XP can't download Updates

[Kelemvor]

Not sure if this is virus related or a corrupted file or what but here's the problem.

My neighbor has Windows XP on their PC. THey've been having problems lately so I went to take a look at it. Web browsing was sluggish so I dumped the cache (which took like 5 minutes) and that helped.

Went to Windows Update and it had almost 40 critical updates to download. Yikes. Attempted to download them and what happens is we get as far as the window where it starts to download, and it hangs forever. Never gets that far.

So, went to Microsoft.com to download IE6 SP1 (they had 6 with no SP), ran the setup, got to the point where it downloads the 12 megs of info, and again, it hangs forever.

So, I installed Spybot to get rid of lots of the crap on the PC. Spybot runs fine but when I try to download updates, well guess what, it hangs forever and eventually fails to download the updates.

Most things work except when they seems to involve downloading updates or installers.

Any idea what the heck would be causing this?

ALSO, when the pC boots up they get 2 errors. One is that MMTASK.EXE can't run beacuse MMVCP70.DLL is missing. Turns out this is a musicmatch thing so I'm not worried about it. But, they also get a pop up thatthere's a problem with TFTP2576 and what should it do. It looks like this is a problem with a security risk in Windows, but the Microsoft Knowledge base is down right nwo so I can't verify that.

Any suggestions would be great.

Thanks!

 

[Davegod]

google'ing TFTP2576 came up with stuff to do with the blaster worm, e.g. http://www.abacusinfo.com/news/security_alerts.htm


8/11/2003

MS Blast Worm

W32.Blaster.Worm (Symantec),W32/Lovsan.worm (McAfee), WORM_MSBLAST.A (Trend Micro),Win32.Posa.Worm (CA),Lovsan (F-secure), MSBLASTER,Win32.Poza

Security Level - Critical

A new internet worm named "MS Blast" is on the loose. This worm takes advantage of an exploit in the MS RPC DCOM subsystems on all Windows 2000 and Windows XP operating systems. The exploit is documented in Microsoft Security Bulletin MS03-026 "Buffer Overrun in RPC Interface Could Allow Code Execution".

Abacus recommends that TCP port 135 and UDP port 135 should be blocked on all perimeter networks as well as on all personal firewalls. Additionally, TCP port 593 and all outbound requests to port 69 should be blocked as well to prevent infection.

If you suspect infection, please check for the existence of registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run with a value of 'msblast.exe'. If this exists, delete the value as well as the file. The value 'msblast.exe' may also exist in a key named 'windows auto update'.

There may also be a file named 'TFTP2576' in the System32 directory.

Microsoft has posted updates to correct the vulnerability.


norton have a removal tool

 

[Kelemvor]

Unfortunately Microsoft is having website problems so I can't get there to get any updates. And when I try to use Windows Update, it fails to downlaod the updates which kind of puts me in an endless loop.

hmmm.

 

[Davegod]

try the norton tool i just edited in

btw it isnt MS having website problems, its fine for me. same result though.

 

[Kelemvor]

I guess a lot of people are having trouble getting to certain MS sites. Must be a regional thing.

The norton tool didn't find anything so I'm not sure if they have the worm or maybe have part of the leftovers from it or what. They are doing a full virus scan now so we'll see if that helps.

Is there anywhere to download updates for Windows other than through WIndowsUpdate? Since they can't get that to work, they can't get the updates. But if there was a direct link to a downloadable update, that would work and they could run it locally.

Just a thought.

WOuld doing a restore back to a previous point with the built in XP thing work in thie case or not?