windows update fails

[Hopalong X]

Bob

Jacee is our security expert. If she says your infected... go with her suggestions.

Mike

 

[bobmane]

ESET "cant get update"

HostsXpert did not work

did manual overright of host with this in it

# Copyright © 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
#
127.0.0.1 localhost


ESET still "cant get update"


dont know how to "configure custom proxy settings"

 

[Hopalong X]

Did you run Malwarebytes?

 

[bobmane]

yes


Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes

Database version: 5482

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

1/8/2011 12:32:35 PM
mbam-log-2011-01-08 (12-32-35).txt

Scan type: Full scan (C:\|)
Objects scanned: 441402
Time elapsed: 49 minute(s), 20 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 6
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
c:\Windows\System32\mygwponzjrmcpzjs.dll (Trojan.Agent) -> Delete on reboot.
c:\Windows\SysWOW64\mygwponzjrmcpzjs.dll (Adware.BHO) -> Delete on reboot.

Registry Keys Infected:
HKEY_CURRENT_USER\Software\qni8hj710fdl (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\kzxuxqckjufniyxkf (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D12F52ED-36B5-EB19-5297-930A048A5B09} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{D12F52ED-36B5-EB19-5297-930A048A5B09} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D12F52ED-36B5-EB19-5297-930A048A5B09} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D12F52ED-36B5-EB19-5297-930A048A5B09} (Adware.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fqpysxqfivxgfk (Trojan.Agent) -> Value: fqpysxqfivxgfk -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:

c:\Users\W7\AppData\Local\Temp\browserhotfix4.exe (AdWare.Adrotator) -> Quarantined and deleted successfully.
c:\Windows\System32\kzxuxqckjufniyxkf.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\SysWOW64\kzxuxqckjufniyxkf.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\System32\mygwponzjrmcpzjs.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\SysWOW64\mygwponzjrmcpzjs.dll (Adware.BHO) -> Quarantined and deleted successfully.

 

[Hopalong X]

Excellent.

Jacee is offline at the moment.
Corrine and Niemiro are off line also.

Windows Update might work now but I have a feeling it won't.

You could try this again now that the bugs may be gone. Both options if necessary.
Windows Update - Reset

Eset is something I have never used nor have any ideas about nor fixing Windows Update beyond the reset.

Sorry I'm not more help at the moment.
Mike

 

[bobmane]

no i ran Malwarebytes before doing the other stuff that all failed

 

[derekimo]

Just a thought here, is windows update service started or running?

 

[Jacee]

Uggg! You may have a Rootkit involved here

Follow the instructions here to download and run TDSS Killer How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

Please save the log report, then copy and paste it in your next reply.

 

[bobmane]

OK but while i do that i have a question.


1. if infected on this drive , can it ever affect OSes on other drives

2. is it just limiting the functions and causing inconvenience of is it key logging and/or some other thing that can look at / access private data. ?

 

[bobmane]

i ran a scan with TDSSKiller

it took 4 seconds to run and found nothing

 

[Hopalong X]

Doesn't take long.
I just ran it myself 12 seconds.

 

[bobmane]

Just a thought here, is windows update service started or running?

yes

 

[bobmane]

Did you get this window?

yes

 

[Hopalong X]

Where is the report?

Run again then click report when done and post it for Jacee please.
It won't tell you or I anything but it may Jacee.

Mike

 

[Tews]

It is obvious at this point, that your system is infected, and has been compromised... Forensics is fun if you wish to spend the time with it, but personally, I would never trust a system, if I knew it to be infected... IMO, the only safe road, at this point, is to back up your data, and perform a format/clean install of the OS... That being said, the entire issue could have been resolved in 15 minutes or so, had you made imaging your system a part of your backup policy...

 

[Hopalong X]

Tews

He didn't find anything yet. The pic above is a repost I made not of his system.

 

[bobmane]

usually info on Microsoft site ends up being useless or really hard to understand. as it is in this case.

at Windows Update error 80072efd

they tell you to add an exception but the instructions are wrong and there is no way to "add"

• http://*.update.microsoft.com
• https://*.update.microsoft.com
• http://download.windowsupdate.com

in Control Panel\All Control Panel Items\Windows Firewall\Allowed Programs









and at

You may encounter temporary connection-related errors when you use Windows Update or Microsoft Update to install updates

they talk about a network issue which is a bit far fetched


im sure this is a bug or virus and nothing to do with connection

You have to open up internet explorer options and add these exceptions to your security tab under trusted sites and uncheck the box saying it needs https....cause it doesn't need that to function.

by the way, ie wont even connect to internet...only firefox




but i added and update still will not work

 

[Tews]

Tews

He didn't find anything yet. The pic above is a repost I made not of his system.

You must forgive an old man his failing eyes .. , however, I stand by the last part of my post ... restoring an image is far quicker then spending days, in some cases, chasing down a problem like this one..

 

[bobmane]

Where is the report?

Run again then click report when done and post it for Jacee please.
It won't tell you or I anything but it may Jacee.

Mike

2011/01/09 07:30:37.0276 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:46
2011/01/09 07:30:37.0276 ================================================================================
2011/01/09 07:30:37.0276 SystemInfo:
2011/01/09 07:30:37.0276
2011/01/09 07:30:37.0276 OS Version: 6.1.7600 ServicePack: 0.0
2011/01/09 07:30:37.0276 Product type: Workstation
2011/01/09 07:30:37.0276 ComputerName: W7-PC
2011/01/09 07:30:37.0276 UserName: W7
2011/01/09 07:30:37.0276 Windows directory: C:\Windows
2011/01/09 07:30:37.0276 System windows directory: C:\Windows
2011/01/09 07:30:37.0276 Running under WOW64
2011/01/09 07:30:37.0276 Processor architecture: Intel x64
2011/01/09 07:30:37.0276 Number of processors: 8
2011/01/09 07:30:37.0276 Page size: 0x1000
2011/01/09 07:30:37.0276 Boot type: Normal boot
2011/01/09 07:30:37.0276 ================================================================================
2011/01/09 07:30:37.0276 Utility is running under WOW64
2011/01/09 07:30:55.0778 Initialize success
2011/01/09 07:31:00.0957 ================================================================================
2011/01/09 07:31:00.0957 Scan started
2011/01/09 07:31:00.0957 Mode: Manual;
2011/01/09 07:31:00.0957 ================================================================================
2011/01/09 07:31:05.0996 ================================================================================
2011/01/09 07:31:05.0996 Scan finished
2011/01/09 07:31:05.0996 ================================================================================

 

[Hopalong X]

This is what the report should look like.

There are several hundred lines between start and stop of scan.

You have two empty lines between Scan- Manual- Empty- Empty- Finish

So the scanner isn't scanning anything.