said it had fixed
some
problems, but did not say what they were.

I still can't download updates from MS Updates because the BITS module
cannot be found. I can download anti-spyware updates other than
Windows
Defender, and Avast AV still updates automatically.

The registry key mentioned in TaurArian's reference does exist.

I guess later today I will see if I understand the help enough to run
Hijackthis software.

Thanks again.

There is a very good chance that you are seeing the effects of a
hijackware infection (i.e., infections that cannot be detected by your
AV
app, MBAM, and/or anti-spware applications, which, in fact, may be
totally
disabled due to the infections)!

NB: If you had no anti-virus application installed or the subscription
had
expired *when the machine first got infected* and/or your subscription
has
since expired and/or the machine's not been kept fully-patched at
Windows
Update, don't waste your time with any of the below: Format &
reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download
the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
scan (only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the
requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums as
well.**

If these procedures look too complex - and there is no shame in
admitting
this isn't your cup of tea - take the machine to a local, reputable
and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

=====================
Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling
1-866-PCSAFETY
in the United States and in Canada or by contacting your local
Microsoft
subsidiary. There is no-charge for support calls that are associated
with
security updates.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002

Donald Eagle wrote:
I posted the message below from Motzarella yesterday. Apparently it
did
not
appear, so I am trying again from a different server. I hope this
works
and
I haven't double posted.

I run XP Home, SP3, with Avast anti-virus, Zone Alarm free, Windows
Defender
, MalwareBytes, Spyware Blaster and other anti-malware software. A
few
days
ago, I noticed that I was being notified about Windows updates, but
they
did
not seem to be downloading and installing. I cannot download updates
either
automatically or manually from the Windows Update website. The error
code I
get is 0x80246008 . A Google search leads me to a MS document that
tells
me
that I need to run services.msc and verify that BITS is correctly
configured. When I try to do that, I cannot start BITS. I get error
126,
module cannot be found. MS does not give me any correcting procedure
for
that errror. Can anyone here help? Everything worked fine up until
Tuesday
of this week.