Update gone screwy

[JackOfAllTech]

I am trying to fix up a computer for the relative of a co-worker. I
managed to clean up the 58 infected files on the system and update
drivers and some other things so it is apparently clean and stable.
But now when I try to run windows update it opens the first page and
when redirected to a page that ends in \v6\default.aspx it just sits
there for several minutes then IE 8 shuts down. I added http:\
\windowsupdate.microsoft.com to the trusted sites list and that didn't
help. Any ideas?

 

[Ken Blake, MVP]

I am trying to fix up a computer for the relative of a co-worker. I
managed to clean up the 58 infected files on the system and update
drivers and some other things so it is apparently clean and stable.

58 infections is an enormous number. Despite what many people think,
the effect of malware is not necessarily simply present until the
malware is removed. Lots of malware (viruses in particular) can do
severe damage to your system that can never be repaired. Sometimes the
only solution is reinstallation of Windows, and that's especially
likely when there are so many infections.

How did you clean up these infections? With so many infections, my
guess is that it is still infected and is nowhere near "clean and
stable."

 

[Shenan Stanley]

I am trying to fix up a computer for the relative of a co-worker. I
managed to clean up the 58 infected files on the system and update
drivers and some other things so it is apparently clean and stable.
But now when I try to run windows update it opens the first page and
when redirected to a page that ends in \v6\default.aspx it just sits
there for several minutes then IE 8 shuts down. I added http:\
\windowsupdate.microsoft.com to the trusted sites list and that
didn't help. Any ideas?

I doubt it is clean - or at least it has leftovers.

Uninstall IE8 - go with IE7.

Assuming this is 32-bit Windows XP, follow these steps in order as
written...

Download, install, run, update and perform a full scan (separately) with the
following two applications (freeware versions are the ones to use for this):

SuperAntiSpyware
http://www.superantispyware.com/

MalwareBytes
http://www.malwarebytes.com/

After performing a full scan with one and then the other and removing
whatever they both find completely, you may uninstall these products,
if you wish.

Download and run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

Reboot.

Fix your file/registry permissions...

Ignore the title and follow the sub-section under "Advanced Troubleshooting"
titled, "Method 1: Reset the registry and the file permissions"
http://support.microsoft.com/kb/949377

Reboot and ...

Search your registry for %fystem and replace the "f" with an "s". May be
three or four matches, may be none. You may even have to take ownership
(even after doing the above) of the keys in order to make the change.

Download/Install the latest Windows Installer (for your OS):
( Windows XP 32-bit : WindowsXP-KB942288-v3-x86.exe )
http://www.microsoft.com/downloadS/...6F-60B6-4412-95B9-54D056D6F9F4&displaylang=en

Reboot.

and...

Download the latest version of the Windows Update agent from here (x86):
http://go.microsoft.com/fwlink/?LinkID=91237
.... and save it to the root of your C:\ drive. After saving it to the root
of the C:\ drive, do the following:

Close all Internet Explorer windows and other applications.

Start button --> RUN and type in:
%SystemDrive%\windowsupdateagent30-x86.exe /WUFORCE
--> Click OK.

(If asked, select "Run.) --> Click on NEXT --> Select "I agree" and click on
NEXT --> When it finishes installing, click on "Finish"...

Reboot.

Then follow the instructions here:

How do I reset Windows Update components?
http://support.microsoft.com/kb/971058

Reboot.

and..

Log on as an user with administrative rights (assuming you are in this case
- given your problem) and open Internet Explorer and visit
http://windowsupdate.microsoft.com/ and select to do a CUSTOM scan...
(Every time you are about to click on something while at these web pages -
first press and hold down the CTRL key while you click on it. You can
release the CTRL key after clicking each time.)

Once the scan is done, select just _ONE_ of the high priority updates
(deselect any others) and install it.

Reboot again.

If it did work - try the web page again - selecting no more than 3-5 at a
time.

The Optional Software updates are generally safe - although I recommend
against the "Windows Search" one and any of the "Office Live" ones for
now. I would completely avoid the Optional Hardware updates. Also - I do
not see any urgent need to install Internet Explorer 8 at this time.

Come back - let us know if that worked.
.... Really - come back and let everyone know if that worked.

You may want to run a second scan with SuperAntiSpyware and MalwareBytes
after everything is updated.

 

[JD]

Try Microsoft's® Windows Update Repair Tool. Download it here
http://www.ms-mvp.org/

The web page http://www.ms-mvp.org/ uses Godaddy's stealth
frame-redirection to redirect you to:
http://pcbutts1.com/downloads/tools/tools.htm


The Real Truth MS MVP is not listed on the MVP list:




The Real Truth MS MVP is listed in the MVPS HOSTS file supplied by
http://www.mvps.org/winhelp2002/

127.0.0.1 pcbutts1-therealtruth.blogspot.com
127.0.0.1 pcbutts1.com

Anyone using this reputable HOSTS file will not be able to access the
above two web pages.

 

[Barry Schwarz]

Try Microsoft's® Windows Update Repair Tool. Download it here
http://www.ms-mvp.org/

This is not the MVP site despite its fake logos.

The correct MVP site is http://www.mvps.org/.

 

[Olórin]

Oh, bugger; it's back.

Try Microsoft's® Windows Update Repair Tool. Download it here
http://www.ms-mvp.org/

 

[M.I.5¾]

Try Microsoft's® Windows Update Repair Tool. Download it here
http://www.ms-mvp.org/

This is a fake MVP site used to distribute malware. It links to pcbutts1's
malware distribution site.

*** Do not download anything from it or you will have more trouble than you
started with. ***

Google 'pcbutts1' for more information.

 

[JackOfAllTech]

58 infections is an enormous number. Despite what many people think,
the effect of malware is not necessarily simply present until the
malware is removed. Lots of malware (viruses in particular) can do
severe damage to your system that can never be repaired. Sometimes the
only solution is reinstallation of Windows, and that's especially
likely when there are so many infections.

How did you clean up these infections? With so many infections, my
guess is that it is still infected and is nowhere near "clean and
stable."

<forehead slap> You're right, of course. I used Malwarebyte's software
but the system was so screwed up I got a BSOD trying to run the full
scan. Then I had to manually download the driver update files and
install them. I currently am running a full scan and will then run
another one with Superantispyware. The owner is supposed to be
purchasing a copy of Norton Internet Security 2009 as his choice for
security software, which I think I will suggest he let me install
before the system leaves my control.

Thanks for all the help, everyone!