[Metallica]

Click Start > Run type services.msc > OK
In the list of services find:
stchost.exe (moto)
Rightclick that line and choose Properties.
On the General tab Stop and set the service to disabled.
In HijackThis click Config > Misc Tools > Delete an NT service
In the dialog box paste: moto

If that does not solve the problem with Windows Update can you check in Control Panel > Security Center > Automatic updates if it is set to ON

Regards,

[Advertisements]

I did as you suggested. I still have the same problem with windowsupdate on IE.

Under the Control Panel, the Automatic Updates is ON.

[doobers]

I did as you suggested. I still have the same problem with windowsupdate on IE.

Under the Control Panel, the Automatic Updates is ON.

[Metallica]

Sorry if I already asked this (couldn't find it), but which Java are you using?

If not the one by Sun could you install that please?
http://www.java.com/...s_automatic.jsp

Regards,

[doobers]

ok, I downloaded/installed that Java. I still have the same problem on the updates website.

[Metallica]

Click Start, and then click Control Panel. Click Performance and Maintenance, then click Administrative Tools, and then double-click Computer Management. Or, open the MMC containing the Event Viewer snap-in.
In the console tree, click Event Viewer.

The Application, Security, and System logs are displayed in the Event Viewer window.

See if you can find anything listed at the time you tried the Windows Update site.
If you see any errors or warnings please post the content.

Regards,

[doobers]

Ok, under Event Viewer>Application I found an error for each time IE quit on me after trying to go to/stay on the updates page:

Faulting application iexplore.exe, version 6.0.2900.2180, faulting module unknown, version 0.0.0.0, fault address 0x015602fe.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.

0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 65 78 ure iex
0018: 70 6c 6f 72 65 2e 65 78 plore.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 32 31 38 30 20 00.2180
0030: 69 6e 20 75 6e 6b 6e 6f in unkno
0038: 77 6e 20 30 2e 30 2e 30 wn 0.0.0
0040: 2e 30 20 61 74 20 6f 66 .0 at of
0048: 66 73 65 74 20 30 31 35 fset 015
0050: 36 30 32 66 65 0d 0a 602fe..

[Metallica]

Download smitRem.zip and save the file to your desktop.
Right click on the file and extract it to it's own folder on the desktop.

Reboot into safe mode and open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log after you tried Windows Update again. Also let me know if it helped.

Regards,

[doobers]

Nope, that did not help. Here's the post of the log file:



smitRem log file
version 2.2

by noahdfear

The current date is: Sat 07/30/2005
The current time is: 11:02:05.89

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Post-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Wininet.dll ~~~

CLEAN!

[Metallica]

I still can't shake the feeling that one of your system files was replaced by malware.

Please do an online scan with Kaspersky WebScanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Standard
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Regards,

[doobers]

Ok, here's the file from Kaspersky:

-------------------------------------------------------------------------------
KASPERSKY ANTI-VIRUS WEB SCANNER REPORT
Saturday, July 30, 2005 16:16:18
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Anti-Virus Web Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 30/07/2005
Kaspersky Anti-Virus database records: 132943
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 30160
Number of viruses found: 39
Number of infected objects: 116
Number of suspicious objects: 0
Duration of the scan process: 9777 sec

Infected Object Name - Virus Name
C:\Program Files\Norton AntiVirus\Quarantine\001C4E0A.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\00FF3665.exe Infected: Trojan.Win32.Agent.ay
C:\Program Files\Norton AntiVirus\Quarantine\021B2AA9.exe Infected: Trojan-Clicker.Win32.Tiny.c
C:\Program Files\Norton AntiVirus\Quarantine\02A3201C.DLL Infected: Trojan-Downloader.Win32.Agent.pi
C:\Program Files\Norton AntiVirus\Quarantine\03EF4E62.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\07134323.exe Infected: Trojan.Win32.WebSearch.j
C:\Program Files\Norton AntiVirus\Quarantine\0764336B.EXE/WISE0001.BIN Infected: Trojan-Downloader.Win32.TSUpdate.f
C:\Program Files\Norton AntiVirus\Quarantine\0764336B.EXE/WISE0007.BIN Infected: Trojan-Downloader.Win32.TSUpdate.f
C:\Program Files\Norton AntiVirus\Quarantine\0764336B.EXE Infected: Trojan-Downloader.Win32.TSUpdate.f
C:\Program Files\Norton AntiVirus\Quarantine\076976DC.qtd Infected: Trojan-Downloader.Win32.Small.azt
C:\Program Files\Norton AntiVirus\Quarantine\076F4AD5.qtd Infected: Trojan-Downloader.Win32.Small.awa
C:\Program Files\Norton AntiVirus\Quarantine\077274D2.qtd Infected: Trojan-Downloader.Win32.Small.aux
C:\Program Files\Norton AntiVirus\Quarantine\0ADA5E80.exe Infected: Trojan-PSW.Win32.PdPinch.gen
C:\Program Files\Norton AntiVirus\Quarantine\0AFB025C.exe Infected: Trojan.Win32.Agent.ay
C:\Program Files\Norton AntiVirus\Quarantine\0AFE2C58.dat Infected: Trojan-Dropper.Win32.Agent.js
C:\Program Files\Norton AntiVirus\Quarantine\0AFE2C58.exe Infected: Trojan.Win32.Agent.ay
C:\Program Files\Norton AntiVirus\Quarantine\0B187C3B.exe Infected: Trojan.Win32.WebSearch.j
C:\Program Files\Norton AntiVirus\Quarantine\0B1B2638.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton AntiVirus\Quarantine\0B227A31.dll Infected: Trojan-Downloader.Win32.Qoologic.q
C:\Program Files\Norton AntiVirus\Quarantine\0B25242D.dll Infected: Trojan-Clicker.Win32.Delf.r
C:\Program Files\Norton AntiVirus\Quarantine\0B25242D.exe Infected: Trojan-Dropper.Win32.Delf.z
C:\Program Files\Norton AntiVirus\Quarantine\0B2C7826.dll Infected: Trojan-Downloader.Win32.Dyfuca.gen
C:\Program Files\Norton AntiVirus\Quarantine\0B2F2222.exe Infected: Trojan-Downloader.Win32.Qoologic.q
C:\Program Files\Norton AntiVirus\Quarantine\0B324C1F.cpl Infected: Trojan-Downloader.Win32.Qoologic.p
C:\Program Files\Norton AntiVirus\Quarantine\0B324C1F.DLL Infected: Trojan.Win32.WebSearch.i
C:\Program Files\Norton AntiVirus\Quarantine\0B36761B.dat Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton AntiVirus\Quarantine\0B36761B.dll Infected: Trojan-Downloader.Win32.Qoologic.p
C:\Program Files\Norton AntiVirus\Quarantine\0B36761B.EXE Infected: Trojan.Win32.WebSearch.j
C:\Program Files\Norton AntiVirus\Quarantine\0B392017.exe Infected: Trojan-Downloader.Win32.Small.aqt
C:\Program Files\Norton AntiVirus\Quarantine\0BC7552F.exe Infected: Trojan-Downloader.Win32.Small.fo
C:\Program Files\Norton AntiVirus\Quarantine\0F0D3474.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\11C3302F.anr Infected: Trojan-Downloader.Win32.Ani.c
C:\Program Files\Norton AntiVirus\Quarantine\12AB3042.exe Infected: Trojan.Win32.Agent.ay
C:\Program Files\Norton AntiVirus\Quarantine\13E94FC8.exe/WISE0001.BIN Infected: Trojan-Downloader.Win32.TSUpdate.f
C:\Program Files\Norton AntiVirus\Quarantine\13E94FC8.exe/WISE0007.BIN Infected: Trojan-Downloader.Win32.TSUpdate.f
C:\Program Files\Norton AntiVirus\Quarantine\13E94FC8.exe Infected: Trojan-Downloader.Win32.TSUpdate.f
C:\Program Files\Norton AntiVirus\Quarantine\1564699D.exe Infected: Trojan-Clicker.Win32.Tiny.c
C:\Program Files\Norton AntiVirus\Quarantine\16610017.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\185B5260.exe Infected: Backdoor.Win32.Agent.iw
C:\Program Files\Norton AntiVirus\Quarantine\19884B7D.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\1C5A6AF5.exe Infected: Trojan-Dropper.Win32.Small.vu
C:\Program Files\Norton AntiVirus\Quarantine\1C6368EB.exe Infected: Trojan-Downloader.Win32.Small.bas
C:\Program Files\Norton AntiVirus\Quarantine\1E842B68.exe/WISE0010.BIN Infected: Trojan-Downloader.Win32.TSUpdate.k
C:\Program Files\Norton AntiVirus\Quarantine\1E842B68.exe/WISE0011.BIN Infected: Trojan-Downloader.Win32.TSUpdate.j
C:\Program Files\Norton AntiVirus\Quarantine\1E842B68.exe/WISE0012.BIN Infected: Trojan-Downloader.Win32.TSUpdate.l
C:\Program Files\Norton AntiVirus\Quarantine\1E842B68.exe Infected: Trojan-Downloader.Win32.TSUpdate.l
C:\Program Files\Norton AntiVirus\Quarantine\1EBE2652.dll Infected: Trojan-Downloader.Win32.Qoologic.q
C:\Program Files\Norton AntiVirus\Quarantine\1EC82448.dat Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton AntiVirus\Quarantine\1EC82448.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton AntiVirus\Quarantine\1F00272F.exe Infected: Trojan.Win32.Agent.ay
C:\Program Files\Norton AntiVirus\Quarantine\1F0E2FFC.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\1F874177.exe Infected: Trojan-Dropper.Win32.Small.vu
C:\Program Files\Norton AntiVirus\Quarantine\1F8A6B73.exe Infected: Trojan-Downloader.Win32.Agent.ho
C:\Program Files\Norton AntiVirus\Quarantine\1F946968.dll Infected: Backdoor.Win32.Agent.iw
C:\Program Files\Norton AntiVirus\Quarantine\1F9A3D61.dll Infected: Backdoor.Win32.Agent.iw
C:\Program Files\Norton AntiVirus\Quarantine\22EF0BB7.dll Infected: Trojan-Downloader.Win32.Ieser.a
C:\Program Files\Norton AntiVirus\Quarantine\23297F76.exe Infected: Backdoor.Win32.Haxdoor.de
C:\Program Files\Norton AntiVirus\Quarantine\232D2973.exe Infected: Trojan-Downloader.Win32.Agent.ho
C:\Program Files\Norton AntiVirus\Quarantine\24AB59CE.dll Infected: Backdoor.Win32.Agent.iw
C:\Program Files\Norton AntiVirus\Quarantine\24AB59CE.exe Infected: Backdoor.Win32.Agent.iw
C:\Program Files\Norton AntiVirus\Quarantine\25091B66.exe Infected: Trojan-PSW.Win32.PdPinch.gen
C:\Program Files\Norton AntiVirus\Quarantine\26290A2A.exe Infected: Trojan-Downloader.Win32.Agent.ho
C:\Program Files\Norton AntiVirus\Quarantine\263C0614.exe Infected: Trojan.Win32.Crypt.c
C:\Program Files\Norton AntiVirus\Quarantine\268421C5.exe Infected: Backdoor.Win32.Haxdoor.de
C:\Program Files\Norton AntiVirus\Quarantine\26C96712.exe Infected: Trojan-Downloader.Win32.Small.awa
C:\Program Files\Norton AntiVirus\Quarantine\271A2D20.exe Infected: Trojan-Downloader.Win32.Small.azt
C:\Program Files\Norton AntiVirus\Quarantine\271E571C.exe Infected: Trojan-Dropper.Win32.Small.wv
C:\Program Files\Norton AntiVirus\Quarantine\27242B15.exe Infected: Trojan-Downloader.Win32.Small.atl
C:\Program Files\Norton AntiVirus\Quarantine\275C74D8.sys Infected: Backdoor.Win32.Haxdoor.cg
C:\Program Files\Norton AntiVirus\Quarantine\275F1ED5.exe Infected: Trojan.Win32.Crypt.c
C:\Program Files\Norton AntiVirus\Quarantine\277C18B4.dll Infected: Trojan-PSW.Win32.LdPinch.os
C:\Program Files\Norton AntiVirus\Quarantine\294A45BC.exe Infected: Trojan.Win32.Agent.ay
C:\Program Files\Norton AntiVirus\Quarantine\2C940162.dll Infected: Trojan-PSW.Win32.LdPinch.os
C:\Program Files\Norton AntiVirus\Quarantine\2D2E174C.exe Infected: Trojan.Win32.Crypt.c
C:\Program Files\Norton AntiVirus\Quarantine\2F737987.exe Infected: Trojan-Dropper.Win32.Small.wv
C:\Program Files\Norton AntiVirus\Quarantine\2F7A1CC5.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\2F9B40A1.anr Infected: Trojan-Downloader.Win32.Ani.c
C:\Program Files\Norton AntiVirus\Quarantine\2FC56272.exe Infected: Trojan-PSW.Win32.LdPinch.os
C:\Program Files\Norton AntiVirus\Quarantine\32EC64FB.exe Infected: Trojan-PSW.Win32.PdPinch.gen
C:\Program Files\Norton AntiVirus\Quarantine\330634DE.exe Infected: Trojan-Dropper.Win32.Agent.js
C:\Program Files\Norton AntiVirus\Quarantine\3340289D.exe Infected: Trojan-Downloader.Win32.Small.ayl
C:\Program Files\Norton AntiVirus\Quarantine\3344529A.EXE/WISE0001.BIN Infected: Trojan-Downloader.Win32.TSUpdate.f
C:\Program Files\Norton AntiVirus\Quarantine\3344529A.EXE/WISE0007.BIN Infected: Trojan-Downloader.Win32.TSUpdate.f
C:\Program Files\Norton AntiVirus\Quarantine\3344529A.EXE Infected: Trojan-Downloader.Win32.TSUpdate.f
C:\Program Files\Norton AntiVirus\Quarantine\3344529A.js Infected: Trojan-Downloader.JS.Small.ag
C:\Program Files\Norton AntiVirus\Quarantine\334E508F.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton AntiVirus\Quarantine\33517A8B.exe Infected: Trojan-Downloader.Win32.Small.fo
C:\Program Files\Norton AntiVirus\Quarantine\3C111C57.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\3C534CAA.exe Infected: Backdoor.Win32.Agent.iw
C:\Program Files\Norton AntiVirus\Quarantine\3E1163DC.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\3FDF0FDE.exe Infected: Trojan.Win32.Agent.ay
C:\Program Files\Norton AntiVirus\Quarantine\47326CB2.exe Infected: Trojan.Win32.Crypt.c
C:\Program Files\Norton AntiVirus\Quarantine\4B744888.exe Infected: Trojan-Downloader.Win32.Qoologic.q
C:\Program Files\Norton AntiVirus\Quarantine\4C08046F.exe Infected: Trojan-Dropper.Win32.Agent.js
C:\Program Files\Norton AntiVirus\Quarantine\4DB54F80.sys Infected: Backdoor.Win32.Haxdoor.cg
C:\Program Files\Norton AntiVirus\Quarantine\563E4A7E.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton AntiVirus\Quarantine\57050487.exe Infected: Trojan-Downloader.Win32.Small.fo
C:\Program Files\Norton AntiVirus\Quarantine\58AB0801.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\58BC4D69.exe Infected: Trojan-Downloader.Win32.Qoologic.o
C:\Program Files\Norton AntiVirus\Quarantine\58D25328.exe Infected: Trojan-Downloader.Win32.Dyfuca.du
C:\Program Files\Norton AntiVirus\Quarantine\5B3B480C.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\5E496CBF.exe Infected: Trojan.Win32.Agent.ay
C:\Program Files\Norton AntiVirus\Quarantine\60F22255.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\644C0968.exe Infected: Trojan.Win32.WebSearch.j
C:\Program Files\Norton AntiVirus\Quarantine\64C8052E.exe Infected: Trojan.Win32.Agent.ay
C:\Program Files\Norton AntiVirus\Quarantine\65FA084B.exe Infected: Trojan-Downloader.Win32.Small.azt
C:\Program Files\Norton AntiVirus\Quarantine\6C914512.exe Infected: Trojan-Downloader.Win32.Agent.ho
C:\Program Files\Norton AntiVirus\Quarantine\6FE22097.exe Infected: Trojan.Win32.Crypt.c
C:\Program Files\Norton AntiVirus\Quarantine\710F277D.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\756B1BB2.exe Infected: Trojan.Win32.Agent.ay
C:\Program Files\Norton AntiVirus\Quarantine\77DE31AB.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\78210110.exe Infected: Trojan-Downloader.Win32.Small.aux
C:\Program Files\Norton AntiVirus\Quarantine\784750A0.qtd Infected: Trojan-Downloader.Win32.Small.atl
C:\Program Files\Norton AntiVirus\Quarantine\7A681DBE.exe Infected: Trojan-Downloader.Win32.Small.ahg
C:\Program Files\Norton AntiVirus\Quarantine\7D712666.dll Infected: Trojan-Downloader.Win32.Ieser.a
C:\WINDOWS\system32\winlogon32.dll Infected: Trojan-Downloader.Win32.Small.baa

Scan process completed.

[Metallica]

Most of those were already quarantained by Norton but the last one might be our evildoer.

• Download the Registry Search Tool.
• Unzip the contents of RegSrch.zip to a convenient location.
• Double-click on RegSrch.vbs.
• If you have an anti-virus installed it might prompt you about a running script. Please ignore this warning and allow the script to run.
• In the "Enter search string (case insensitive) and click OK..." box paste this string:
  • winlogon32.dll
• Click "OK" to search the registry for that string.
• Wait for a few minutes while it completes the search.
• Click "OK" to open the results in WordPad.
• Copy and paste the entire results into your next post.

Regards,

[doobers]

I did as you said, and it did not give me the option to open the results in WordPad because it told me:

No instances of "winlogon32.dll" found.

[Metallica]

Download Process Explorer from HERE

Run Process Explorer and click Find > Find DLL
type winlogon32 in the dialog box.

Let me know in which Processe(s) it is found, they will be listed in the bottom part.

If it is not listed in any of them simply delete:
C:\WINDOWS\system32\winlogon32.dll

Regards,

[doobers]

Ok, it did not list any processes, so I just went and deleted it. Then I restarted and tried to go to the updates page on IE again. Unfortunately, it did the same thing (loaded and then after a few seconds it gave me an error and had to close).

[Metallica]

Can you find a entry in the Event Viewer logs that could be related?

To open Event Viewer, click Start, click Control Panel, click Performance and Maintenance, click Administrative Tools, and then double-click Event Viewer.

Regards,