Very strange: Windows update problem

[Jerricho]

Some wierd stuff is going on with my laptop.

I though that I hadn't seen an update come through for a while and tried to manually check (I'm running XP Home edition)

On clicking the icon, the Explorer window opens and give me the good old "HTTP 404 Not Found Error". I have tripple checked the address it's trying to access (http://windowsupdate.microsoft.com/), and still get the same thing.

I have tried going the long way through microsoft.com.......nope, no luck. Funny thing is I can't seem to access symantec.com either.

I know Microsofton can get a little funny about Mozilla Firefox and all, which I do use instead on Explorer, but I have tried it with both and still no luck.

Any thoughts?

[BlueEagle]

Just got in from Oz, no probs. Could it be that you access a different server over there and that it is down?

[Pablo Martin]

Fairly sure its only some encrypted pages that have problems with firefox and as far as I am aware microsoft isnt encrypted!

That is a bit random, although i know that sometimes my symantec update goes a bit funny and I have to prod it into action but microsoft updates are normally gd.

Know any1 else in the land of OZ that is connected to the internet and if so, try it on theirs maybe???????

Gd luck

PM

[Jerricho]

It's been 2 days now since I first started.

All very strange.

[maxell]

is your date/time set correct also country

[Jerricho]

Max, that had crossed my mind, but have checked it and is correct.

[Irish Steve]

Might be worth running a hijack check. There was a DNS stealth attack a few days ago that misdirected all sorts of things to places they'd be better avoiding, and if I recall correctly Microsoft Update and Symantec were both targets of that one.

I can't recall exactly how it was resolved.

Are you on broadband or Dial up. I had a case a few weeks ago at home here where broadband stopped accessing some sites, and the only answer I came up with was to power the local connection box off and force it to reload, once it did that, everything came back clean,

[SoftTop]

the link I use has V5 at the front i.e. http://v5.windowsupdate.microsoft.com try that one using IE and NOT Firefox. I know that Firefox doesn't respond well to the MS site.

The other way is to access it via the main MS Home page and follow the links.

If still unable to connect, the old HJT! route seems best bet.

Good luck

ST

[Jerricho]

Right, could one of you really nice people out there have a look at my HijackThis log for me please, please, please.

Logfile of HijackThis v1.99.1
Scan saved at 9:32:50 AM, on 16/03/2005
Platform: Windows XP SP1 WinNT 5.01.2600
MSIE: Internet Explorer v6.00 SP1 6.00.2800.1106

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\****\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=Q304&bd=pavilion&pf=lapt op
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com...ll/xscan60.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{870B1EA9-786B-463C-866B-CE743403B479}: NameServer = 142.161.2.155 142.161.130.155
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR1\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR1\RpcSandraSrv.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe

[Flypro]

I have recently had a similar problem downloading Windows Updates (for M.E.)
I eventually found the reason to be the fact that I was using AVANT as my browser. Using MS Internet Explorer instead of Avant solved the problem immediately!!!

[Jerricho]

FP, I have kept Explorer on my maching simply for that sort of thing.

Still now working

[zoink]

Jerricho

You could try clearing all temp files and internet explorer cache on the machine using something like Windows Washer..
http://www.pcworld.com/downloads/fil...id,6136,00.asp
It could be a caching issue..

Can you ping windowsupdate.com?

[Jerricho]

Hi Zoink,

I can ping the site.

I use Crap Cleaner on a regular basis, but also gave Window washer a go. Still no luck .

[zoink]

So you can ping it.. but the page comes up as a 404 Not Found..



What about this URL?

http://v5.windowsupdate.microsoft.co....aspx?ln=en-us

[SoftTop]

Jerricho,

haven't got time (tonight) to look in detail at the log, but you can safely get rid of the R0 entries.

You can also get rid of the 2 BHO ones with "no file" against them.

I'll have a look at the rest tomorrow when I get a chance.

I can't see anything that leaps out at me as being "bad", but that doean't mean there isn't anything there.

I'm pretty certain that there's nothing in the log that would stop you from loading the windowsupdate front page if you used IE.

ST

[Jerricho]

Thanks SoftTop, I really appreciate it

[BlueEagle]

Just remembered, I had a similar problem with certain web sites but not others, no warnings just wouldn't access the site.
The solution was session cookies, which the site will maintain are "harmless"!

Problem cured by going as follows in IE6:

Tools>Internet Option>Privacy>Sites then type in to the box www.microsoft.com and click on 'Allow'

Worth a try, when this happened to me it was on sites I had no previous problem with.

[Jerricho]

BE, I've just given that a go, and unfortunately still no joy.

*Jerricho kicks his laptop*

[Stoney X]

Jerricho, have you tried all the steps on this page?

Regards
Stoney

[Jerricho]

Guess what Stoney.

THAT page gives a HTTP 404 error as well.

*sigh*