MS Update issue with 2003

ElGuapo · 9th February 2009

I'm running a domain with Server 2003 Enterprise. I recently ran high priority updates. After updates were done, Symantec Live Update was unable to reach it's update site, and server couldn't reach MS Update page.
SP2 was installed, cause problems and was uninstalled. Server is running SP1.

Servers were updated for first time in over 14 months.

Any help would be appreciated.

**Arie** · 10th February 2009

Any clues from the Event logs?

Post the last 75 lines of the WindowsUpdate.log here.

ElGuapo · 10th February 2009

Nothing. Symantec keeps reporting a rundle.exe file, but can't remove it. We're doing the manual registry and file removal tonight.

Has anyone ever heard of this problem before?

**Arie** · 11th February 2009

Quote:

Originally Posted by ElGuapo

Nothing. Symantec keeps reporting a rundle.exe file, but can't remove it. We're doing the manual registry and file removal tonight.

Has anyone ever heard of this problem before?

I haven't, but have you searched the Symantec support site? Contacted Symantec support?

That would be the 1st thing I did.

ElGuapo · 11th February 2009

Thanks Arie. Symantec did have a remove for it. We also found W32.Downadup, which (among other things) blocks access to security sites including windows update and symantec. Hopefully removing that will fix the problem.

**Arie** · 12th February 2009

Yea, a lot of worms/malware disable Windows Updates these days.

aweston · 14th February 2009

It sounds like the Hako virus.

aweston · 14th February 2009

Downadup.. Confiker. Which means you didn't patch the RPC vulnerability. Make sure you have the proper patch installed (available from Microsoft) and then scan for the infection using Bitdefender's removal tool.

I can pretty much promise you your entire network is infected and that you're going to have a brutal time getting rid of it.