Windows update problem

**yayupp** · 07-10-10, 05:59 PM

My mom's laptop got a nasty virus, but I took care of it using avast!. She mainly uses it for emails, word, etc. However, when my sister gets on it, she installs all kinds of things and browses who-knows-what. I had to do lots of cleaning, chkdsk, defraging, etc. But now, when ever I try to use WindowsUpdate, it opens InternetExplorer and gives me the "Internet Explorer cannot display the webpage". Every other website works, so it's not my connection. I've tried looking everywhere for help on this issue. I hoping someone here can help me out.

Specs:
Microsoft Windows XP
Professional
Version 2002
Service Pack 3

HP
AMD Turion 64 X2 Mobile
1.81 GHz, 1.43 GB of RAM

**DJ Ms. White** · 07-10-10, 06:06 PM

Check your computers error messages to see if an error pops up when you try to use Windows update.

**Bunni** · 07-10-10, 06:09 PM

You still have a virus installed (or have not corrected the imbalence). I think its virtuemond, ill look for my post a while back on how to nuke it.

One of the things it does is install a transparent proxy, which filters all your traffic blocking some sites (windows update included). Id wager you cannot get to some popular antivirus websites either.

**Bunni** · 07-10-10, 06:11 PM

eh see if this rings a bell: http://www.teamplayergaming.com/show...ght=virtumonde

If you fit the profile, ill upload the virtumonde nuke kit i have, for you

**yayupp** · 07-10-10, 06:39 PM

I can get to all the major AV sites. Google works. It's just WindowsUpdate or http://windowsupdate.microsoft.com/ doesn't work.

Also:
When I start the computer, things take a little longer to load. More specific, at first it will show the balloon in the systray about the firewall not being turned on. The network icons and HP's WLAN thing take long to show up in the systray.

And where can I check for the errors?

**Bunni** · 07-10-10, 06:57 PM

Originally Posted by yayupp

I can get to all the major AV sites. Google works. It's just WindowsUpdate or http://windowsupdate.microsoft.com/ doesn't work.

Also:
When I start the computer, things take a little longer to load. More specific, at first it will show the balloon in the systray about the firewall not being turned on. The network icons and HP's WLAN thing take long to show up in the systray.

And where can I check for the errors?

Hmm could be just a fragment left of a similar virus.

Errors: Hit the windows key+R-> "eventvwr.msc" (w/o quotes) :: hit OK->

Your interested in Application log and System Log

.

If you do not see anything there:

Windows+R-> cmd :: OK-> "tracert update.microsoft.com" :: hit enter

Let it run see if it makes it to microsoft (pinging wont work for that address btw)

Also, do me a favor and download hijack this, install and run it, and post the log of the first scan.

**yayupp** · 07-11-10, 09:56 PM

Ok here is what I got from the event log. The errors I found in Application:

Source: crypt32
"Failed auto update retrieval of third-party root list sequence number from: <http://www.download.wondowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist."

The errors I found in System:

Source: Ftdisk
"Configuring the Page file for crash dump failed. Make sure there is a file on the boot partion and that is large enough to contain physical memory"

Source: Service Control Manager
"Timeout (30000 milliseconds) waiting for Roxio Hard Drive Watcher 9 service to connect."

I searched for anything Roxio related, and deleted it except for two folders because access was denied.

**yayupp** · 07-11-10, 10:15 PM

It's not letting me post the whole log here.

And the Tracert "request timed out" after seven hops.

**Bunni** · 07-13-10, 05:40 PM

Sorry for the delayed reply. Can you post the log in fragments?

If your in a explorative mood, ive ~~attached~~ linked a utility used to crush a old, devastating virus. It has many utilities that can be used for a wide range of virus cleanup. It makes backup's of important files, so if something does go wrong (doubt it will, if you stick to my instructions) you'll have a backup. So if your up-to-it, download it and extract it somewhere, then run the 'Smitfraudfix.cmd' file as Administrator (if your in Vista or W7). If you do not want to do this yet, then post that hijack log or pm it to me. From it i should be able to tell if you need to run this.

Smitfraudfix.cmd->

4 :check for updates :: (follow dialog and let it run, when its done you'll return back to the main menu)->
3: [OPTIONAL] Delete Trusted Zones :: (these can be used maliiciously to block your access to certain sites) ->
6: proxy disable :: follow dialog, will eventually return back to main menu ->
5: Search and clean DNS Hijack :: post log (will open txt log file after it finishes).

This link should work for you: Smit Fraud Fix