Windows Updates - Problems

Richard Sinkler · Post by **Richard Sinkler** » 17 Dec 2010 11:44 am

Vista operating system, 32 bit I assume. Just normal OS that Dell put on this laptop.

This week I have had notifications that I had updates to install (automatic updates). I think it was Wednesday, I had to update and Windows proceeded to install like 13 updates. At the end, my computer would not boot up. This morning, Windows automatically gave me 3 updates without my, knowledge that it was happening until I got the window that said my computer was going to restart in XX minutes. I clicked on restart now. The computer went to the shutdown screen. After watching a whole 30 minute TV show with that screen showing, I figured I better turn off the computer using the on/off switch as the automatic shutdown/reboot wasn't going to happen. When I turned it back on, all I got was the first screen that has the little progress bar that has the green vertical stripes that scroll across the progress bar. Then, a black screen. This happened after both updates this week. Both times I had to use the repair program, which did nothing but give me a chance to restore to previous point. Not choosing to restore and clicking cancel just takes me back to the black screen.

Whats's going on with these Micro$hit updates?

Mitch Drumm · Post by **Mitch Drumm** » 17 Dec 2010 11:58 am

Richard:

These links may help:

http://www.sevenforums.com/tutorials/91 ... html?ltr=W

http://www.thewindowsclub.com/repair-fi ... wu-utility

Richard Sinkler · Post by **Richard Sinkler** » 17 Dec 2010 3:41 pm

Thanks Mitch. I have Vista, not Win 7.

I think I am OK. When I shut down again, it showed I had updates to install and I stupidly clicked to update before shutdown. It installed the 12 updates that I trouble with on Wednesday. It would not boot up again though. I used the repair utility and it seems to be OK now.

Wiz Feinberg · Post by **Wiz Feinberg** » 17 Dec 2010 8:17 pm

Richard;
It appears to my trained and suspicious eye that your PC may be infected with a Rootkit.

Richard Sinkler · Post by **Richard Sinkler** » 18 Dec 2010 11:58 pm

Wiz.. Not familiar with that. How do I tell and fix it?

I use Trend Micro" Internet Security Pro but don't know if that should detect it.

I wish we would go back to the DOS days. Back then, the term "computer literate" meant knowing how to use it. Now it means how well you can fix the crap that Microsoft puts out.

Wiz Feinberg · Post by **Wiz Feinberg** » 19 Dec 2010 9:04 am

Richard;
Update the definitions for TMIS and run a full computer scan. While that is happening, aosl download Malwarebytes' Anti-Malware. Install and update it, then run a Quick Scan with it.

Report back on any malware found and removed by either program.

Windows Updates are designed by Microsoft and should not cause a failure to be able boot the computer into Windows. The only time in the past year that this event was documented, it was due to the resistance of a hidden rootkit, interfering with a major update to the Windows kernel. That is why I suggested that a rootkit might be implanted deep in your operating system (your PCs OS, not yours!).

Have you tried rebooting it into Safe Mode? If it will boot into Safe Mode With Networking, you can install updates from there, then reboot into Safe Mode again, rather than normal mode. If this convoluted process works, something is messing up when normal Windows is loading drivers. The detective work starts at that point to disable various startup processes until you find the bad one.

Richard Sinkler · Post by **Richard Sinkler** » 19 Dec 2010 4:59 pm

It seems to be running OK right now, although it boots and shuts down real slow. I will try those things tomorrow when I'm not so tired and have more patience.

Or, I could just call in my favotite computer tech...

Richard Sinkler · Post by **Richard Sinkler** » 19 Dec 2010 7:55 pm

Well I googled "rootkit" and I have to say it scared the livin' daylights out of me.

I updated Trend (actually, it does it by itself every day. I did a complete scan and here is the result.

Nothing seems out of order here. Those 3 cookies show up in every scan on both of my computers.

Will run Malwarebytes over night.

Wiz Feinberg · Post by **Wiz Feinberg** » 19 Dec 2010 8:11 pm

Since this problem involves a Dell PC, why not visit the Dell user forums and post you problem with Windows Updates there? Others may have reported similar issues and solutions may be found there.

Richard Sinkler · Post by **Richard Sinkler** » 20 Dec 2010 9:29 am

Will do Wiz.

Here is the result of the MalwareBytes scam:

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 5360

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

12/20/2010 9:11:21 AM
mbam-log-2010-12-20 (09-11-12).txt

Scan type: Full scan (C:\|D:\|E:\|)
Objects scanned: 379190
Time elapsed: 2 hour(s), 49 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 8
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 7
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Value: {00A6FAF6-072E-44CF-8957-5838F569A31D} -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{00A6FAF6-072E-44cf-8957-5838F569A31D} (Adware.MyWebSearch) -> Value: {00A6FAF6-072E-44cf-8957-5838F569A31D} -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\program files\funwebproducts (Adware.MyWebSearch) -> No action taken.
c:\program files\funwebproducts\screensaver (Adware.MyWebSearch) -> No action taken.
c:\program files\funwebproducts\screensaver\Images (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\Settings (Adware.MyWebSearch) -> No action taken.

Files Infected:
c:\$Recycle.Bin\s-1-5-21-2566267484-1420116232-2070548335-1000\$RCY2PLE.exe (Adware.MyWebSearch) -> No action taken.
c:\program files\mywebsearch\bar\1.bin\MWSSVC.EXE (Adware.MyWebSearch) -> No action taken.
c:\Windows\System32\f3PSSavr.scr (PUP.FunWebProducts) -> No action taken.
c:\program files\mywebsearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> No action taken.

Wiz Feinberg · Post by **Wiz Feinberg** » 20 Dec 2010 5:26 pm

Richard;
MyWebSearch/FunWebProducts is an advertising parasite, but not a high level threat. This would not cause a failure of Windows Updates to take.

Here is my recommended course of action.

Restore to December 14, to before the Windows Updates were applied. Then reboot.

Visit the Windows Update site with Internet Exploder and manually download the available updates, but only one at a time, writing down the KB number of each one, rebooting after each one. If you install a particular update that causes the PC to hang, uninstall that update (by KB number) and report it to Microsoft, or to Dell.

Bent Romnes · Post by **Bent Romnes** » 20 Dec 2010 7:38 pm

Richard, Wiz;
I am currently the recipient of the most nasty rootkit you can ever imagine.
Wiz, a week or so ago you told me to get in touch with bleepingcomputer.com since I had tried everything you suggested to get rid of the rootkit. That was the best advice you could have given.

It turns out I had an mbr rootkit. Spybot S/D found it but could not remove it, likewise MBAM and AVG.
So I got on Bleeping and was assigned a helper. These guys know their stuff. You just have to follow their 'orders' to the letter like you said Wiz.

The last thing I did was fix my master boot record (mbr) with Recovery Console on my Windows disk. Upon scanning with a violent virus killer called Combofix, I think I may be seeing the light at he end of the tunnel. Just waiting to hear back from my Helper.

So I am saying if all else fails, get on to www.bleepingcomputer.com

Wiz Feinberg · Post by **Wiz Feinberg** » 20 Dec 2010 11:16 pm

Bent;
That is the news I wanted to hear! Let us know when you get the all clear. I recall mentioning Mebroot somewhere in our discussions. That is the name of the most common MBR infector of the past 18 months or so.

Note to others reading this. What works for one computer may not work for another one. The trained malware hunter/killers of Bleeping Computers have an arsenal at their disposal. They choose the best weapon for each computer they are help to fix. Many of the tools they use are not to be used without expert supervision.

Now, Richard, how are you doing in your fight? Where are you at?

Richard Sinkler · Post by **Richard Sinkler** » 21 Dec 2010 3:24 am

Well, I had MalwareBytes get rid of the files it found that were defective, and now when I boot up, I get a message in a dialog box:

WebWorks.exe - Unable to locate component. This application has failed to start because Endec.dll was not found. Reinstalling the application may fix this problem.

Then I get a dialog box that says:

Webworks MFC application has stopped working. A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available.

And finally, i get a balloon at the bottom of the screen that reads:

Windows has blocked some startup programs. Windows blocks programs that require permission to run when Windows starts. Click to view blocked programs.

I looked at the file list but didn't really understand the file names that showed up or what to do with them.

Once the computer boots up, it seems to work fine. The slow startup and shutdown, as well as taking about 30 seconds from the time I click an icon until the program appears, might be the way it has always been. I can't remember this computer ever doing those things fast.

Of course today, I spent half the day troubleshooting and fixing my DSL router and computers. But, that's another story for a different day. DAMN AT&T and 2WIRE.

Wiz Feinberg · Post by **Wiz Feinberg** » 21 Dec 2010 8:09 am

It appears that Webworks.exe is part of the ATT DSL installation kit.

Webworks.exe and the attendant endec.dll are installed from the SBC/AT&T/Yahoo DSL installation disc...in our case, they're put into the 2wire directory which seems to be the standard brand and models of gateway shipped in the self-install kit.

Therefore, the simple and straightforward fix...re-run the SBC/AT&T/Yahoo DSL installation like you were doing it from scratch and go all the way through.

If you reinstall Webworks, tell MBAM to ignore that file. First, reinstall, then scan with your anti-virus program. Then, have MBAM ignore it permanently.

FYI: Webworks is usually started up from Registry RUN entries.

Richard Sinkler · Post by **Richard Sinkler** » 21 Dec 2010 11:16 am

Well, now that you bring up the DSL thing, I'll let you in on the story, Yesterday, and to a lesser extent, the last week, I have noticed the DSL and INTERNET lights on the router going red and blinking. Sometimes the internet light would stay red.

I kept unplugging and plugging in the router as AT&T has had me do in the past (and has fixed things), but yesterday, no help. I hit the reset button and fired up my laptop and was told that I have to reinstall the 2Wire software. It would not complete the installation. Now thinking I would have to wipe out my hard drive and start from scratch, I decided to fire up my desktop. Same message. So I guess the reset wiped out the interface between the computers and router.

I reinstalled the software from AT&T on the desktop, and everything is fine there. Now here's the weird thing. I went back to my laptop and it was back on the net like before. Only the error I mentioned in my last post.

I'm on the laptop now, and the internet is working fine except for that error message about WebWorks at startup.

Would it help to uninstall MBytes before attempting the reinstall of the AT&T software?

EDIT: The AT&T software backup will not go all the way through the setup.

Richard Sinkler · Post by **Richard Sinkler** » 21 Dec 2010 3:37 pm

Here's the latest:

I turned on my monitor after a few hours away from the computer and had a window from Trend Micro that said:

Security Vulnerabilities found in the Windows operating system.
Vulnerability in ASP.net could allow information disclosure. (2418042)

I also updated and scanned my desktop to see if I got the same message and it didn't.

Back to the laptop. I check and I have the following installed:

Microsoft .net Framework 3.5 SP1
Microsoft .net Framework 4 Client Profile
Microsoft .net Framework 4 extended
Microsoft .net Framework 4 Multi Targeting Pack

Should I update every one of these?

By the way, I immediately removed my network cable so the laptop has no connection to the internet until I can found out what I should do. Better safe than sorry.

Is it time to dump the hard drive and reinstall Windows Vista?

Wiz Feinberg · Post by **Wiz Feinberg** » 21 Dec 2010 8:54 pm

Richard Sinkler wrote:Here's the latest:

I turned on my monitor after a few hours away from the computer and had a window from Trend Micro that said:

Security Vulnerabilities found in the Windows operating system.
Vulnerability in ASP.net could allow information disclosure. (2418042)

I also updated and scanned my desktop to see if I got the same message and it didn't.

Back to the laptop. I check and I have the following installed:

Microsoft .net Framework 3.5 SP1
Microsoft .net Framework 4 Client Profile
Microsoft .net Framework 4 extended
Microsoft .net Framework 4 Multi Targeting Pack

Should I update every one of these?

By the way, I immediately removed my network cable so the laptop has no connection to the internet until I can found out what I should do. Better safe than sorry.

Is it time to dump the hard drive and reinstall Windows Vista?

Richard;
Try updating all of the .net components, but do one at a time, rebooting after each update. A lot of programs now use various versions and components of .net. Some versions have been found to have vulnerabilities and when that happens, patched versions are released, via Windows Updates.

Bent Romnes · Post by **Bent Romnes** » 22 Dec 2010 8:00 am

Wiz, I can now report a totally clean drive! Thanks to bleepingcomputer.com I feel secure in this fact.

The scary thing about my rootkit virus wa sthat the usual scanners like MBAM, AVG and SB S&D found the actual infections but were not able to remove them. It also appeared that these nasties actually "made babies" within my master boot record. After some of the viruses were removed, others appeared.

After several scans by Combofix, and a master boot record fix we thought we were out of the woods. My helper then wanted me to run MBAM again...noting showed up; and ESET..it found 11 files of a Trojan variety. After THAT scan, and me sending the helper the resulting logs, we agreed that my drive was clean. I was impressed by Eset, an online virus scanner and will scan with it on occasion.

My helper also suggested I download an outgoing Firewall and use in conjunction with the regular Windows Firewall.

It took me a week and a half to get this done. Like Richard , I was also on the verge of wiping out my hard drive(actually I tried but the virus wouldn't let me!)

So Richard, I would strongly recommend that you contact www.bleepingcomputer.com It appears you have enough problems to justify this.

You need to do two things: Follow their instructions to the letter. And also you need patience. These people are busy experts but will get around to you and your problem. Once you get a helper assigned to you, then he sticks with you like glue.

Wiz, I am a happy camper. Thanks again for your help and excellent advice!

Mitch Drumm · Post by **Mitch Drumm** » 22 Dec 2010 11:46 am

Bent:

I followed your case at bleeping computer--what an ordeal!!

I am running ESET for kicks right now. So far nothing found.

I think the link is bleepingcomputer.com with no "s" at the end.

Those guys are on the ball.

Bent Romnes · Post by **Bent Romnes** » 22 Dec 2010 1:43 pm

Mitch,
Indeed there is no s at the end. I corrected it.
I agree, those guys know their stuff!
Yes I believe that ESet is a good scanner.
Yes, It was quite an ordeal, especially since I didn't have a printer to print the instructions to refer to when I had to shut down the browser. I believed that my printer software was partly to blame for leaving an open port on my PC.

Another roadblock was that the virus prevented me from opening my Windows XP disk when I needed to run recovery console. But finally we got rid of some viruses and that enabled the disk again.

The Steel Guitar Forum

Windows Updates - Problems

Windows Updates - Problems

Fixed - I Think