Solved WinUpdate and MSE fail with 0x8024402c, no common solution works.

[ChrisML]

Hi,

Win7 gave me an "update MSE now" message. I ran MSE. It exited with error above.

I am directly connected to the internet via a broadband modem, sharing the connection with 1 other machine. The home network behaves fine and allows sharing of a NAS drive. I have Win7 Home, on an Athlon64 single core. I am not running nor have I ever run any third party firewalls, or antivirus or internet accelerators. Only Win7firewall and MSE.

Googling gives me possible IE error, recommending to delete proxy settings. My IE settings had no proxy entries, it was a direct connection. LAN setting were set to autodetect already. Switched proxy on to check exceptions, none listed, switched proxy off again.

I use Comodo dragon ( a chrome type browser) stills connects fine. IE doesn't work though. This MSE error occurs with all combinations of comodo and IE loaded and quit.

Looked at the KB/MSE support page for this error. Suggests resetting the local proxy server. Ran cmd as admin, used "netsh winhttp reset proxy", it reported no proxy running. Stopped and started wuauserver anyway. tried MSE again: MSE still gives the error code.

Chose to look for exceptions or blocks in the firewall, I can't see any labelled as MS update or MSE. Just switch firewall off and try again. (on another forum, someone found this worked) Still get 0x8024402c. Firewall back on.

Try updating MSE through Windows Update. This also stops with a 0x8024402c. This problem spans my Win7 install, for MS programs only.

Found the "fix it for me" software from MS support home page. Downloaded "MicrosoftFixit.wu.LB.107262617125576563.10.1.Run" Ran it as admin, but it exited with error 80072EE7, "encountered an error contacting the server". Same cause??

The other machine on the home network has no problems connecting and updating. This problem is limited to my instance of Win7.

Read about a similar error code giving similar problems in similar situations, being fixed by stopping and starting windows update and "Background intelligent transer service" from "Services" running it as admin. Did this then tried MSE/winUpdate: result same error.

Also found Someone resolved this problem by switching "active X filtering" off on his broadband modem. He had the problem on both machines behind the router though where one of mine works. I checked my router home page and settings anyway: it does not have an activeX filtering option.

I think I have exhausted the normal offerings available at MS and on other forums. I have tried raising an email support ticket with MS, but comodo dragon is jumpy about some webpages, and trying IE instead won't work as in the current situation IE doesn't work at all.

A Little help anyone?

 

[windude99]

Hi,

Win7 gave me an "update MSE now" message. I ran MSE. It exited with error above.

I am directly connected to the internet via a broadband modem, sharing the connection with 1 other machine. The home network behaves fine and allows sharing of a NAS drive. I have Win7 Home, on an Athlon64 single core. I am not running nor have I ever run any third party firewalls, or antivirus or internet accelerators. Only Win7firewall and MSE.

Googling gives me possible IE error, recommending to delete proxy settings. My IE settings had no proxy entries, it was a direct connection. LAN setting were set to autodetect already. Switched proxy on to check exceptions, none listed, switched proxy off again.

I use Comodo dragon ( a chrome type browser) stills connects fine. IE doesn't work though. This MSE error occurs with all combinations of comodo and IE loaded and quit.

Looked at the KB/MSE support page for this error. Suggests resetting the local proxy server. Ran cmd as admin, used "netsh winhttp reset proxy", it reported no proxy running. Stopped and started wuauserver anyway. tried MSE again: MSE still gives the error code.

Chose to look for exceptions or blocks in the firewall, I can't see any labelled as MS update or MSE. Just switch firewall off and try again. (on another forum, someone found this worked) Still get 0x8024402c. Firewall back on.

Try updating MSE through Windows Update. This also stops with a 0x8024402c. This problem spans my Win7 install, for MS programs only.

Found the "fix it for me" software from MS support home page. Downloaded "MicrosoftFixit.wu.LB.107262617125576563.10.1.Run" Ran it as admin, but it exited with error 80072EE7, "encountered an error contacting the server". Same cause??

The other machine on the home network has no problems connecting and updating. This problem is limited to my instance of Win7.

Read about a similar error code giving similar problems in similar situations, being fixed by stopping and starting windows update and "Background intelligent transer service" from "Services" running it as admin. Did this then tried MSE/winUpdate: result same error.

Also found Someone resolved this problem by switching "active X filtering" off on his broadband modem. He had the problem on both machines behind the router though where one of mine works. I checked my router home page and settings anyway: it does not have an activeX filtering option.

I think I have exhausted the normal offerings available at MS and on other forums. I have tried raising an email support ticket with MS, but comodo dragon is jumpy about some webpages, and trying IE instead won't work as in the current situation IE doesn't work at all.

A Little help anyone?

Try System Restoring to a time before all of this started happening: http://www.sevenforums.com/tutorials/700-system-restore.html

 

[NoelDP]

Please run the following command from an elevated command prompt, and post the results.

IPCONFIG /ALL


1) To open an Elevated Command Prompt Window (the CP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Windows, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[ChrisML]

Hi,

System restore could work, feels a little heavy handed for what feels like a simple setting change. Will resort to it if I have to.

Used ipconfig as admin lots before. Not used the /all tag though. Here is the ouput.

C:\Windows\system32>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : Anaplian
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : cable.virginmedia.net

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : cable.virginmedia.net
Description . . . . . . . . . . . : Realtek RTL8168D/8111D Family PCI-E Gigab
it Ethernet NIC (NDIS 6.20)
Physical Address. . . . . . . . . : 00-25-22-CC-FD-1E
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::f976:17dc:1f6c:c95b%10(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.102(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 09 June 2012 08:40:40
Lease Expires . . . . . . . . . . : 16 June 2012 08:40:40
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DHCPv6 IAID . . . . . . . . . . . : 234890530
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-17-13-B1-67-00-25-22-CC-FD-1E

DNS Servers . . . . . . . . . . . : 174.114.184.185
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.cable.virginmedia.net:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : cable.virginmedia.net
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 11:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

C:\Windows\system32>

For reference, I used to have DHCP server enabled on the NAS drive but it conflicted with the DHCP server on the router. I switched it off on the NAS and made sure it was off on my Win7 install. As far as I can tell, you can't really switch DHCP client behaviour off on the NAS, and i certainly don't know how to do it in win7, why would you want to? I am guessing (weakly) it might (not) have anything to do with this problem.

Thanks again all.

 

[NoelDP]

You don't really want two DHCP servers on a home network - you would probably get problems with that configuration.
It's actually very easy to turn DHCP Client off in any version of Windows - simply set a fixed IP address in the adapter properties - but it can lead to problems if you access more than one network with that machine.

I suspect that you may be the victim of a DNS hijack - it seems that your DNS server's IP is based in Canada - and I can see no reason why Virgin should be use a Canadian DNS server for a UK account.
Please download and install the free Malwarebytes Anti-malware www.malwarebytes.org and update it, and run a full scan (DO NOT enable the Real-Time protection option!) in your main account, and Quick scans in any other user accounts.
Delete everything it finds

Please chaeck your Ethernet Adapter settings, and if the DNS server is set there, remove it, and allow it to pick up the automatic one.

 

[ChrisML]

I am sure there is only one DHCP server on my home LAN.

MBAM I have done before, and will do now. It is having trouble connecting to the MBAM server for an update. (installing from a local install package from about 2 months ago.) MBAM reported "address is valid but no address found. error 11004, 0, No Address Found". Can't update MBAM. Suspect same cause? Ok scanning anyway on an MBAM that is 100+ days old. I only have one user account, doing a full scan.

Not sure what you mean by Ethernet adapter settings. I looked under settings under Ethernet adapter under device manager. Looked under all the tabs. Could not find anything saying DNS settings. Going to do a google search on that and try again. I have to put the washing out and go to bed.

Tomorrow.
Thanks

 

[ChrisML]

Mbam output:


Malwarebytes Anti-Malware 1.60.1.1000
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Database version: v2012.01.13.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Chris :: ANAPLIAN [administrator]

09/06/2012 22:06:12
mbam-log-2012-06-09 (22-06-12).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 271270
Time elapsed: 27 minute(s), 47 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
====
Looks like I am going for DNS settings on the ethernet card. (um, where is this?)

 

[NoelDP]

Go to Control Panel > Network and Sharing Center

Click on 'Change Adapter setttings'
pick your Enthernet Adapter and double-click on it to open the settings
Highlight the TCP/IPv4 settings and click Properties
make sure that there is nothing in the box for 'Use the following DNS Server addresses'. - the radio button for 'Obtain DNS Server address automatically' should be active.
Repeat for TCP/IPv6, then OK out
Repeat for all other available adapters.
If you've changed anything, reboot.
test

 

[ChrisML]

Followed instructions as last post, re: DNS settings. There was a DNS IP for IP4, but not IP 6. Set to auto. Rebooted.

Works:

MSE updates (now scanning) and
Microsoft update also updates.
MBAM also updates (will run a full scan again now).

My big questions are:
How did this happen?
How do I prevent it from happening again?
Was it only an IP setting on my machine that was changed?
Do I need to change some settings in my router to increase my security, I use the factory settings at the moment?

This machine was a (newish) build about 2 months ago and was freshly installed about that time. I have kept 3rd party software to a minimum, and since it is still a single core, I have noticed that virus programs conflict with each other (I used to run 2) and really slow everything down. I read some reports about running just win firewall and MSE would be enough for the average desktop user (me). I certainly noticed a speed increase. Since the build I have been VERY careful about visiting any sites other than BBC, Google, banking, amazon etc (big name sites with high traffic), and have been using comodo dragon so the most minimal amount of my data is shared. It confuses me that I am being vigilant in this way AND I still get a DNS proxy settings change?

 

[ChrisML]

MBAM is clear:
Malwarebytes Anti-Malware 1.61.0.1400
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Database version: v2012.06.10.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Chris :: ANAPLIAN [administrator]

10/06/2012 08:19:02
mbam-log-2012-06-10 (08-19-02).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 299312
Time elapsed: 33 minute(s), 9 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
==================
MSE is clear so far but only 1/10th the way through the full scan.

Could this be a consequence of using comodo? If ISP cannot collect info on my usage from comodo, then might they reroute me to another DNS to collect info? Ok that was a stupid question, I totally did non use my understanding of what a DNS does when I wrote that question. I can't see how it is a consequence of using comodo dragon though.

 

[NoelDP]

Glad to hear it!

OK - let's deal with your points one at a time.....

How did this happen? - you possibly visited a compromised website without proper protection, or installed software that had malware embedded. I'm qulite surprised that neither MSE nor MBAM spotted the DNS problem, as it's widely known. Have you not used Google lately? - I believe that if it detects such a change it should display a prominent warning (but perhaps your particular DNS wasn't one of the ones it can detect)

How do I prevent it? - by ensuring that you keep windows up-to-date, and your anti-virus solutions also. Also, you need to be careful about where you go on the web, and what you download/install. There is no magic bullet.

Was it only an IP setting on my machine that was changed? - probably not - but if MBAM cannot find anything, it's likely that your AV managed to prevent or remove anything else.

What about my router settings? The main thing to change with your router is the access password - it's all too easy to get supervisor access to a router at default settings, if you can attach to it. Make sure that any NAT firewall in the router is turned on.

Anti-Virus - NEVER have more than one AV running full-time! They WILL conflict, and will often bring the computer to a complete halt. I agree that MSE and the Windows firewall is quite sufficient for the average user (it's all I use, and you should see some of the sites I get to!) - it also has the great advantage of being free adding a weekly scan with MBAM free version is enough to keep the machine clean, most of the time - but nothing is perfect.

HTH?

 

[NoelDP]

I see we crossed in the post
Is comodo at fault? I have no idea - but I'm not a lover of its products.
I just tried using the faulty DNS server you had, in a VM here, and could get nothing at all to connect to the internet. There's no response to a ping, and a tracert goes to a rogers.com server (in Canada), which does not appear to be set up as a DNS server.
I did find a link somewhere that referred to the IP as being forced during the install of some game (from piratebay, IIRC) called Terraria.