Help needed On monder trojan

Hi Dan
Here's the kaspersky log . I've noticed i cant update windows even tho auto updates are shown as on ,it wont update .Keeps saying i have to turn updates on .

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, July 7, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, July 07, 2008 18:11:57
Records in database: 922161
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\

Scan statistics:
Files scanned: 86527
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 00:41:21

No malware has been detected. The scan area is clean.

The selected area was scanned.

Don't think i've defragged for at least 6 month

Can you defrag your drives, while i look into your updates.
let me know when done.

Morning Dan ,
Have done as requested and defragged drives. So far every thing seems OK .Just the issue with the windows updating shows it be on but windows keep saying i need to turn on to update .When i click on it to change status nothing happens. Before i knew i had been infected the windows updating kept turning it self off after every boot up ,even tho i kept turning it back on . Could this be connected to my Trojan problem ?

Dan have just done search regarding Windows update ,it seems you now have to add the update sites into your trusted zone to get it to work .I will let you know how i get on .

Adding sites to your trusted zone,it offers no more benefits having it there than out of it. The Trusted Zone has the lowest security and allows scripts and applications from sites in this zone to run freely, and have unfettered access, so as such it is my recommendation that you would not add any website to the trusted zone.

As your having problems with the updates,
Go here and under Run the Windows Validation Assistant*, click on Validate Now.
Copy & paste the full validation message you get into your next reply..
* You will need to use Internet Explorer.
and we will take it from there.
dan

Hi dan
Here's the validation

Thank you for completing the validation process and for using genuine Microsoft software.

By using genuine Microsoft software, you can be confident that you will have access to the latest features, security, and support, which will help to improve your productivity and expand the capabilities of your computer.

You will also have access to new innovations and offerings available only to genuine Microsoft software customers.

The report is normally longer than that have you copied it all?

Hi Dan
Thats all that comes up on the windows page !

Ok,let's try something.
There's a tool that's proved effective in restoring all necessary settings, permissions, and files to repair Windows Update issues.

Dial-a-fix

Download it to your Desktop and unzip it.

Next, open the program.

When you first open it, click the Flush Software Distribtution button. Then put a check mark next to these Options:

Under Prep - Empty temp folders
Under WU/WUAU - Stop services, Register WUAU dlls, Start services
Under SSL/HTTPS Cryptography - All
Under Registration center - All

Then click the GO button.
Next, click the Tools button.

Run these by clicking on each one, then clicking the GO button:

Flush DNS
Repair permissions
Reset WMI/WBEM/WinMgmt

Reboot and try Windows Updates or Microsoft Updates again.[/quote]

I hope this helps.
dan

Hi Dan
Still no joy on the updates, might have to just leave it for the moment !

Please go to Start - Run - type in eventvwr.msc to open the event viewer. Look under both "application" and "system" for recent (the last 48 hours or so) errors shown in red and if found, do this for each one.

Double-click the error to open it up and then click on the icon that looks like two pieces of paper. This will copy the full error. Then "paste" the error into Notepad. Do this for each one until you have them all listed in Notepad and then copy and paste the list in a reply here please.

Morning Dan
Heres what you requested !

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 08/07/2008
Time: 06:41:45
User: N/A
Computer: YOUR-0CDC4F5844
Description:
Faulting application acrord32.exe, version 8.1.0.137, faulting module kernel32.dll, version 5.1.2600.5512, fault address 0x00012aeb.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 61 63 72 ure acr
0018: 6f 72 64 33 32 2e 65 78 ord32.ex
0020: 65 20 38 2e 31 2e 30 2e e 8.1.0.
0028: 31 33 37 20 69 6e 20 6b 137 in k
0030: 65 72 6e 65 6c 33 32 2e ernel32.
0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
0040: 32 36 30 30 2e 35 35 31 2600.551
0048: 32 20 61 74 20 6f 66 66 2 at off
0050: 73 65 74 20 30 30 30 31 set 0001
0058: 32 61 65 62 0d 0a 2aeb..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 07/07/2008
Time: 16:41:32
User: N/A
Computer: YOUR-0CDC4F5844
Description:
Faulting application acrord32.exe, version 8.1.0.137, faulting module acrord32.dll, version 8.1.2.86, fault address 0x0051289d.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 61 63 72 ure acr
0018: 6f 72 64 33 32 2e 65 78 ord32.ex
0020: 65 20 38 2e 31 2e 30 2e e 8.1.0.
0028: 31 33 37 20 69 6e 20 61 137 in a
0030: 63 72 6f 72 64 33 32 2e crord32.
0038: 64 6c 6c 20 38 2e 31 2e dll 8.1.
0040: 32 2e 38 36 20 61 74 20 2.86 at
0048: 6f 66 66 73 65 74 20 30 offset 0
0050: 30 35 31 32 38 39 64 0d 051289d.
0058: 0a .
Event Type: Error
Event Source: MsiInstaller
Event Category: None
Event ID: 10005
Date: 21/06/2008
Time: 11:57:00
User: YOUR-0CDC4F5844\James
Computer: YOUR-0CDC4F5844

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 09/07/2008
Time: 07:17:27
User: N/A
Computer: YOUR-0CDC4F5844
Description:
The Windows Media Player Network Sharing Service service depends on the Universal Plug and Play Device Host service which failed to start because of the following error:
%%0

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 09/07/2008
Time: 07:17:27
User: N/A
Computer: YOUR-0CDC4F5844
Description:
The Media Center Extender Service service terminated with service-specific error 2147500037 (0x80004005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 3095
Date: 09/07/2008
Time: 07:17:25
User: N/A
Computer: YOUR-0CDC4F5844
Description:
This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 09/07/2008
Time: 06:58:09
User: N/A
Computer: YOUR-0CDC4F5844
Description:
The Windows Media Player Network Sharing Service service depends on the Universal Plug and Play Device Host service which failed to start because of the following error:
%%0

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 09/07/2008
Time: 06:58:09
User: N/A
Computer: YOUR-0CDC4F5844
Description:
The Media Center Extender Service service terminated with service-specific error 2147500037 (0x80004005).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 3095
Date: 09/07/2008
Time: 06:58:05
User: N/A
Computer: YOUR-0CDC4F5844
Description:
This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 08/07/2008
Time: 21:58:51
User: N/A
Computer: YOUR-0CDC4F5844
Description:
The Windows Media Player Network Sharing Service service depends on the Universal Plug and Play Device Host service which failed to start because of the following error:
%%0

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 3095
Date: 08/07/2008
Time: 21:58:46
User: N/A
Computer: YOUR-0CDC4F5844
Description:
This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Hi Dan
Think i've sorted update issue's .Think it's some setting on my Kaspersky thats stopping the update .When i turned it briefly off i got an update from windows .I will have a look see what its stopping .

"C:\WINDOWS\system32\wuauclt.exe. "
If i allow this it updates !!