Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


Windows XP wont update

Posted on 2006-03-21
Medium Priority
Last Modified: 2012-08-13
   I have Windows XP with SP2. I noticed that my Windows Media Player had blocked out the back and forward buttons ( I couldnt use them) then I also noticed that Msn Messenger wouldnt display the song I was listening to (Yes I had it clicked on). So I decided to do a Windows Update to see if that would fix it. I click on download to install the 'Windows Genuine Advantage' update, then it says intallation failed. So I went to review installed updates. I clicked on the red X and nothing happens.

Any thoughts?
Question by:PlatinumStylz
  • 4
  • 4
  • 3
  • +2

Author Comment

ID: 16248274
Also.. I noticed when I make Norton scan music files, it looks like its scanning, but in the details it says its scanned O of O files.
LVL 44

Expert Comment

by:zephyr_hex (Megan)
ID: 16248440
you may have something malicious running on your computer
run hijackthis.  then put the log it produces into the analyzer.  the analyzer will produce a web page that can be saved (option to save is at the bottom of the report).  post a link to your saved analyzed log here.
hijackthis: http://www.majorgeeks.com/download3155.html
analyzer : http://www.hijackthis.de

Expert Comment

ID: 16248465
Are you logged in as an admin?
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Assisted Solution

alandemartino earned 600 total points
ID: 16248484
About the Msn problem: go to the Windows Media Player > Tools > Plug-ins > MSN Messenger Music Plug-in.

Assisted Solution

M_Intuit earned 300 total points
ID: 16249846
Your computer has definitely been infected with some form of spyware/virus/trojan/worm/etcetera...

I don't mean to sound crass, but I recommend that you loose Norton.
I service computers and 9/10 when a computer has been completely hijacked and the virus scanner "trained" to ignore it, the program is Norton.

Get rid of Norton and lockdown your browser... after you get the thing cleaned.
If you're in or around Cincy in the States, I'd be happy to clean *and secure* it for you... and without reinstalling Windows.

Author Comment

ID: 16258023

That worked for the Msn Song Problem, so I will award you some points at the end, thanks. although the back and forward buttons are still not working.

zephyr hex:

Here is what my log of hijack this looks like, can you tell me what might be causing the update problem?

Logfile of HijackThis v1.99.1
Scan saved at 7:56:12 AM, on 3/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\My Documents\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://loginnet.passport.com/ppsecure/md5auth.srf?lc=1033
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WorkShelf] C:\Program Files\Winstep\WorkShelf.exe autostart
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


Author Comment

ID: 16258335
Also I downloaded spybot 1.4 . It wont let me check for errors until I do an update, I try and do an update and this is what I get.

3/22/2006 8:33:33 AM downloaded update Detection rules
3/22/2006 8:33:33 AM  - URL: http://dl.betanews.com/spybot/updates/files/includes.zip
3/22/2006 8:33:33 AM  - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.zip
3/22/2006 8:33:33 AM  - FILE REJECTED because of bad checksum
LVL 44

Accepted Solution

zephyr_hex (Megan) earned 600 total points
ID: 16259162
you can download the spybot definitions separetly.  just run the exe file at the link below and it will ask you for the directory where spybot is installed, and update the defs
http://www.safer-networking.org/en/download/  (download the detection updates file).  if you are having internet problems on the computer, then download this file from another computer and transfer.

here is a link to your analyzed log: http://www.hijackthis.de/logfiles/e2b13ce5310498212ebf6253688f8bff.html
i will look at it and comment on it in a bit...

Expert Comment

ID: 16259228
I'm glad that I've been of help, although not that much beacuse I don't have an idea about the other problems.

LVL 44

Expert Comment

by:zephyr_hex (Megan)
ID: 16259259
i would definitely remove the party poker 09 items (2 items)

the other entries look ok.

in addition to spybot, i also recommend a tool called xcleaner.  when you launch it, select all items on the first screen and run it.  if it prompts you to reboot, do NOT.  you want it to complete its scan...  so only reboot after it is completely done scanning.  there are other tools with xcleaner, but if you select all items on the first screen, you dont need to run any of its other options.

also, run these tools (spybot and xcleaner) in safe mode.

xcleaner: http://aboutyourbreakup.com/xcleaner.html  (i know, the url is weird... and so is the website... but the tool really does a good job at spyware removal).

finally, make sure norton is up to date and run a virus scan.  and verify that your IE security settings are at the default level before attempting windows update again.

Author Comment

ID: 16260312
Finally I have fixed the problem. The reason my computer wouldnt update and failed on the 'Windows Genuine Advantage' install was because of the permission settings in the local security settings. A review of my wpa.log file alerted me to that.

I would like to request a Moderator close this thread an award the points accordingly, thank you.

alandemartino - 200 points for the Media Player fix
zephyr hex - 300 points. (Even though he never had the right solution to my question, he gave alot of information and help.)

Thank you PlatinumStylz
LVL 44

Expert Comment

by:zephyr_hex (Megan)
ID: 16261427
you can close the thread yourself ;)

when you scroll down the thread to the box that you normally type into to post, you will see a link just above that box called "split points"
select that link
then assign points as you wish.  you will need to select one person as the one who answered the question.  but anyone who has points next to their name will get credit as well.

as a side note... you could alert the Mods that you answered the question yourself and they would refund your points back to you.  to alert the Mods of this, post a request in the Community Support forum.

Expert Comment

ID: 16264853
On one system I recently serviced, the malwares had set NUMEROUS policies AND settings to prevent Windows Update from running.  They didn't go after the program itself... just set policies and parameters.  The closest they came to going after the program, was to set the service to "disabled".

Expert Comment

ID: 16264863
They also disabled the firewall among other things...

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disclosure: Use this tutorial only when no other options helps to get Windows XP running without any problems and you don't want to format the drive. The back up of the data is the responsible of the user, however there is a description of how t…
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Is your OST file inaccessible, Need to transfer OST file from one computer to another? Want to convert OST file to PST? If the answer to any of the above question is yes, then look no further. With the help of Stellar OST to PST Converter, you can e…

580 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question