Re: Are A9Helper.A9 and HidInputMonitorX malware infections
 OS: Windows XP : Version: 5.01.2600 Service Pack 3
 WU (Windows Update) started to 'break down' during a MS Support case.
Basically an insignificant update was not installing (Via WU).
So We (MS Support and I) did the following.
 Flushed the WU SoftwareDistribution directory
 Reset the WUAU / BITS services (service down, reboot, service up)
 Registered WU DLLs
 Ran the 'Dial-a-Fix' tool and reset/reregistered WU and Cryptography
 Re-installed WUA (Windows Update Agent)
The result of the above was the 'break down' of WU so that the WU Web page
is (a) basically blank (dependeing on the WU website accessed), (b) says
everything is OK or (c) error [Error number: 0x8DDD0004]
I have recorded the 12 MS WU websites I tested and their responses (not
So, in summary, WU no longer works via IE 8.
But, I believe, even the WUAU (..Auto Update) may be failing where key updates
it says are applied : other tools (Belarc Advisor) say some critical updates
are not applied - which is what I have determined to be true - updates were
never really applied.
"PA Bear [MS MVP]" wrote:
> Always state your full Windows version (e.g., WinXP SP3; WinXP 64-bit SP2;
> Vista SP1; Vista 64-bit SP2; Win7; Win7 64-bit) when posting in a forum or
> newsgroup. Please do so in your next reply. Also tell us what led you to
> ask these questions?
> MrSoftware wrote:
> > Topic : Are A9Helper.A9 and HidInputMonitorX malware infections
> > Many people who have posted WU [Windows Update] problems on various
> > internet
> > help sites
> > have the following two Active X controls.
> > Directory = C:\WINDOWS\Downloaded Program Files
> > - A9Helper.A9
> > - HidInputMonitorX
> >  Are these valid Microsoft software devices?
> >  I have removed them but WUAU [Windows Update Automatic Update] seems
> > to
> > download/re-install them
> > When the ActiveX files (above) are examined the following are blank or
> > bogus.
> > Description
> > Company
> > Copyright
> > Thus, I expect they are NOT Microsoft controls and can be removed.