Applies To:

Had this question 1

Question

Cannot install KB2572067 and KB892130

Ηello,

I have a windows XP home sp3 laptop, with Kaspersky security suite. Strong intrusion problems with trojans and so on, since 98 and with all other 3 systems I changed till now. I used ZAP, NIS, NOD32 in the past but they did not discover trojans, for instance now I scan with a 2010 security suite my desktop which I disconnected from the net permanently in 2009. At the time could not find what is wrong with it (lots of problems) although I had NOD32 antivirus and ZAP firewall, also an antimalware. Now I scanned and found kuang2 in a .dll file (system volume information folder).

In my actual surfing system (laptop) I have the windows update automate function on and recently something wrong happens with them.

Often cannot log in my limited account (the one I usually surf with) and have a window saying "windows cannot find this account profile and will connect you with a temporary account" or sort of. I log out through the power button and when I open my laptop again, I can log in my limited account normally. Today though this could not happen no matter how many times I tried.

I logged in my admin account (it took ages) and saw there was a pendant security update for KB2572067 which I tried to install but the answer was failure.

I performed system restore in a couple of days ago and logged in my limited account, then I tried to perform windows update manually through run as function (it needs admin rights) so to see if I'll be able to install above update.

Windows update asked me to install KB892130 so that to use it and again the result was failure.

Recently I tried to scan rebooting in a linux antivirus software for viruses, trojans etc but the screen frosed.

It's typical, same thing was happening in the past whenever I tried to scan with something else except for the installed security software which never discovered anything, by the way.

I see updates to be ready for installation each and every time I close my laptop it asks "do you want to install, or close without installing?" and I install them, but did not search in add/remove programs to see in detail what I'm installing.

Also in system restore past month is full of restore points (each day one or almost, mentionning software distribution 3.0, or sort of.)

So, apart the trojan problem which more or less I'm almost fully disappointed about, regarding the windows updates which it seems I cannot install manually, should I check each and every update I have in add/remove programs with microsoft's monthly papers? Or what?

Tks a lot fr any answer and wish you all a happy new year 2012

Found this helpful 0

Answer

PA Bear MS MVP replied on

MVP Community Star

1. [MSHTML.DLL version] 8.0.6001.18812

Your computer is missing at least three years of Cumulative Security Updates for Internet Explorer 8. This indicates of a longstanding & ongoing hijackware infection, possibly compounded by a W32/Alureon-variant rootkit (or even a bootkit) infection. See...

• Cleaning a Compromised System
http://technet.microsoft.com/en-us/library/cc700813.aspx

Follow the instructions in this post of mine in another forum (to-the-letter & in order! ) to return your computer to a secure & functional state: http://aumha.net/viewtopic.php?f=62&t=44636

If you need additional assistance with the clean install, please begin a new thread in this forum: http://answers.microsoft.com/en-us/windows/forum/windows_xp-system

Note: The computer should NOT be connected to the internet or any local networks (i.e., other computers) in its current state. All of your personal data (e.g., online banking & credit-card passwords) should be considered at-risk, if not already compromised.

Wish I'd had better news for you. Good luck!

~Robear Dyer (PA Bear)
MS MVP-Windows Client (IE, Mail, Security & Update Services) since 2002

All Replies (14)

Found this helpful 0

PA Bear MS MVP replied on

MVP Community Star

Assuming you do NOT reside in the USA, start here: http://supportservices.microsoft.com/support/services/virus_malware_removal

~Robear Dyer (PA Bear)
MS MVP-Windows Client (IE, Mail, Security & Update Services) since 2002

Found this helpful 0

Vassiliki Stavropoulou replied on

I do not reside in the States indeed. I followed yr link and here's what I got: So now what I must do? Never mind, in the past several times I got helpful answers in international microsoft forums, that's why I prefer them to the local ones. I usually start by asking my question somewehere and then usually I find the answer finally...

Tks again

P.S.: As a matter of fact I do remember you having answered to me in the past again!

Sorry,this site restricted to US visitors only

Dear Answer Desk visitor

We believe that your IP address may be from outside the United States. If you think we have incorrectly detected from where you are visiting, please proceed. In order to make purchases, your address will need to reside within the United States.
If you are outside the United States, we welcome you to visit any of the online resources listed below to help you with your Microsoft product questions.

Microsoft Answers:
Microsoft Solution Centers:
Microsoft Fixit Center:

Currently, we are working to expand our service internationally to best support all Microsoft customers.

Sincerely,
Microsoft Answer Desk Team.

Found this helpful 0

PA Bear MS MVP replied on

MVP Community Star

Sorry about that.

FYI here's a little background:

Microsoft introduced no-charge, third-party support for Malware Removal and Windows Update-related problems c. May 2011 via the supportservices.microsoft.com website.

In early December 2011 (the 7th IIRC), Microsoft very quietly rolled-out Answer Desk Premium (as in paid) Support via the www.answerdesk.com website. At its debut, the site could only be reached by US residents; all others were redirected to the original supportservices.microsoft.com website for no-charge support.

Apparently, Microsoft has since "pulled the plug" on the supportservices.microsoft.com website offerings and those attempting to access the site are redirected to www.answerdesk.com.

Moving on...

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please answer all of the following diagnostic questions in a numbered list in your very next reply (no need to quote this post):

1a. When (exact data, preferably) did you install the Kaspersky suite and when (exact date, preferably) does your current subscription expire?

1b. Are the Kaspersky suite's definitions current?

2. What anti-virus application was installed before you installed the Kaspersky suite, was your subscription still current, and did you uninstall it before you installed the Kaspersky suite?

3a. Had your Norton Internet Security subscription already expired by the time you replaced it?

3b. Did you (a) uninstall the Norton application AND THEN (b) download/run the Norton Removal Tool [1] & reboot (c) BEFORE you installed the replacement application?

4. Had your NOD32 subscription already expired by the time you replaced it?

5. When (exact date, preferably) does your ZoneAlarm Pro subscription expire?

6. Did a Norton free-trial or a McAfee free-trial [pick one] come preinstalled on the WinXP computer when you bought it? (Doesn't matter if you never used or Activated it.)

7. Open Add/Remove Programs & make sure the Show Updates box at the top is checked (and leave it checked); then select the Name option in the Sort by box on the right. Now scroll down & tell me which, if any, of the following updates ARE listed?

• KB2656353, KB2618444, KB2633171, KB2639417, KB2620712, KB2619339, KB2624667, KB2618451; KB2641690, KB2544521 & KB971029

Most will be displayed as Security Update for Windows XP followed by the KB number in parentheses.

If IE8 is installed, two will be displayed as Security Update for Windows Internet Explorer 8 followed by the KB number in parentheses.

8. Is Firefox, Chrome or any other alternate browser installed?

9. Are you in the habit of using "Registry cleaners" (e.g., Registry Mechanic; System Mechanic; RegCure; RegClean Pro; Advanced SystemCare; AVG PC TuneUp; Norton Registry Cleaner; PCTools Optimiser; SpeedUpMyPC; CCleaner)?

==================================================================
[1] ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe

~Robear Dyer (PA Bear)
MS MVP-Windows Client (IE, Mail, Security & Update Services) since 2002

Found this helpful 0

Vassiliki Stavropoulou replied on

My Kaspersky suite expires after 169 days. It is one year license, so it has been installed 196 days ago (cannot calculate exact date).

Its definitions are current, but: often it shows "databases destroyed" and I must update them, afterwards it shows "protected". This happens primarily when and if I perform system restore, I can understand that, but also in the middle of my surfing without any apparent reason. From its initial installing cannot use the sandbox at all.

Before that I had NIS, and yes its subscription was still current when I uninstalled, VERY tired of the fact it was stopping me from performing system restore which is an important help to me when facing internet threats.

Yes, I uninstalled NIS, then ran the Norton removal tool and then rebooted before to install Kaspersky.

NOD32 was installed in my previous system the desktop where I discovered now kuang2, and it is off the net 2,5 years now. I never uninstalled it, it's still there.

ZAP was also in same system, did not uninstall it, still there, but it's a system I do not use as I said to surf any more.

They both expired I guess, am pretty sure about it, did not check exact expirement date.

This older desktop had no security suite nor antivirus pre-installed when I bought it, but the laptop I'm using now (with Kaspersky actually) had pre-installed Norton when I bought it.

KB2633171 was installed on 19/12/11

KB2639417 on 23/12/11

KB2620712 on 19/12/11

KB2619339 on 19/12/11

KB2624667 on 20/12/11

KB2618451 on 19/12/11

KB2641690 on 13/11/11

KB971029 on 26/2/11

KB971961 and KB981332 are the only IE8 updates showing there.

KB2656353, KB2618444 are not installed I doublechecked my add/remove programs.

I installed Chrome after my Firefox crashed last spring, but it was unstable and my Kaspersky that I installed after that, found vulnerabilities to it, so I uninstalled it permanently and installed Safari, blessing Jobs for giving me this secure alternative.

My Firefox immediately when I updated it to Firefox 8, stopped functioning, could not open it, delete it, uninstall it, correct it, nothing. I suspected it was due to my ZA (free version), then installed to my system together with NAV, cause they referred in their site ZA was not compatible to Firefox 8, as they delayed to correct this, I uninstalled ZA, NAV and installed NIS but never got back my Firefox. I also have no Adobe reader, it stopped functioning, twice, I uninstalled and downloaded again once, the second time, cannot do it any more.

Never had used registry cleaners up to now.

Resume: my desktop off the net 2.5 years now, had NOD32 antivirus and ZAP on it, lots of severe problems due to trojans, of which remote shut down was the slightest one, at the time could not find anything at all, now I scanned with gdata 2010 and found kuang2.

My laptop with which I surf since I disconnected the desktop, initially bought with trial version of NAV, I used it with ZA free version, then NIS, and finally Kaspersky suite. Lots of problems due to trojans as It shows, cannot find anything up to now.

Tks for consulting me

Found this helpful 0

PA Bear MS MVP replied on

MVP Community Star

Note: In this thread, we're only dealing with the WinXP computer on which the Kaspersky suite is currently installed and where Norton Internet Security had been installed. Your references to other computers have been confusing the **** out of me so far! <wink> So please stop referring to ANY of your other computers (unless I ask about them). Thanks.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Again, please answer all of the following diagnostic questions by number (i.e., in a numbered list preferably) in your very next reply (no need to quote this post):

1. Your Norton Internet Security (NIS) subscription had NOT already expired by the time you replaced it with the Kaspersky suite five or six months ago (i.e., April or May 2011), is that correct? [YES/NO]

2. Did a Norton free-trial or a McAfee free-trial [pick one] come preinstalled on the WinXP computer-in-question when you bought it? (Doesn't matter if you never used or Activated it.) [YES/NO]

3a. Is IE8 working OK as far as you can tell? [YES/NO]

3b. Can you open IE8 (only!) to http://windowsupdate.microsoft.com and then run a CUSTOM scan? [YES/NO]

4. When you click on a link on your desktop or in an email message, does the link open in IE8 or Safari?

5. Please confirm that none of the following updates are listed in Add/Remove Programs:

• Security Update for Windows Internet Explorer 8 (KB2618444)

• Security Update for Windows Internet Explorer 8 (KB2497640)

• Security Update for Windows Internet Explorer 8 (KB2482017)

6. Have you ever had occasion to do a Repair Install or a clean install of WinXP for any reason?

7. You have never, EVER used a registry cleaner, not even the Norton Registry Cleaner that was included in Norton Internet Security, is that correct? [YES/NO]

8. Using the computer-in-question, can you access data on any other computer in your home? [YES/NO]

~Robear Dyer (PA Bear)
MS MVP-Windows Client (IE, Mail, Security & Update Services) since 2002

Found this helpful 0

Vassiliki Stavropoulou replied on

1.YES (it had not expired).

2.YES (Norton free trial).

3a.NO.

3b.Never use IE. I tried so now, it said "IE explorer had a problem and must shut down" and then "Drwatson32.exe had a problem and must shut down", had the option to send to microsoft report or not about those two problems, then IE did not shut down,, it simply takes ages as usual until to get to the initial page, so I quit.

4.Last week I made IE again default browser don't remember why and desperate with everything, since I know how to undo it. I cannot find a link on my desktop to try it now.

5.No, they are not.

6.Never tried repair install or clean install windows.

7.No, as far as I can remember.

8.Other computers are not connected with this one with any net, neither are they connected to the internet. I can only access them by opening them.

IE still trying to open.

There is another thing, KB2639417 seemed to provoke the erasing of all settings of my limited account (screen image, documents and desktop documents). I performed three times system restore after having installed this, found all lost data and then surfed normally, the update was installed again and again the limited account appeared without its documents and settings. But it was only "seeming", as as soon as I saved the data in a usb stick and could easily download them to the "new" limited account, this stopped.

Then again today, after having saved a dozen of fresh documents on my desktop, other windows updates were downloaded and the limited account appeared again without its settings and documents. I performed again system restore, first time I could not log in my regular limited account at all ("windows cannot find this profile and will connect you to a temporary one") and the second time I logged in alright, the old account was intact.

In the past I often had the impression that hackers are acting as if their actions results should be due to regular handling of my pc by me, that is they are pretending as if problems are due to other reasons but them. Even if I cannot find or erase their malware, if I find ways to "prove" this is not true, they stop doing the specific thing. So now it is easy for me to download all data to the new limited account (even the screen image if it is available) and proceed. I have other comments and questions too, but I try not to confuse your asterisks.

Found this helpful 0

PA Bear MS MVP replied on

MVP Community Star

KB2639417 seemed to provoke the erasing of all settings of my limited account (screen image, documents and desktop documents). I performed three times system restore after having installed this...

Tip: Ideally, you would never, EVER use System Restore to "undo" an update, Service Pack, or IE upgrade (which often leaves the system in a "confused" or "torn" state)! Instead, uninstall the update, Service Pack, and/or IE upgrade & reboot. If that doesn't correct the problem, then try System Restore.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1. Had the preinstalled Norton free-trial period already expired by the time you purchased your first Norton Internet Security subscription?

2. Did you (a) uninstall the Norton free-trialware AND THEN (b) download/run the Norton Removal Tool & reboot (c) AND THEN do a clean install of Norton Internet Security?

3. Is KB2567053 and/or KB2555917 and/or KB2506223 listed in Add/Remove Programs?

~Robear Dyer (PA Bear)
MS MVP-Windows Client (IE, Mail, Security & Update Services) since 2002

Found this helpful 0

Vassiliki Stavropoulou replied on

"Ideally"!..

...trying to answer this, with "reply" I had a window saying the certificate of this site isn't OK and maybe it's pretending to be microsoft and will cheat my data. Then I answered with "reply with quote" and certificate was OK. Cannot use right "reply with quote" so plse forgive me.

I'm living in harsh conditions and internet is more than important for my survival, so every time that some new problem arises with my pc or my connection, perhaps cannot pick the ideal solution, even more as I'm not computer savvy at all.

Today I logged in my limited account and given that I resolved every other issue of the past days it just did not log in for at least half an hour, finally I did it.

I also forgot to say about an error each time I open the pc (or sort of) about an application that could not initialize (a different one each time or sort of) and will be closing, I close the error window and it does not affect any more my using my pc.

Also I tried to install some windows 7 checking program (that checks if a pc is ready to upgrade to windows 7) and it seems that my windows installer has a problem. Same windows installer seems to stop me from installing again adobe reader. Do not know how to fix it.

1. 2. Do not remember anything at all about if Norton free trial had expired when I purchased my first NIS nor if I used the NRT before to install second, as this hapenned on 2005. I still recall though, a Norton free trial was pre-installed,

3. KB2506223 was installed on 15/4/11, KB2555917 on 15/7/11 and KB2567053 on 14/10/11.

Found this helpful 0

PA Bear MS MVP replied on

MVP Community Star

1. 2. Do not remember anything at all about if Norton free trial had expired when I purchased my first NIS nor if I used the NRT before to install second, as this hapenned on 2005. I still recall though, a Norton free trial was pre-installed

3. KB2506223 was installed on 15/4/11, KB2555917 on 15/7/11 and KB2567053 on 14/10/11

1a. Enable Show Hidden Files and Folders per this tutorial => http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/#winxp

1b. In Windows Explorer [WinKey+E], navigate to & right-click on

• C:\WINDOWS\SYSTEM32\MSHTML.DLL <=this file

1c. Select PROPERTIES | VERSION (tab): What file version is displayed here (e.g., v8.0.1234.98765)?

2. Are ANY of the following updates listed in Add/Remove Programs?

• KB2631813, KB2598479, KB2603381, KB2646524, KB2584146 and/or KB2585542

~Robear Dyer (PA Bear)
MS MVP-Windows Client (IE, Mail, Security & Update Services) since 2002

Found this helpful 0

Vassiliki Stavropoulou replied on

1.8.0.6001.18812

2. All of them but KB2585542 are installed.

Previous Page of 2 Next