You have a Vundo infection, usually accompanied by ZLOB and/or SDBot
infections, all of which is protected by a rootkit.
Run a thorough check for hijackware, including posting your hijackthis log
to an appropriate forum.
Checking for/Help with Hijackware
When all else fails, HijackThis v2.0.2
) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
, or other
appropriate forums for review by an expert in such matters, not here.**
If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
Start a free Windows Update support incident request:
Support for Windows Update:
For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
> I'm trying to update my Windows XP Pro after being infected by a virus,
> scanned the computer several times and I've found the virus, it's in a
> called qoMcbcDs.dll, located in the C:\Windows\System32\ and I've tried
> everything to delete it (command, safe mode etc) , but with no success
> because the file is "in use" at all times.
> So, I tought, I have to try to update my Windows definitions. But when I
> tried it, the internet based update service told me I've got some services
> inactive, and gave me instructions to activate them. So I ran the
> services.mcs and tried to set the Automatic Update to Automatic (from
> Inactive), but when I hit apply the status went back to Inactive,
> it stayed Automatic and when I hit the Start button, I got a pop-up saying
> that the service Automatic Update couldn't be started on the Local
> Error 1058: Service can't be started. The reason is that the service is
> either blocked or there's no active devices to be associated with
> (translated from Swedish).
> The other two services, Background Intellient Transfer Service and
> are in order. It was when the BITS was stopped that the Aut.Upd. went
> inactive when applying, but when started, as it shall be, the Aut.Upd.
> to automatic but when trying to start the service, I got the Error.
> What is the problem here? What shall I do to get it active and started, in
> order to get my updates? Is there an other way to get the updates?