Windows XP wont update

Posted on 2006-03-21
Last Modified: 2012-08-13
   I have Windows XP with SP2. I noticed that my Windows Media Player had blocked out the back and forward buttons ( I couldnt use them) then I also noticed that Msn Messenger wouldnt display the song I was listening to (Yes I had it clicked on). So I decided to do a Windows Update to see if that would fix it. I click on download to install the 'Windows Genuine Advantage' update, then it says intallation failed. So I went to review installed updates. I clicked on the red X and nothing happens.

Any thoughts?
Question by:PlatinumStylz

    Author Comment

    Also.. I noticed when I make Norton scan music files, it looks like its scanning, but in the details it says its scanned O of O files.
    LVL 42

    Expert Comment

    you may have something malicious running on your computer
    run hijackthis.  then put the log it produces into the analyzer.  the analyzer will produce a web page that can be saved (option to save is at the bottom of the report).  post a link to your saved analyzed log here.
    analyzer :
    LVL 8

    Expert Comment

    Are you logged in as an admin?

    Assisted Solution

    About the Msn problem: go to the Windows Media Player > Tools > Plug-ins > MSN Messenger Music Plug-in.
    LVL 3

    Assisted Solution

    Your computer has definitely been infected with some form of spyware/virus/trojan/worm/etcetera...

    I don't mean to sound crass, but I recommend that you loose Norton.
    I service computers and 9/10 when a computer has been completely hijacked and the virus scanner "trained" to ignore it, the program is Norton.

    Get rid of Norton and lockdown your browser... after you get the thing cleaned.
    If you're in or around Cincy in the States, I'd be happy to clean *and secure* it for you... and without reinstalling Windows.

    Author Comment


    That worked for the Msn Song Problem, so I will award you some points at the end, thanks. although the back and forward buttons are still not working.

    zephyr hex:

    Here is what my log of hijack this looks like, can you tell me what might be causing the update problem?

    Logfile of HijackThis v1.99.1
    Scan saved at 7:56:12 AM, on 3/22/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Administrator\My Documents\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
    O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [WorkShelf] C:\Program Files\Winstep\WorkShelf.exe autostart
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\\PartyPokerNet\RunPF.exe (file missing)
    O9 - Extra 'Tools' menuitem: - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\\PartyPokerNet\RunPF.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


    Author Comment

    Also I downloaded spybot 1.4 . It wont let me check for errors until I do an update, I try and do an update and this is what I get.

    3/22/2006 8:33:33 AM downloaded update Detection rules
    3/22/2006 8:33:33 AM  - URL:
    3/22/2006 8:33:33 AM  - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\
    3/22/2006 8:33:33 AM  - FILE REJECTED because of bad checksum
    LVL 42

    Accepted Solution

    you can download the spybot definitions separetly.  just run the exe file at the link below and it will ask you for the directory where spybot is installed, and update the defs  (download the detection updates file).  if you are having internet problems on the computer, then download this file from another computer and transfer.

    here is a link to your analyzed log:
    i will look at it and comment on it in a bit...

    Expert Comment

    I'm glad that I've been of help, although not that much beacuse I don't have an idea about the other problems.

    LVL 42

    Expert Comment

    i would definitely remove the party poker 09 items (2 items)

    the other entries look ok.

    in addition to spybot, i also recommend a tool called xcleaner.  when you launch it, select all items on the first screen and run it.  if it prompts you to reboot, do NOT.  you want it to complete its scan...  so only reboot after it is completely done scanning.  there are other tools with xcleaner, but if you select all items on the first screen, you dont need to run any of its other options.

    also, run these tools (spybot and xcleaner) in safe mode.

    xcleaner:  (i know, the url is weird... and so is the website... but the tool really does a good job at spyware removal).

    finally, make sure norton is up to date and run a virus scan.  and verify that your IE security settings are at the default level before attempting windows update again.

    Author Comment

    Finally I have fixed the problem. The reason my computer wouldnt update and failed on the 'Windows Genuine Advantage' install was because of the permission settings in the local security settings. A review of my wpa.log file alerted me to that.

    I would like to request a Moderator close this thread an award the points accordingly, thank you.

    alandemartino - 200 points for the Media Player fix
    zephyr hex - 300 points. (Even though he never had the right solution to my question, he gave alot of information and help.)

    Thank you PlatinumStylz
    LVL 42

    Expert Comment

    you can close the thread yourself ;)

    when you scroll down the thread to the box that you normally type into to post, you will see a link just above that box called "split points"
    select that link
    then assign points as you wish.  you will need to select one person as the one who answered the question.  but anyone who has points next to their name will get credit as well.

    as a side note... you could alert the Mods that you answered the question yourself and they would refund your points back to you.  to alert the Mods of this, post a request in the Community Support forum.
    LVL 3

    Expert Comment

    On one system I recently serviced, the malwares had set NUMEROUS policies AND settings to prevent Windows Update from running.  They didn't go after the program itself... just set policies and parameters.  The closest they came to going after the program, was to set the service to "disabled".
    LVL 3

    Expert Comment

    They also disabled the firewall among other things...

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    I wanted to pass this along in case anyone has a problem removing a device from the Device Manager, or if you suspect a corrupted Driver that you want to remove in its entirety. I know it is kinda lengthy and very basic in its format, but I figured …
    cPanel is a Unix based web hosting control panel that provides a graphical interface and automation tools designed to simplify the process of hosting a web site. cPanel utilizes a 3 tier structure that provides functionality for administrators, rese…
    It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
    how to add IIS SMTP to handle application/Scanner relays into office 365.

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now