Windows installer

June 10, 2009 at 08:07:53
Specs: Windows XP
My daughter has some type of virus that appears in the form of Windows Installer. It will not allow her to access any virus software removal sites. She has Norton, but it will not let her update. She gets ccCommon file missing error. Any suggestions on how to manually remove it? (windows xp)

See More: Windows installer

Report •


#1
June 10, 2009 at 08:10:14

Report •

#2
June 10, 2009 at 08:49:28
It will not let you update Norton utilities. If I attempt to go to any web site with antivirus software, it disconnects you from the web site. I ran Windows Live One Care in Safe Mode and it detected and cleaned it, but when she rebooted to her regular session the Windows Installer window popped up and began running again. I ran MBAM, Norton, and several others, but cannot get rid of it.

Report •

#3
June 10, 2009 at 09:16:39
Note: I can help you remove it manually. Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible. First Track this topic (http://www.computing.net/help/#track). Then follow:

1) Can you please post your AVZ log:
Note: Run AVZ in windows normal mode. If avz.exe doesn't start, then try to rename the file avz.exe to something else and try to run it again. Make sure you have your web browser open in background before following the steps below.

i) To create the logfile, download AVZ by clicking HERE. Please save this file to your desktop or "My Documents" folder.

ii) Next, unpack the file to a new folder using the Compressed (zipped) folders wizard built into Windows XP/Vista, or a zip utility of your choice.

iii) Once you have unpacked the contents of the zip archive, please launch the file AVZ.exe by double clicking on it or right clicking and selecting Open.
Note: If you are running Windows vista launch AVZ.exe by right clicking and selecting Run as Administrator.

You should now see the main window of the AVZ utility. Please navigate to File->Custom Scripts. Copy the script below by using the keyboard shortcut CTRL+C or the corresponding option via right click.

begin
ExecuteStdScr(3);
RebootWindows(true);
end.


Paste the script into the execution window by using CTRL+V keyboard shortcut, or the "paste" option via the right click menu. Click on Run to run the script, the PC will reboot. After the reboot the LOG subfolder is created in the folder with AVZ, with a file called virusinfo_syscure.zip inside. Upload that file to rapidshare.com and paste the link here.

Image Tutorial

2) Can you also make a new HijackThis log and upload it to rapidshare.com. HijackThis: Here

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

Related Solutions

#4
June 10, 2009 at 09:29:44
I really appreciate your help. I have been working on this for weeks now. I am going to my daughter's tomorrow so I will follow your instructions to obtain the logs and send them to you then. Thank you again.

Report •

#5
June 12, 2009 at 08:16:17
The computer will not stay connected to the internet. I downloaded MBAM on a disk and ran it. The following registry items were infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft|Security Center|AntiVirusDisableNotify (Disabled.SecurityCenter) ->Bad: (1) Good: (0) -> No Action taken.
HKEY_LOCAL_MACHINE|SOFTWARE|Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) ->Bad: (1) Good: (0) -> No action taken.

I also ran Microsoft Live One Care Scan afterwards and it also showed an error and cleaned it. After rebooting the machine, ran the scans again and had the same results. At that time, it allowed me to access the internet. We decided to download McAfee Security Suite on her computer since it was time for the Norton to expire. (I have McAfee and haven't encountered any problems.) When it checked for compatability, it instructed us to remove Norton which I did. When the computer restarted, the windows installer came up again and another notification that ccCommon file was missing which is what alerted us to the virus in the first place. I finally removed all parts of Norton and started the download. A notification appeared that the test scan had found an item that could not be removed and the rest of the download would not complete.

I worked on the computer from 8:00a until 8:00p at her house. I finally gave up and disconnected it from the internet and brought it to my house. I can't connect to the internet with it (wrong modem configuaration - she had Hughes satellite and I have Suddenlink cable)

If you can provide further instruction, it will be very much appreciated.


Report •

#6
June 12, 2009 at 08:30:24
Follow Response Number 3 ... If you can't use internet you will need to use usb to transfer those files from computer with internet and back and forth till problem is diagnosed. Every time you use USB make sure you scan usb for cross infection.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#7
June 13, 2009 at 20:29:02
http://rapidshare.com/files/2442950...

I am continuing to experience problems with Windows Installer. I have a Fix-It Pro Utilities Program that I have been attempting to uninstall unsuccessfully. It gives me the Windows Installer files missing error. The same happened with a few other files I tried to remove. I reviewed her system logs as far back as 5/12/09. She had error after error about computer unable to renew its address from the network for a specific network address. The timeout period has expired. Computer will continue to try and obtain an address on its own from the network address (DHCP) server. That error and the Windows Installer error were repeatedly on the logs. The system restore points were deleted and updates stopped. Computer continually disconnected from the network. Evidently this has been going on for some time. I ran several different scans and most showed the same two registry items but did not remove them. Each time I rebooted they reappeared.


Report •

#8
June 15, 2009 at 17:55:48
I have no clue what file you have posted its not the file i requested in Response Number 3.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#9
June 15, 2009 at 20:33:52
Sorry for the extra files. I thought they might be helpful. All were logs generated from Malware, Trend Micro, Etc. Each gave different scan results. The following are the links to the information specifically requested: http://rapidshare.com/files/2450307...
http://rapidshare.com/files/2450307...

Report •

#10
June 15, 2009 at 20:47:34
Pause/stop all your current Antivirus/Spyware programs. Then follow:

Download and run Kaspersky AVP tool: http://devbuilds.kaspersky-labs.com...
Once you download and start the tool:

# Check below options:

    * Select all the objects/places to be scanned. 
    * Settings > Customize > Heuristic analyzer > Enable deep rootkit search

# Click Scan
# Fix what it detects
# Attach Scan log/Summary to your next message.

Illustrated tutorial: http://img32.imageshack.us/img32/76...

PS: You can use usb to transfer it over from another computer. If you can't run it in normal mode then run it in safe mode.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#11
June 16, 2009 at 15:19:55
http://rapidshare.com/files/2453416...

The summary stated no errors. Download represents full scan info.


Report •

#12
June 16, 2009 at 15:41:56
Doesnt really look like a virus. Tried reinstalling symantec? Also post a screen shot of that window.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#13
June 17, 2009 at 18:06:40
Are you saying that none of the scans removed the virus? I thought the last scan didn't show any virus. I purchased McAfee virus protection, but I have not been able to download the product yet. The internet was disconnecting each time we attempted. If you think the computer is clean, I will take it back to my daughter's and attempt to connect to her internet provider and download McAfee.

Report •

#14
Report •

#15
June 18, 2009 at 05:58:20
Thank you for your help. I must have misread response number 12. I thought it said it DOES apppear that I have a virus.

Report •

#16
June 18, 2009 at 06:06:56
Follow Response Number 14. It was Doesn't :).

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •


Ask Question