No software updates in Normal mode

XP Home SP3, 512mb ram.
Client thought the computer was infected because it suddenly stopped updating software. Nothing will update in Normal mode (TurboTax, Malwarebytes, Avira Antivir, Windows, all fail to update). I can get online with IE but Firefox can't. Booting into Safe mode, all programs that I tested were able to update and Firefox got online.

Avira, MBAM, SuperAntiSpyware, and ComboFix all scan clean other than tracking cookies so I don't think an infection is causing this. There is no third party firewall that I can find installed and turning Windows firewall off doesn't help matters.

I uninstalled Avira and installed Microsoft Security Essentials at clients request (didn't like Avira interface). MSE would not update after being installed. Researching the web found that the Windows Installer service may have to be started for MSE to update. Found Windows Installer stopped. Set it to Automatic and started it. MSE updated in Normal mode that one time, but has failed to update since. And, the Windows Installer service is still set to Automatic but is never started on boot up (not sure if that's normal or not).

With programs being able to retrieve updates in Safe mode but not Normal mode tells me that it has to be a software issue. Its probably just a setting somewhere, but I can't figure it out (thus my asking for help with the experts here at BC).

Thanks for any help you can give.

<<Nothing will update...>>

Error messages?

You actually went to WUS...what was the error message?

Louis

You checked Event Viewer for pertinent errors?

Edited by hamluis, 16 April 2010 - 12:08 PM.

When trying to update Windows, the update site never comes up. I get "The website has encountered a problem and cannot blah blah blah" with error code 0x80070017.
All the other programs give their own error codes with a message saying basically to insure you are connected to the internet.

The Event viewer is full of errors under Applications. Most are from MPSampleSubmission, crypt32, and MSEssentials. I have no idea what the first 2 listed are. MSEssentials is obviously Security Essentials.

EDIT: A little more info that I forgot to mention.
Outlook Express will receive but not send emails.
TurboTax would not send the e-file.
Malwarebytes gets the following message when trying to update: An error has occurred. Please report this error code to our support team. MBAM_ERROR_UPDATING (12029, 0, WinHttpSendRequest)
I just disabled all startup items using msconfig. That didn't help so it shouldn't be any program running in the background that is causing this.

Edited by possumbarnes, 16 April 2010 - 07:25 PM.

What is the Outlook Express error message, please?

MPSampleSubmission...Windows Defender error. This is XP and you have Windows Defender installed?

MSEssenitals, we know.

Crypt32.dll, Error 8 seems to be Windows Update.

All of these indicate an inability to update the native program.

Have these programs been configured correctly? Do you have a given update time scheduled...when the system is off/not powered?

Do you have any other problems connecting to the Internet and browsing?

Error 0x80070017. I would follow Method 1, but rather than type chkdsk /f, type chkdsk /r.

Are you using a proxy server?

Malware often will install proxy server settings on a system, let's see.

Open Internet Explorer...select Tools/Internet Options. Connections tab...scroll down and click the LAN settings button. Uncheck proxy server, if it is selected. Click OK, etc.

Now see if you can update/connect.

If so, then you may want to reverse whatever you changed in msconfig.

Louis

Outlook Express gave some kind of SMTP error when trying to send. Receives just fine. Installed Mozilla Thunderbird and set up a new gmail account for the client. Thunderbird also gives an SMTP error when trying to send an email. I can't give you a specific error right now because chkdsk /r is running (currently on step 4 of 5 at about 15%)

It seems that nothing is allowed outbound EXCEPT for Internet Explorer. That makes no sense to me whatsoever except for a firewall gone bad. Turning the windows firewall off does not help the situation. Is there a difference between terminating the firewall service under the Administrative Tools-Services and just turning the firewall off in the Control Panel?

There is no proxy settings at all. Everything is set to automatic under connections.

Thanks for the help so far, Louis. I'll get back to you after chkdsk is done.

Well...I'd take a look in Event Viewer for errors pointing to connectivity problems. There should be a number of those, given all the current dysfunctionality.

http://email.about.com/cs/standards/a/smtp_error_code.htm

In the absence of anything illuminating...I would also try setting up the NIC anew.

If that produces nothing new...I'd have to guess that the NIC is failing.

You mentioned running ComboFix...you know the standard warning about using that without supervision, no need for me to repeat it.

See Manually Restoring Internet Connection at http://www.bleepingcomputer.com/combofix/how-to-use-combofix. You might read the rest of that webpage also, paying particular attention sections like:

"You should not run ComboFix unless you are specifically asked to by a helper. Also, due to the power of this tool it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained. If you do so, it may lead to problems with the normal functionality of your computer."

Louis

I had a similar Problem, that actually came about from an Email from Gmail, traced back to China. I have been watching this Thread, wasn't sure until you mentioned Gmail.

If it is the same? it is a devilish thing, that really freaked me out.

It could not be detected in any other way, except for the Fact that it was generating so many copies of Files? Over ten Copies each of my entire C:/ Drive. At one stage I had nine Computers completely down from it. I don't have a "Quick Fix", but I am happy to share what I did to try to resolve it.

BTW, I am working on the fourth one to come back online, during the time I also had serious Medical Problems.

Louis/hamluis is corect, the thing I had actually took out HJT and turned it into a Zombie, bombarding me with Spam as it did with many other Programs, bombarded my Windows Live Messenger List and also every one that I had sent an email to through Outlook Express. I do not use Outlook Express or IE6 in any way now, yet keep them up to date, same as Windows Live or Messenger, which I access for emails only from online, no input is allowed beside that.

You could try a Free Program, called Threatfire? It works similar to TeaTimer from SpyBot S&D, but without the Resources grab. It just tells you simply when something, "Maybe" Malious is trying to alter your Computer and gives you an option to block it. That may Help? It's Scan actually counts the number of Files scanned and displays them.

http://www.threatfire.com/download/

Ray.

Edited by Drovers Dog, 16 April 2010 - 11:06 PM.

chkdsk /r ran but didn't help. System Restore only has one point in it and that was from about 3 hours ago so it won't do me any good. I just can't get my mind wrapped around how nothing is going out except IE.

I'm gonna run SDfix and see if that helps at all (not hopeful)

Read my Post again with an OPEN mind?

Think about what I say?

If I am right, that thing is generating more copies each time you make changes, untill it fills the Hard Drive and just takes over, or will burn it out in frustration, as it has done for my Neighbour, in who's name it was originally sent.

I have been lucky, so far, only lost one HDD, buts heaps of RAM, and DVD Burners and DVD ROMS, they just burned out, when I challanged them, darned thing was hiding in the capicators in the DVDs, I thought it was in the RAM. Only two Locical explainations I can think of? I am very conversant on draining a MotherBoard of ALL Information and returning it to Default as it came from the Factory.

Ray.

Edited by Drovers Dog, 16 April 2010 - 11:36 PM.

Drovers Dog,
I appreciate your input but there are no signs of anything at all being copied anywhere. The hard drive is not filling up. I simply have a bunch of programs that cannot get to the outside world except for IE. IE gets out just fine. We just set up a Gmail account for testing purposes so we wouldn't be messing with the client's email accounts.

Louis,
I've used ComboFix for years. It didn't find anything when it ran, plus this computer was having this issue before I got my hands on it, so Combofix is not the cause.
The SMTP message is simply Outlook and Thunderbird telling me that it can't reach the SMTP server at Charter or Gmail.
Event viewer shows a few errors. One of them under System was a browser error, saying that "The browser was unable to promote itself to master browser. The computer that currently believes it is the master browser is MOMMYCOMPUTER." (Mommycomputer is another computer on our network). Almost like this computer thinks its a slave in a network that has to have permission to do anything. The trouble is that it has the same issue at the client's home, and we have never had this issue with any other clients computers. I've got two others hooked up right now and they are connected with no issues.

Try uninstalling the Programs that won't upgrade?

Post back. I bet that they wont let you uninstall, Mate. Just make it worse.

Look towards an extreme Reformat and reinstall, save what you can. I have heaps of Data, for the Machines, that I am not Game to reintroduce, just yet. I am still not sure that I actually have this thing by the Throat.

You just need to save it all towards one side, on Disks or an external HDD, not knowing if you can use it, if it is what I suspect. It certainly seems like similar to what I am fighting.

I suspect that I am not alone in the World with this one. It took out many Millions of Computers using XP, making them vertually useless. I am just a stubbon old person that doesn't know when to quit.

Ray

Edited by Drovers Dog, 17 April 2010 - 12:57 AM.

Master browser errors are nothing...I get them all the time on my home network.

These have to do, in my case, with which computer I turn on first. The first one connecting to the Internet will be deemed the Master Browser, which makes sense.

But, if I turn on another system in my home network first...I get the MB error notification.

It has no impact at all on connectivity, I consider it just a status report of sorts on the technical aspects of connecting to the Internet from multiple computers in a home network configuration.

If you are getting MB errors and the system is not in a home network...that's beyond my knowledge/abilities.

Windows Browsing

Louis

I certainly bow towards Louis' Judgement. That is normally what we would expect.

I think? Maybe you have a similar Problem to me?

That is totally different and quite unusual. I would Love to keep this all here so that ALL Members and Guests get some advantage from it?

Ray.