Windows XP wont update

Hi,
   I have Windows XP with SP2. I noticed that my Windows Media Player had blocked out the back and forward buttons ( I couldnt use them) then I also noticed that Msn Messenger wouldnt display the song I was listening to (Yes I had it clicked on). So I decided to do a Windows Update to see if that would fix it. I click on download to install the 'Windows Genuine Advantage' update, then it says intallation failed. So I went to review installed updates. I clicked on the red X and nothing happens.

Any thoughts?
PlatinumStylzAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

PlatinumStylzAuthor Commented:
Also.. I noticed when I make Norton scan music files, it looks like its scanning, but in the details it says its scanned O of O files.
0
zephyr_hex (Megan)DeveloperCommented:
you may have something malicious running on your computer
run hijackthis.  then put the log it produces into the analyzer.  the analyzer will produce a web page that can be saved (option to save is at the bottom of the report).  post a link to your saved analyzed log here.
hijackthis: http://www.majorgeeks.com/download3155.html
analyzer : http://www.hijackthis.de
0
jsvorCommented:
Are you logged in as an admin?
0
Cloud Class® Course: Amazon Web Services - Basic

Are you thinking about creating an Amazon Web Services account for your business? Not sure where to start? In this course you’ll get an overview of the history of AWS and take a tour of their user interface.

alandemartinoCommented:
About the Msn problem: go to the Windows Media Player > Tools > Plug-ins > MSN Messenger Music Plug-in.
0
M_IntuitCommented:
Your computer has definitely been infected with some form of spyware/virus/trojan/worm/etcetera...

I don't mean to sound crass, but I recommend that you loose Norton.
I service computers and 9/10 when a computer has been completely hijacked and the virus scanner "trained" to ignore it, the program is Norton.

Get rid of Norton and lockdown your browser... after you get the thing cleaned.
If you're in or around Cincy in the States, I'd be happy to clean *and secure* it for you... and without reinstalling Windows.
0
PlatinumStylzAuthor Commented:
alandemartino:

That worked for the Msn Song Problem, so I will award you some points at the end, thanks. although the back and forward buttons are still not working.


zephyr hex:

Here is what my log of hijack this looks like, can you tell me what might be causing the update problem?

Logfile of HijackThis v1.99.1
Scan saved at 7:56:12 AM, on 3/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\My Documents\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://loginnet.passport.com/ppsecure/md5auth.srf?lc=1033
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WorkShelf] C:\Program Files\Winstep\WorkShelf.exe autostart
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

0
PlatinumStylzAuthor Commented:
Also I downloaded spybot 1.4 . It wont let me check for errors until I do an update, I try and do an update and this is what I get.

3/22/2006 8:33:33 AM downloaded update Detection rules
3/22/2006 8:33:33 AM  - URL: http://dl.betanews.com/spybot/updates/files/includes.zip
3/22/2006 8:33:33 AM  - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.zip
3/22/2006 8:33:33 AM  - FILE REJECTED because of bad checksum
0
zephyr_hex (Megan)DeveloperCommented:
you can download the spybot definitions separetly.  just run the exe file at the link below and it will ask you for the directory where spybot is installed, and update the defs
http://www.safer-networking.org/en/download/  (download the detection updates file).  if you are having internet problems on the computer, then download this file from another computer and transfer.

here is a link to your analyzed log: http://www.hijackthis.de/logfiles/e2b13ce5310498212ebf6253688f8bff.html
i will look at it and comment on it in a bit...
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
alandemartinoCommented:
I'm glad that I've been of help, although not that much beacuse I don't have an idea about the other problems.

Alan
0
zephyr_hex (Megan)DeveloperCommented:
i would definitely remove the party poker 09 items (2 items)

the other entries look ok.

in addition to spybot, i also recommend a tool called xcleaner.  when you launch it, select all items on the first screen and run it.  if it prompts you to reboot, do NOT.  you want it to complete its scan...  so only reboot after it is completely done scanning.  there are other tools with xcleaner, but if you select all items on the first screen, you dont need to run any of its other options.

also, run these tools (spybot and xcleaner) in safe mode.

xcleaner: http://aboutyourbreakup.com/xcleaner.html  (i know, the url is weird... and so is the website... but the tool really does a good job at spyware removal).

finally, make sure norton is up to date and run a virus scan.  and verify that your IE security settings are at the default level before attempting windows update again.
0
PlatinumStylzAuthor Commented:
Finally I have fixed the problem. The reason my computer wouldnt update and failed on the 'Windows Genuine Advantage' install was because of the permission settings in the local security settings. A review of my wpa.log file alerted me to that.

I would like to request a Moderator close this thread an award the points accordingly, thank you.

alandemartino - 200 points for the Media Player fix
zephyr hex - 300 points. (Even though he never had the right solution to my question, he gave alot of information and help.)

Thank you PlatinumStylz
0
zephyr_hex (Megan)DeveloperCommented:
you can close the thread yourself ;)

when you scroll down the thread to the box that you normally type into to post, you will see a link just above that box called "split points"
select that link
then assign points as you wish.  you will need to select one person as the one who answered the question.  but anyone who has points next to their name will get credit as well.

as a side note... you could alert the Mods that you answered the question yourself and they would refund your points back to you.  to alert the Mods of this, post a request in the Community Support forum.
0
M_IntuitCommented:
On one system I recently serviced, the malwares had set NUMEROUS policies AND settings to prevent Windows Update from running.  They didn't go after the program itself... just set policies and parameters.  The closest they came to going after the program, was to set the service to "disabled".
0
M_IntuitCommented:
They also disabled the firewall among other things...
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows XP

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.