Impossible to do Windows Update !! 1

[WhiteTornado]

Hi,

I am unable to find anything related to this on the net so far, I have installed Windows 2000 to this computer, I have installed AVG Anti Virus, updates are done. When I first installed the computer, I install most of the Windows updates. Now when go back to the MS Update site, I get as if I get hacked, or a virus takes over, my mouse goes crazy and goes out of my control and it seems as if it is erasing the window. I have to reboot to get out of there. This occured when i first install the system, I had then Norton and AVG both installed and updated and they could not find anything on my computer, I had AdAware and Spy bot do a scan and nothing could be found either. Everything else seems ok, programs worked and all, just when I would try to go to the updates site would I get this crap.

Now it is doing it again. When it first happened, i tried a few thinfgs, i went to the Internet options and disable java and active-x (in the security tab) with no change.

I used Highjacked this and I got this as the result of the scan:
Logfile of HijackThis v1.94.0
Scan saved at 1:36:50 PM, on 28/09/2003
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=

http://www.google.ca/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINNT\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKCU\..\Run: [internat.exe] internat.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -

http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37891.5792361111

I do not see anything in there that could lead to a clue.

I am not sure what to look for in this computer to resolve this problem, does anyone has a clue ? I have an other comp with Win XP on the NW and there is no such issue with it, all my comps are on an SMC Barricade router.

Cheers!

 

[linney]

The file Internat.exe is a genuine Windows file, I think used in multi language set up. It is also a known trojan so it might be worth checking out.

http://www.experts-exchange.com/Applications/Viruses/Q_20678065.html

For the Windows Update site to work you must have ActiveX functioning.

Try this url and download any updates you require, save them to disk, then install them.

http://v4.windowsupdate.microsoft.com/catalog/en/default.asp

Click on Find updates for Microsoft Windows operating systems and select your operating system.

http://v4.windowsupdate.microsoft.com/troubleshoot

Perhaps you may have better luck in the 2000 forum.

 

[WhiteTornado]

Thanks for these links, these will definitely help me from nom on - as to my problem, imagine that someone suggested it was my video card, hard to beleive, but I changed it since and I am now testing the comp, might be the problem.

cheers!

 

[bcastner]

I think you have a variant of the Alexa virus.

The next time you have the mouse jumping around, hit Ctrl-Alt-Del and see if wowexec and/or smss are taking a lot of cpu cycles.

If so you have the virus. Most AV programs will miss this one. Try several from smah's FAQ: faq760-3862

Panda and Trend Micro to start. Or Google for Alexa virus.

 

[FredUG]

Adaware (freeware) will also detect and remove Alexa.

 

[WhiteTornado]

Hi,
Ok, thanks, I actually had reformated the drive, now I changed the video card and I am not having these problems, maybe I should put the other one back so I can verify the hypothesis, but I keep what you said in mind - I did use SpyBot and ran it a few times thinking it might show me something interesting, but not really.

Cheers!

 

[carrr]

Alexa virus? Do you mean the spyware/adware/add-on tool (depending on interpretation) from Amazon?

 

[WhiteTornado]

Hi, yes I beleive this is what he meant - I know one time I was using that and I was able to detect a couple viruses on the system, AdAware was not able to remove the entire thing but it help greatly at nailing it.

Cheers!

 

[bcastner]

Do two of Forum member smah's list of on-line scans. I would pick Trend Micro and Panda: faq760-3862