[Niki McKnight]

Hi... I was referred here by Lt.Angel, (http://www.geekstogo...35#entry1778835) As I am unable to update Vista...

[Advertisements]

Are you still using LimeWire PRO ?

Having Limewire running in the background (or even installed in my opinion) can make fixing your computer extremely difficult.
Plus it may have been the reason why you were infected in the first place (I'd say likely)

By the way, I read through the long Malware removal thread.
It is difficult reading your posts if your Font and Color changes.
I ask whilst I try to help that you do not use any of this extra formatting in your posts. Only because I have trouble reading it clearly. Thanks.


Try this

Download and Run IE Reset Fixit Tool: http://support.microsoft.com/kb/923737
Irrespective of what browser you normally use.

Temporarily disable Windows Firewall, or any 3rd party live protecting software (Antivirus only can remain enabled and updated

• Click on Start > Run > CMD > ok
• Type the following commands. Press <enter> key after each command:
  • regsvr32 wuapi.dll
  • regsvr32 wuaueng.dll
  • regsvr32 wuaueng1.dll
  • regsvr32 wucltui.dll
  • regsvr32 wups.dll
  • regsvr32 wups2.dll
  • regsvr32 wuweb.dll
• Re-Enable your Firewall and test Windows Update again

EDIT: You may need to Restart first



EDIT2
The following was provided (reminded) to me by Moderator Rorschach112
I will refer to it in future on any support posts I make that also entails registry editing

Before Changing/Adding/Editing any Registry entry
Backup Your Registry with ERUNT

• Please use the following link and scroll down to ERUNT and download it.
  http://aumha.org/freeware/freeware.php
• For version with the Installer:
  Use the setup program to install ERUNT on your computer
• For the zipped version:
  Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe

Edited by kimsland, 10 March 2010 - 05:10 AM.

[kimsland]

Are you still using LimeWire PRO ?

Having Limewire running in the background (or even installed in my opinion) can make fixing your computer extremely difficult.
Plus it may have been the reason why you were infected in the first place (I'd say likely)

By the way, I read through the long Malware removal thread.
It is difficult reading your posts if your Font and Color changes.
I ask whilst I try to help that you do not use any of this extra formatting in your posts. Only because I have trouble reading it clearly. Thanks.


Try this

Download and Run IE Reset Fixit Tool: http://support.microsoft.com/kb/923737
Irrespective of what browser you normally use.

Temporarily disable Windows Firewall, or any 3rd party live protecting software (Antivirus only can remain enabled and updated

• Click on Start > Run > CMD > ok
• Type the following commands. Press <enter> key after each command:
  • regsvr32 wuapi.dll
  • regsvr32 wuaueng.dll
  • regsvr32 wuaueng1.dll
  • regsvr32 wucltui.dll
  • regsvr32 wups.dll
  • regsvr32 wups2.dll
  • regsvr32 wuweb.dll
• Re-Enable your Firewall and test Windows Update again

EDIT: You may need to Restart first



EDIT2
The following was provided (reminded) to me by Moderator Rorschach112
I will refer to it in future on any support posts I make that also entails registry editing

Before Changing/Adding/Editing any Registry entry
Backup Your Registry with ERUNT

• Please use the following link and scroll down to ERUNT and download it.
  http://aumha.org/freeware/freeware.php
• For version with the Installer:
  Use the setup program to install ERUNT on your computer
• For the zipped version:
  Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe

Edited by kimsland, 10 March 2010 - 05:10 AM.

[Niki McKnight]

HI Kim,

I just wanted to touch base... I have tried re-registering the dll files, though I will do so again per your instruction. I will report back once I have completed the task you suggested... And thank-you in advance for your help... Cheers ~Niki

[kimsland]

No probs Niki,

If you reply I'll read it

But I am thinking of getting off, I've been on for already ~3hrs today, my eyes are going all gooblywok

[Niki McKnight]

Hi Kim.... I actually posted a reply yesterday, that for some reason isn't here, it was complete with images...=~( Ugh... So, allow me to try again... First and foremost I really appreciate you help, and I apologize for not having been available... I had no idea you stayed online for extended amounts of time to help! If you let me know approximately the hours you are on, I will do my best to make myself available.
(I'm truly so thankful, I feel as if there is something more I should say or do. If there is anything I can do for you or to give back, please let me know...)

Yes, I use Limewire, however the folder I download to isn't on my main drive and I run several scan on the entire download folder before I so much as look at a downloaded file, also I do not download exe nor rar files...

Step 1 - I didn't complete this step as I wasn't sure I was suppose to, as I do not use IE at all, only Firefox.

Step 2 - I attempted once again to register the dll files, and the errors I encountered are posted below.








Step 3 - I followed your instructions, and while the program did not state that it was compatible Vista, it did install and seemingly run fine. However, during installation the program asked me if I wanted the program to create a back-up copy each time windows was started, which seemed a bit excessive, though I allowed it to, should I change this setting?

[happyrock]

you need to run sfc /scannow...
if you don't have a xp cd you will have to borrow one from a friend or coworker...
it has to be the same flavor of xp you have installed...IE: if you have xp pro...the one you borrow has to be xp pro

How to use Scannow sfc...

To do this click on start...run...then type in...sfc /scannow

This command will immediately initiate the Windows File Protection service to scan all protected files and verify their integrity, replacing any files with which it finds a problem.

for vista...
go to the run box and type in cmd
instead of hitting the Enter key press Ctrl+Shift + Enter You will be prompted with the obnoxious User Account Control dialog… but it will then open up a command prompt in Administrator mode...then type in sfc /scannow

NOTE THE SINGLE SPACE BEFORE THE /

[Niki McKnight]

Thank-you very much HappyRock, for stepping in to help... I'm am running the scan now, will update you as soon as it is finished...

[Niki McKnight]

Also just a little 411, I am running Vista, Home Premium, (bah, I miss XP)
I have the "obnoxious User Account Control" turned off...
My would consider my computer knowledge to be advanced, (compared to most), and I am more than willing to do all the foot work needed... I knew my way inside out and backwards on my XP, (which I miss dearly), and am shocked that MS, changed the OS so vastly...




I tried to include the CBS log file but cannot, I'm assuming it is because of the size...(26MB)
Would you like for me to post it in sections or look for and export just a certain part?

Thanks again HappyRock.....

Edited by Niki McKnight, 15 March 2010 - 03:10 AM.

[happyrock]

just cut and paste any parts it said are corrupt and can't fix...
then try the CheckSUR tool here...
pick the version of vista or 7 you have...the x86 are for 32 bit versions and the x64 are for 64 bit versions...if you have over 3GB of ram you have a 64 bit OS

Edited by happyrock, 15 March 2010 - 09:28 AM.

[Niki McKnight]

Ok, I went about half way through the loig file, but I'm not exactly sure what you want me to paste...=~(


2009-05-02 19:53:26, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2009-05-02 19:59:34, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2009-05-02 20:01:00, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2009-08-01 04:14:28, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2009-10-08 07:26:25, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2009-10-12 16:20:29, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2009-11-23 09:37:01, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-01-09 07:32:03, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-02 09:48:04, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-02 11:52:17, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-02 11:53:04, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-02 11:53:23, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-02 11:54:45, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-10 03:49:49, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-10 12:22:03, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-21 20:15:19, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-21 23:51:49, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-21 23:53:19, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-22 00:08:49, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-22 00:08:56, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-28 11:42:24, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-28 13:22:25, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-28 13:37:08, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-28 17:38:06, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

2010-02-28 17:38:14, Info CBS Mark store corruption flag because of package: WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.2.6001.788. hr: 0x800b0100

Found: {l:32 b:gib0dZO1gEo8sibeZdJPtRR7nMXy6zKCrpw//At8Mw0=} Expected: {l:32 b:Rtr8cVvCvL/Vajsrw98d0sA2iT6rLk/W5Dk+CBBU1Q0=}
2010-03-01 07:10:10, Info CSI 00000136 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"wuauclt.exe"; source file in store is also corrupted
2010-03-01 07:10:10, Info CSI 00000137 Hashes for file member \??\C:\Windows\System32\wups2.dll do not match actual file [l:18{9}]"wups2.dll" :


Found: {l:32 b:HeBDOpvHtYxcIS6/hiB8w4iPh4Se68BD40ZQ1BnQ0IM=} Expected: {l:32 b:sbl3QY024aF5BdczkQ2hrJTsLLFyRZyDL/xyTMOFo2U=}
2010-03-01 07:10:10, Info CSI 00000139 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:18{9}]"wups2.dll"; source file in store is also corrupted
2010-03-01 07:10:10, Info CSI 0000013a Repair results created:
POQ 53 starts:
0: Move File: Source = [l:192{96}]"\SystemRoot\WinSxS\Temp\PendingRenames\b3a5482338b9ca01d81700007004e805._0000000000000000.cdf-ms", Destination = [l:104{52}]"\SystemRoot\WinSxS\FileMaps\_0000000000000000.cdf-ms"

[Niki McKnight]

I scanned the log for "corrupt", which I pasted above, (but not all of them), then I tried searching the log for "can't fix", and nothing came up...

[Niki McKnight]

scanned log for "failed to resolve": (some of which is posted below, but there are just so many...???)

2006-12-31 23:05:00, Error CBS Failed to resolve Package: WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~en-US~7.2.6001.788. hr: 0x80070490

2010-03-15 06:25:41, Error CBS Failed to resolve Package: WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~en-US~7.2.6001.788. hr: 0x80070490

2009-05-03 20:17:26, Error CBS Failed to resolve Package: WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~en-US~7.2.6001.788. hr: 0x80070490

2009-05-04 02:23:56, Error CBS Failed to resolve Package: WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~en-US~7.2.6001.788. hr: 0x80070490

2009-05-04 07:24:15, Error CBS Failed to resolve Package: WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~en-US~7.2.6001.788. hr: 0x80070490

[happyrock]

I edited my last post...run the CheckSUR tool...
you must restart your computer after you run CheckSUR to make sure that any changes take effect. Additionally, you must try to reinstall any software updates that previously could not be installed. If CheckSUR detected and fixed the cause of the failures, these updates will now install successfully.

[Niki McKnight]

But there wasn't any parts that said "can't fix"

[Niki McKnight]

and by checkSur do you the update readiness tool?