Would try restore before cracking laptop open, also need ide adapter to slave
laptop hd.


http://www.experts-exchange.com/Operating_Systems/Q_20820709.html

To fix this, mount the hard drive...

oops duuuhbull post

Start\Run

"regsvr32 wuapi.dll" (w/o quotes)
Press Ok

Type "regsvr32 wups.dll" (w/o quotes)
Press Ok

This worked

Start\Run

"regsvr32 wuapi.dll" (w/o quotes)
Press Ok

Type "regsvr32 wups.dll" (w/o quotes)
Press Ok

I think the problem is in the registry, dont have this
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate

just up to policies
and other key found
found...

PC is clean now , thanks to Crunchie http://www.daniweb.com/techtalkforums/showthread.php?p=79963&posted=1#post79963

but xp home (legit) still wont update, any ideas?

PHEWWW , all clear thus far. thx again Crunchie, now I gotta figger Y xp wont update :eek: Spreadin the word "Go Daniweb and help your head" :twisted:

ill reboot and run some scannies, 3 tokes for crunchie TOKE! TOKE! TOKE! :cheesy:

qoole took a loooong time for me, but did post C:\log.txt and win.txt

Logfile of HijackThis v1.99.0
Scan saved at 10:09:37 PM, on 12/30/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:...

Just this in regedit and hjt?


O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\system32\qkwokg.exe


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Thank you very much Crunchie, ive learned well from your links and previous posts. Greatly appreciate the enlightenment you spread on all us.


Logfile of HijackThis v1.99.0
Scan saved at 9:32:32...

qoole seems cool now

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE...

No, i didnt want to do anything til sure of solid first step, will switch to that pc and do that now.

was able to delete all , saeuan.dll wouldnt but killed qkwokg.exe with PE and quickly...

so far these gtg, know theres more to it though...help

qkwokg.exe
xqhmqa.exe
fnhpni.exe
Ipczpq.dll
saeuan.dll
xqhmqa.dll

I did delete it once, but killbox makes again when used, i want to try and pick thru some of what logs show and delete on boot with killbox but if ya miss previous logs obsolete..... :( more...

Seems Vx2, coolweb, qoolaid, all tied together, common thread seems to be bargain/rebate/surfbuddy crap. This is definately the worst ive seen in looong time.


Turns out !submit is created by...

takes them awhile , thought same thing letem run , you will know when done

Log rollin
hjt

Logfile of HijackThis v1.99.0
Scan saved at 2:31:10 PM, on 12/30/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running...

Closer but still struggling

qoolelogic log

C:\adl\wnxpdl\Find_qoologic\qoologic


Files Found in system Folder............
------------------------
C:\WINDOWS\system32\ipczpq.dll:...

Process PID CPU Description Company Name
System Idle Process 0 97
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4 1
smss.exe 716 Windows NT Session...

it is intereesting, ive had the laptop on and offline to dl stuff , post logs from.
recently found a "C:\!Submit" folder that appeared empty said not empty when tried to delete. did a kill...

I have tried that, and I cannot find qkwokg.exe anywhere,(all folder view options are set properly) I can usually dig this crap out....On boot using regmon after about 10 minutes qkwokg.exe:620...

out for now, ill post another hjt-last one inaccurate- early a.m.edt dec 30

what should my dll compare settings be? I see it in regmon, filemon but its everywhere and nowhere...

Have you tried this ? from this thread http://www.daniweb.com/techtalkforums/thread13965.html



Re: Can't remove ColdFusion Trojan
I also had this problem, but Dav555 very kindly provided this...

Trying to clean friends hp pavilion ze4400.
After removing most of the nasties can get it to windows update but dies at "looking for latest version" dont think it had been updated (ever...)no fixes...

thx crunchie, im stumpified

Logfile of HijackThis v1.99.0
Scan saved at 1:15:51 PM, on 12/29/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
...

just wondering if vx2, coolweb interfere with xp home updates

try to add\remove all web rebate, 180soltions stuff. would try a diff anti-vir to, then hjt again. http://sarc.com/avcenter/venc/data/adware.180search.html

try safemode hjt and hit these? think i did it b4 tho...

O17 - HKLM\System\CCS\Services\Tcpip\..\{353F53C7-C6B3-4C1A-AAB7-6218F0727122}: NameServer = 151.203.0.85 151.202.0.85
...

This vx2 , coolweb stuff is winning, would appreciate any help. im bout toast and need to get it back to bro. xp home




Logfile of HijackThis v1.99.0
Scan saved at 3:56:53 AM, on 12/28/2004...