HTC
Spyware, viruses, & security : for months any windows update link goes to msn.com- help
for months any windows update link goes to msn.com- help
by Lisa - 10/19/08 12:05 AMIve tried everything to fix this- no matter where i click a link to get windows update page it goes right to msn.com- ive even uninstalled avg and zonealarm and turned off windows firewall- no luck- i even reset IE7 back to manufacturers settngs- no luck-
ive run online virusscans- nothing- ccleaner- no luck- im at a loss. turned all my securities to low- still msn.com no matter what- i just dont know what to try-
windows xp- IE7, za up to date- new avast free up to date- had to run live clean sweep a few times- still cant get to windows update- can it have something to do with active x? im stumped (again)
Follow the instructions...
by jahnjahn - 10/19/08 1:57 AM In reply to: for months any windows update link goes to msn.com- help by Lisato install and scan with Malwarebytes Anti-Malware in post 2 HERE.
If still no joy open your Hosts file (with Notepad) at C:\Windows\system32\drivers\etc. Normally, each entry will begin with 127.0.0.1. If not, post the odd entry/ies back on this thread. Ignore the lines that begin with #.
Re: Windows Update redirected to msn.com
by Carol~
- 10/19/08 2:08 AM
In reply to: for months any windows update link goes to msn.com- help by Lisa
Lisa..
Did you try scanning with Malwarebytes' Anti-Malware? You might want to try installing it and scanning in Safe Mode. (Safe Mode isn't imperative, but it would help) MBAM has shown to help some user's with the same problem as you're experiencing. Hopefully, it will do the same for you.
Download Malwarebytes Anti-Malware from:
http://www.besttechie.net/tools/mbam-setup.exe
Or from MajorGeeks:
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
'Double Click mbam-setup.exe to install the application.
-Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
-If an update is found, it will download and install the latest version.
-Once the program has loaded, select Perform QUICK Scan, then click Scan.
-The scan may take some time to finish,so please be patient.
-When the scan is complete, click OK
-On the main scanner screen, click on Show Results to view what was detected.
-Make sure that everything is checked, and click Remove Selected.
-When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so immediately.
**If you encounter this message:"c:\program files\malwarebytes' Anti-Malware\mbamext.dll Unable to register the dll/ocx: RegSvr32 failed with exit code 0x5" Click on ignore mbamext.dll'
Let us know if it helps. If it doesn't, there ARE additional options available to you which will.
Best of luck..
Carol
no luck yet
by Lisa - 10/19/08 11:07 AM In reply to: Re: Windows Update redirected to msn.com by Carol~
i ran that program- it found i think 26 baddies- so i removed then rebooted- went to windows update site and the page loaded, but an error occured ( i think its an active x problem, i cant get the active x prompt to run it no matter what i do or what page im on now) then when i closed IE and tried again it goes right to msn again.
Re: No luck yet
by Carol~ - 10/19/08 4:21 PM
In reply to: no luck yet by Lisa
Lisa..
After you ran the scan and removed the "26 baddies", did you run another scan to make sure you're completely clean?
You wrote that the page loaded, but "an error occurred". Do you happen to know what that error was? You also said you "can't get the active x prompt to run it". Are you having problems with all ActiveX's, or just with Windows Updates? Can you get the updates, if you set them to install automatically? Whether or not it makes a difference, I don't know. But a little more information might help.
When you open IE and go to Tools>Internet Options>Security Tab and click on Trusted Sites, then the "sites" button, do you show the following on the list?
http://*.update.microsoft.com
https://*.update.microsoft.com
http://download.windowsupdate.com
If it is an ActiveX issue, when you click on custom level, on the security tab, are you sure you have the correct Active X setttings?
Download Signed ActiveX controls
Download Unsigned ActiveX controls
Initialize and script ActiveX controls not marked as safe
Run ActiveX controls and plug-ins
Script ActiveX controls marked safe for scripting
If you are getting a specific error, see if anything here helps:
http://support.microsoft.com/?kbid=883821
In lieu of asking unrelated questions, it might help to know what the error message was. I see other's with the same problem, each with a different way of dealing with it.
ok followed the instructions
by Lisa - 10/19/08 4:55 PM In reply to: Re: No luck yet by Carol~
on the windows update error it just sais this
The website has encountered a problem and cannot display the page you are trying to view. The options provided below might help you solve the problem.
For self-help options:
Frequently Asked Questions
Find Solutions
Windows Update Newsgroup
For assisted support options:
Microsoft Online Assisted Support
I still get this after changing the setting in my security about the active x as you suggested- i still do not even get the active x yellow warning at the top of th window.
i reran that scan malware thing and both scans find the following - seems to come back after i reboot
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{101e9aeb-9fc1-4eb4-a72e-c3f0a5f8462e}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.59 85.255.112.126 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{101e9aeb-9fc1-4eb4-a72e-c3f0a5f8462e}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.59 85.255.112.126 -> No action taken.
those 2 files are in both the reports from the scans. its like it keesp coming back at boot up?
i asked the program to remove all teh bad ones but i dont think it removed these.
running a third scan to see if they are found again.avast doesnt see these 2 files or this trojan at all i think.
cant run anything
by Lisa - 10/19/08 5:28 PM In reply to: ok followed the instructions by Lisai tried to run F-Secure Online Virus Scanner but due to the active x problem i cant run anything. i am googling how to solve the ctive x problem- not sure what sites to trust for info anymore exept here.
You changed the ActiveX settings?
by Carol~ - 10/19/08 7:18 PM
In reply to: cant run anything by Lisa
'I still get this after changing the setting in my security about the active x as you suggested'
Sorry, I must have overlooked the above. I meant for you to look at those specifically. Are they all at the default settings, or did you change them?
settings
by Lisa - 10/19/08 7:42 PM In reply to: You changed the ActiveX settings? by Carol~
they were default - i changed them and can set them back- but that didnt help. i printed the post and am trying all that now. i managed to get the adaware 2008 freeware download to start so i will try that too- teh other adaware i had wouldnt update- sounds to me now this whole mess is that virus blocking me no matter what i try. lol. will follow teh instructions in the posts and let ya know how it went- thanks so much all for teh help.
Re: Ok followed instructions
by Carol~ - 10/19/08 6:57 PM
In reply to: ok followed the instructions by Lisa
Lisa..
It's my feeling you first need to deal with the Trojan.DNSChanger entries MBAM found, before proceeding further. One of the developers of MBAM claims it removes Trojan.DNSChanger, but I'm not sure that's the case. You might want to give it one more try.
Did run the scan in Safe Mode, as I suggested above? Before running another scan in Safe Mode with MBAM, unhide your files and folders. Also disable System Restore. (Something you would have needed to do eventually, had the infections you removed found their way into your restore points) You'll need to re-enable it when all is done. You mentioned you ran CCleaner at one point. You might want to run it again, after scanning.
Lisa, there's one other thing you could check, which seemed to have helped some in your same situation. Go to the Control Panel>Network Connections>Local Area Connection. Click on it's Properties. On the General Tab highlight "Internet Protocol (TCP/IP)". After clicking the Properties button there should be a tick mark next to ""Obtain DNS server address automatically". The user at this forum, found it had been changed to "Use the following DNS server addressess" (with addresses entered), instead. I'm NOT saying this will turn things around for you, but something you might want to look into.
Marianna may have some other recommendations. Otherwise, I would suggest posting a HijackThis log, whether any of the above helps, or not. It enables those who analyze them, to have a complete and thorough look at what's going on. And to also use tools we don't use here. We don't analyze HJT logs at this forum, but you'll find a list which do at the below link, along with instructions on how to download and install HJT.
http://forums.cnet.com/5208-4_102-0.html?forumID=32&threadID=255339&messageID=2533167
I wish you the very best of luck..
Carol
to everyone
by Lisa - 10/23/08 12:24 AM In reply to: Re: Ok followed instructions by Carol~
i just wanted to thank everyone for helping me- im sorry also if i caused a stir here. this bug is now gone....... and i actually got the windows update site to work..all my pages now load without errors. im so thrilled- and thank you for recommending 2 great programs and a site that could help one on one. that along with this great forum here sure got me out of an aggrevating spot.
ok im headed back to update every dang anti type program i have- going to be even more cautious now.. again, thanks so much, everyone.:)
Great News!
by Carol~ - 10/23/08 12:42 AM
In reply to: to everyone by Lisa
Lisa..
You didn't cause a stir. We're just glad you were able to get "up and running". I would wait just a bit longer, to see if TomK has anything else to suggest or add. He may even have you post one last log, just to be 100% sure. I don't know. But generally, the helpers will post back, after suggesting you run a scan. Meanwhile, you did some good work!
Stay safe and clean..
Carol
Windows Update has encountered an error
by Carol~ - 10/19/08 7:34 PM
In reply to: ok followed the instructions by Lisa
Lisa..
Have a look here.
"Error message when you try to install updates from the Windows Update Web site on a Windows XP-based computer: "Windows Update has encountered an error and cannot display the requested page""
http://support.microsoft.com/?kbid=914226
so far so good
by Lisa - 10/19/08 8:18 PM In reply to: Windows Update has encountered an error by Carol~
ok the latest in safe mode scan came up clean 0 items found- ran it again after a normal boot- came up clean again.
so now im going to try the article about fixing the windows update error - thanks so much
You're welcome. Sounds good to me :)
by Carol~ - 10/19/08 8:31 PM
In reply to: so far so good by Lisa
You "did good"! If you are clean, and what's in article doesn't help, there may be some other things to try. I'm keeping my fingers crossed... as I call it night. Don't get yourself into trouble while I'm gone. 
| Forum legend: | |
 |
Locked thread |
 |
Moderator |
 |
CNET staff |
 |
Samsung staff |
 |
Norton Authorized Support team |
 |
AVG staff |
 |
Windows Outreach team |
 |
Dell staff |
 |
Intel staff |
