Prev: Vista SP2 Not Offered
Next: code 646
From: CJ on 27 Oct 2009 21:50
[Error number: 0x8DDD0018] This is the erro message I am getting after going
through your processes and doing some of the Fix It items. I am also getting
the following messages form your Security Center Alert, but I am unable to
Enable any installation. McAfee tells me when I do click on these to
installenable that they have blocked "Fake Alert-JN".....Messages received
from Security Alert Center:
TrojanWin32.agent.dcc
Net-worm.win32.Dip.net.d
Rootkit.win32.agent.pp
Backdoor.win32.agent.ich
Email-worm.win32.netsky.q
Virus.win32.Hala.a
Backdoor.win32.Kbot.al
Net-worm.win32.Mytob.t
This all started yesterday when some pop up ads saying Microsoft-Yahoo
started showing up with ways to make money from home using Google....I am at
my wits end. Have run McAfee and PC Optimizer more than once, tried to run
your updates to identify and remove but to no avail.
From: PA Bear [MS MVP] on 27 Oct 2009 21:55
You are seeing the effects of a hijackware infection!

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

Microsoft PCSafety provides home users (only) with no-charge support in
dealing with malware infections such as viruses, spyware (including unwanted
software), and adware.
https://support.microsoft.com/oas/default.aspx?&prid=7552&st=1

Otherwise...

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2a. WinXP => Run the Windows Live Safety Center's 'Protection' scan (only!)
in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

2b. Vista or Win7=> Run this scan instead:
http://onecare.live.com/site/en-us/center/whatsnew.htm

3. Run a /thorough/ check for hijackware, including posting requested logs
in an appropriate forum, not here.

Checking for/Help with Hijackware:
• http://aumha.net/viewtopic.php?f=30&t=4075

• http://mvps.org/winhelp2002/unwanted.htm
• http://inetexplorer.mvps.org/tshoot.html
• http://www.mvps.org/sramesh2k/Malware_Defence.htm
• http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

=====================
Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002


CJ wrote:
> [Error number: 0x8DDD0018] This is the erro message I am getting after
> going through your processes and doing some of the Fix It items. I am
> also
> getting the following messages form your Security Center Alert, but I am
> unable to Enable any installation. McAfee tells me when I do click on
> these to installenable that they have blocked "Fake Alert-JN".....Messages
> received from Security Alert Center:
> TrojanWin32.agent.dcc
> Net-worm.win32.Dip.net.d
> Rootkit.win32.agent.pp
> Backdoor.win32.agent.ich
> Email-worm.win32.netsky.q
> Virus.win32.Hala.a
> Backdoor.win32.Kbot.al
> Net-worm.win32.Mytob.t
> This all started yesterday when some pop up ads saying Microsoft-Yahoo
> started showing up with ways to make money from home using Google....I am
> at
> my wits end. Have run McAfee and PC Optimizer more than once, tried to
> run
> your updates to identify and remove but to no avail.

From: Shenan Stanley on 27 Oct 2009 22:17
CJ wrote:
> [Error number: 0x8DDD0018] This is the erro message I am getting
> after going through your processes and doing some of the Fix It
> items. I am also getting the following messages form your Security
> Center Alert, but I am unable to Enable any installation. McAfee
> tells me when I do click on these to installenable that they have
> blocked "Fake Alert-JN".....Messages received from Security Alert
> Center:
> TrojanWin32.agent.dcc
> Net-worm.win32.Dip.net.d
> Rootkit.win32.agent.pp
> Backdoor.win32.agent.ich
> Email-worm.win32.netsky.q
> Virus.win32.Hala.a
> Backdoor.win32.Kbot.al
> Net-worm.win32.Mytob.t
> This all started yesterday when some pop up ads saying
> Microsoft-Yahoo started showing up with ways to make money from
> home using Google....I am at my wits end. Have run McAfee and PC
> Optimizer more than once, tried to run your updates to identify and
> remove but to no avail.

Who is the "your" that you are referring to? This is a peer-to-peer
newsgroup. ;-)

You *might* be able to clean up - but possibly not. How's your personal
file backups?

Start button --> RUN
(no "RUN"? Press the "Windows Key" + R on your keyboard)
--> type in:
winver
--> Click OK.

The picture at the top of the window that opens will give you the general
(Operating System name) while the line starting with the word "version"
will give you the rest of the story. Post _both_ in response to this
message verbatim. ;-)

Assuming you have Windows XP 32-bit with SPor above...

Download/install this:
http://support.microsoft.com/kb/290301

After installing, do the following:

Start button --> RUN --> type in:
"%ProgramFiles%\Windows Installer Clean Up\msizap.exe" g!
--> Click OK.
(The quotation marks and percentage signs and spacing should be exact.)

Download, install, run, update and perform a full scan (separately) with the
following two applications (freeware versions are the ones to use for this):

SuperAntiSpyware
http://www.superantispyware.com/

MalwareBytes
http://www.malwarebytes.com/

After performing a full scan with one and then the other and removing
whatever they both find completely, you may uninstall these products,
if you wish.

Download and run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

Reboot.

Download/Install the latest Windows Installer (for your OS):
( Windows XP 32-bit : WindowsXP-KB942288-v3-x86.exe )
http://www.microsoft.com/downloadS/details.aspx?familyid=5A58B56F-60B6-4412-95B9-54D056D6F9F4&displaylang=en

Reboot.

and...

Download the latest version of the Windows Update agent from here (x86):
http://go.microsoft.com/fwlink/?LinkID=91237
.... and save it to the root of your C:\ drive. After saving it to the root
of the C:\ drive, do the following:

Close all Internet Explorer windows and other applications.

Start button --> RUN and type in:
%SystemDrive%\windowsupdateagent30-x86.exe /WUFORCE
--> Click OK.

(If asked, select "Run.) --> Click on NEXT --> Select "I agree" and click on
NEXT --> When it finishes installing, click on "Finish"...

Reboot.

Then follow the instructions here:

How do I reset Windows Update components?
http://support.microsoft.com/kb/971058

Reboot.

CHKDSK
How to scan your disks for errors
http://support.microsoft.com/kb/315265
* will take time and a reboot

Defragment
How to Defragment your hard drives
http://support.microsoft.com/kb/314848
* will take time

Reboot.

Log on as an user with administrative rights and open Internet Explorer
and visit http://windowsupdate.microsoft.com/ and select to do a
CUSTOM scan...

Every time you are about to click on something while at these web pages -
first press and hold down the CTRL key while you click on it. You can
release the CTRL key after clicking each time.

Once the scan is done, select just _ONE_ of the high priority updates
(deselect any others) and install it.

Reboot again.

If it did work - try the web page again - selecting no more than 3-5 at a
time. Rebooting as needed.

The Optional Software updates are generally safe - although I recommend
against the "Windows Search" one and any of the "Office Live" ones or
"Windows Live" ones for now. I would completely avoid the
Optional Hardware updates. Also - I do not see any urgent need to install
Internet Explorer 8 at this time.

Seriously - do all that. This is like antibiotics - don't skip a single
step, don't quit because you think things will be okay now - go through
until the end, until you have done everything given in the order given. If
you have a problem with a step come ask and let someone here get you
through that step. If you don't understand how to do a step, come back and
ask here about that step and let someone walk you through it.

Then - when done - let everyone here know if it worked for you - or if you
have more issues.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html


From: Ǝиçεl on 27 Oct 2009 23:03
Hi Cj,

First - ensure you do not have "Vundo".

It seems possible that your Windows installation has been deliberately
damaged by a trojan (Vundo, along any uninvited guests. (SDBot and ZLOB, all
protected by a rootkit.)) so as to prevent you updating your system or
removing the trojan.

Your first priority must be to cleanse your PC of all malware.

A very good antimalware app is SUPERAntiSpyware and Malwarebytes
Anti-Malware.

There is a free version (on demand scanning only)
<http://www.superantispyware.com/>
Reboot
-=-

Try running Malwarebytes Anti-Malware... download, update, and perform a
full system scan:
<http://www.malwarebytes.org/mbam.php>
Reboot
-=-


The 0x8ddd0018 error code typically occurs because of a BITS error.
http://www.updatexp.com/0x8ddd0018.html


1058
ERROR_SERVICE_DISABLED
The service cannot be started. If BITS service is disabled by the
Administrator, or because it has no enabled devices associated with it.
ERROR_SERVICE_DISABLED then this error will be seen.
BITS has been disabled. Enable the BITS service.


You may receive an error message that contains the "0x8DDD0018" code or the
"0x80246008" code when you try to download updates from the Microsoft Windows
Update Web site or from the Microsoft Update Web site
<http://support.microsoft.com/?kbid=910337>
-=-



Copied яesponse from Robert Aldwinckle -

Robert Aldwinckle 11/19/2008 9:48 PM PST


Try searching for: 0x8ddd0018
or
Searching for: 0x8ddd0018 MVP

E.g. using the web interface that you are posting from press Alt-7 and enter
those words.

In this particular case there have been so many satisfied participants who
also use the web interface that you can even use the Answered Questions
filter to reduce the number of messages you have to read through.
E.g. press Alt-i Enter CursorDown, CursorDown, Enter after your search
returns results.

Notice though that normally you will not be able to use the filters
successfully even though there are relevant useful posts to be found.
Unfortunately, not enough users of the web interface bother to come back and
mark posts that they find helpful... ; }


Good luck


Let us know what hªppens.

Ǝиçεl


"CJ" wrote:

> [Error number: 0x8DDD0018] This is the erro message I am getting after going
> through your processes and doing some of the Fix It items. I am also getting
> the following messages form your Security Center Alert, but I am unable to
> Enable any installation. McAfee tells me when I do click on these to
> installenable that they have blocked "Fake Alert-JN".....Messages received
> from Security Alert Center:
> TrojanWin32.agent.dcc
> Net-worm.win32.Dip.net.d
> Rootkit.win32.agent.pp
> Backdoor.win32.agent.ich
> Email-worm.win32.netsky.q
> Virus.win32.Hala.a
> Backdoor.win32.Kbot.al
> Net-worm.win32.Mytob.t
> This all started yesterday when some pop up ads saying Microsoft-Yahoo
> started showing up with ways to make money from home using Google....I am at
> my wits end. Have run McAfee and PC Optimizer more than once, tried to run
> your updates to identify and remove but to no avail.
From: richrad on 28 Oct 2009 12:50
I mean I'm having the same problem of not being able to install the recent
security updates. I'm not an expert, sorry.
It's KB974455, Error Code: 0x800F0102
All I've tried is letting the automatic updates do it and doing it through
the microsoft website (which led me here).


> Seriously?
>
> How do you know you two are having the same problem?
>
> There have been no details given.
>
> At least you gave *one* more detail - albeit not the most important one.
>
> Throw out the KB###### of the update giving the issue and what you have
> tried, please.
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
> .
>
 |  Next  |  Last
Pages: 1 2
Prev: Vista SP2 Not Offered
Next: code 646