Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows Update command box flashing/Automatic Update Disabled


  • Please log in to reply
3 replies to this topic

#1 IAmCelery

IAmCelery

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:12:28 PM

Posted 28 November 2008 - 08:53 PM

Hello folks - first post, so you have my apologies if I don't quite get the format correct.

I did a search for this problem and didn't find anything - my apologies again if this type of problem has already been addressed.

First of all, I'm running Windows Vista Ultimate with SP1 (32 bit) on a Dell Latitude D830 with 2.20GHz processor and 4GB RAM.

A short while back, a command box has been flashing every twenty or thirty seconds with a heading having something to do with Windows Update (from what I can read, the cmd box comes and goes very quickly). This came with a Windows Security alert saying that the Windows Automatic Updates were disabled. When I attempted to re-enable automatic updates, I got the message

[Window Title]
Windows Security Center

[Main Instruction]
Security Center can't change your automatic updating settings.

[Content]
Change settings manually


When I attempt to change the settings manually, I get the error:

[Window Title]
::{21EC2020-3AEA-1069-A2DD-08002B30309D}\::{36EEF7DB-88AD-4E81-AD49-0E313F0C35F8}\pageSettings

[Content]
Windows cannot find '::{21EC2020-3AEA-1069-A2DD-08002B30309D}\::{36EEF7DB-88AD-4E81-AD49-0E313F0C35F8}\pageSettings'. Make sure you typed the name correctly, and then try again.

[OK]


I looked up the error messages online and found a variety of explanations from "this is a Windows error" to "this is a backdoor trojan."

My first instinct was that it was a virus, so I ran a full Symantec Scan, ran a Bazooka Scan, and ran one other full scan that was suggested by another forum (I've deleted the program since.), and found nothing to fix.

I then turned my attention to the "it's a windows update theory" and tried installing the Windows Update Manager, tried manually re-registering the updater .dlls, and tried stopping, then re-registering the same .dlls.

I managed to register the following .dlls

regsvr32 wuapi.dll
regsvr32 wuaueng.dll
regsvr32 wuaueng1.dll
regsvr32 wucltui.dll
regsvr32 wups.dll
regsvr32 wuweb.dll

This .dll failed, however, with this message:
regsvr32 wups2.dll

[Window Title]
RegSvr32

[Content]
The module "wups2.dll" may not compatible with the version of Windows that you're running. Check if the module is compatible with an x86 (32-bit) or x64 (64-bit) version of regsvr32.exe.

[OK]


After a few hours of digging around with nothing to show for it (the command prompt continued to show up and the updater doesn't work these fixes and a reboot), I left the PC, when I returned, the command prompt was up with something similar to this error message (my sister closed it before I could copy it down exactly)

16 bit MS-DOS Subsystem
wuauclt.exe
The NTVD CPU has encountered an illegal instruction.
Choose 'Close' to terminate the application


The error message also had something similar to this code, but it was not this code - I believe it ended in a lot of f's in a row if that helps.

CS:0556 IP:01a3 OP:63 6f 6d 6d 75


At this time I'm also finding that my Firefox is crashing with "illegal operations" - This is not my main issue, but perhaps it'll provide a clue. (This info is making me lean more heavily towards it being a trojan.

I have run HijackThis and have a log to post - please let me know if it would be a good idea to head over to that forum area as well.

My apologies for the long post and in some cases spotty information, and my great thanks for those who read and respond.

BC AdBot (Login to Remove)

 


#2 IAmCelery

IAmCelery
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:12:28 PM

Posted 28 November 2008 - 09:02 PM

Forgot to mentiion that when I try to manually use Windows Update, windows explorer flashes up for a fraction of a second, closes, and nothing happens.

I have the WindowsUpdate Log file saved for the past few days - there is a -ton- of information on it, but I don't get anything terribly usseful from it - let me know if I should post any of it.

Thanks again!

#3 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:01:28 PM

Posted 29 November 2008 - 07:45 AM

The first step would (IMO) be to scan for malware with an independent scanner. Here's a list of several free, online one's: http://www.bleepingcomputer.com/blogs/usas...?showentry=1252
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#4 bethebel

bethebel

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:12:28 PM

Posted 29 November 2008 - 01:27 PM

Hi, the first post pertains to my computer, my brother was attempting to fix my computer, but has left for home, so an update:
I have run two malware programs (Malwarebytes and Ad-aware):
Both claimed to have found malicious files, I deleted them all (I can provide the log files if you'd like) but none of them seemed like actual malware.
After rebooting the computer, the command prompt window is still flashing every 20-30 seconds and the windows updater is still not working (I got some error pertaining to ox000142 upon shutdown when windows was supposed to install updates).
Any other suggestions? Or any other info I can provide?
Thanks!

Edited by bethebel, 29 November 2008 - 01:30 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users