Page 1 of 2 12 LastLast
Results 1 to 10 of 15

Thread: KB956572 and install problems

  1. #1
    gelert Guest

    Default KB956572 and install problems

    RE: Security Update for Windows XP KB956572
    C:\WINDOWS\SoftwareDistribution\Download\51401b498 f4675531d9efb941ee01ef3\SP3GDR\wmiprvse.exe
    Zone Alarm message: Backdoor.Win32.Agent.afqs was found in C:\WINDOWS\SoftwareDistribution\Download\51401b498 f4675531d9efb941ee01ef3\SP3GDR\wmiprvse.exe on 19/04/2009 17:35:54Options of Ignore Once / Repair do NOT work...but I'm not going to click the Ignore Always option just yet...!

    Can somebody please tell me if this is:
    A) a False positive, orB) a Known Issue, orC) how to get around this problem.
    Basically, during today's batch of MS Security Updates, ZASS keeps finding this as a problem, and denies install - subsequently KB956572 doesn't install.
    i've even tried disabling ZASS and installing KB956572 - and I still get the "Backdoor.blah blah" issue.
    Any clues anyone...?

    Operating System:Windows XP Pro
    Software Version:8.0
    Product Name:ZoneAlarm Internet Security Suite

  2. #2
    gwbaldwin Guest

    Default Re: KB956572 and install problems

    ZA finds Backdoor.Win32.Agent.afqs in Windows\system32\wbem\wmiprvse.exe when KB956572 tries to install. The installation fails. This occurs when using today's ZA's update files. I then used an old image of my C: drive which was using ZA's April 12th @6:29 update files. KB956572 installs properly and no virus found. Using this same image, after KB956572 was installed, the virus is 'found' when I update the ZA files.

    Message Edited by GWBaldwin on 04-19-2009 11:18 AM

  3. #3
    phantomk Guest

    Default Re: KB956572 and install problems

    Zone Alarm reports the backdoor, reports failure to remove, then reports deleted on reboot.
    Afterwhich the KB956752 update tries to post.
    Running Windows Update fails to run...
    Seems the WMIPRVSE is involved... I fear a Windows Update may have delivered a virus as part of a security update involving WMIPRVSE in this week's updates
    Zone Alarm Scans clean but continues to log what appear to be the downloaded update

  4. #4
    magic_engr Guest

    Default Re: KB956572 and install problems

    I get a similar issue, with my problem being that I can't install the MS update at all. Even tried to disable ZA ISS to do it, and it wouldn't allow me to do so. I had a similar instance on April 16-17 with a MS update that was downloaded, ended up spending several hours on the phone with MS support who ended up disabling ZA, allowing the update to take.
    But then on virus scan today (April 19), Backdoor viruses were discovered. I thought it was because I had the MS tech use a Netmeeting-type program to do diagnostics and take control of my PC, so I deleted those programs, since I didn't need them anymore, but now that I read this, I wonder what's really going on?

  5. #5
    magic_engr Guest

    Default Re: KB956572 and install problems

    Quote from PhantomK:
    "Zone Alarm reports the backdoor, reports failure to remove, then reports deleted on reboot.Afterwhich the KB956752 update tries to post.Running Windows Update fails to run...Seems the WMIPRVSE is involved... I fear a Windows Update may have delivered a virus as part of a security update involving WMIPRVSE in this week's updatesZone Alarm Scans clean but continues to log what appear to be the downloaded update"

    Yes! This is what just happened to me today (April 19). Word for word, detail for detail.

    Message Edited by magic_engr on 04-19-2009 02:55 PM

  6. #6
    Join Date
    Nov 2004
    Location
    localhost
    Posts
    17,291

    Default Re: KB956572 and install problems --> Please report false positive

    Please report false positive, see here how:http://forum.zonelabs.org/zonelabs/b...essage.id=3780No reporting, no fix.Cheers,Fax

    Message Edited by fax on 04-19-2009 10:25 PM

    Click here for ZA Support
    Monday-Saturday 6am to 10pm Central time
    Closed Sundays and Holidays

  7. #7
    qsimdo Guest

    Default Re: KB956572 and install problems --> Please report false positive

    Could you explain how to do that please?

  8. #8
    diligent Guest

    Default Re: KB956572 and install problems --> Please report false positive

    Hi Folks. Diligentinquirer here (Diligent). Thought it would be best to add this to the mix.

    I do not currently nor ever on this puter, used Zone Alarm. But today about 2:00 when returning from a shower, the A-Squared free program had ended which gave this message: "a-squared has detected the following files that should be sent to the analysis team for deeper investigation.

    C:\WINDOWS\SoftwareDistribution\Download\51401b498 f4675531d9efb941ee01ef3\SP3GDR\wmiprvse.exe

    Do you allow to submit these files now?"

    Thought I would google this first, cause some (I think) questionable findings have came out from a-squared, especially after adding the Akura engine. Found this sole-recent forum googling the above a2 stated file.

    I have been having odd(?)malware-like installation probs, so thought that for the benefit of all persons thought it was best to post this info since it seems to not be a zonealarm specific event, unlike the oringal op's situation.

    If any info is needed, pls holler!

    My Best, Diligent

    EDIT: April 19, 2009; 3:58 pm pacific Daylight time:
    Ran this op's (and my same) specific file with the following results:

    Specific file virus scan results:
    Jottie.org: Nothing found
    Virus Total: Nothing
    virscan.org: Nothing

    Well, something is up, either unrecognized malware, or false positive conclusions or inquiries. Will post results from a2 once recieved. My Best, Diligent.

    Message Edited by Diligent on 04-19-2009 04:06 PM

  9. #9
    gmichaels Guest

    Default Re: KB956572 and install problems --> Please report false positive

    I also had the same problem today; I have spent the last six hours trying to figure if the "virus" found in the various locations for wmiprvse.exe was real or not. I was going to stop this program in Services, but after more research found that it is a required program. I even let Microsoft run their "live" scanner but no viruses were found. I also noticed that when I tried to check "dependencies" using the properties dialog in Administrative Tools, Services (XP SP3), the services program would hang up. Then I noticed every time I would shut down the computer, Microsoft would remind me to "install updates, then shut down." And the update would FAIL each time that I tried to install it! I checked which were the most current security updates and KB956572 was in the mix! I think this is some kind of incompatibility, as what happened last year when a Zonealarm / Microsoft update clash caused my computer (and some other people's that I know) to not be able to access the Internet for a while. At least now, I know my problem is not unique. I hope that ZoneAlarm has an answer to this problem on Monday, as I'm not too confident that Microsoft will -- I've already been in their Knowledge Base, Technet, and MSDN. They have a 1-800 number to contact for update installation problems, but I've been on the phone for hours with them on other issues (such as OfficeLive,) and still not gotten any resolution.

  10. #10
    naivemelody Guest

    Default Re: KB956572 and install problems --> Please report false positive

    GMichaels, it beginning to look like a 'false positive' - click here > http://forum.zonealarm.org/zonelabs/...ssage.id=32975
    reading other posts.<hr>For me, although I did not have a detection (because I dont' have ZA anti-virus[Kaspersy av]) I did have problems with some of the updates not 'installing' properly even though Microsoft Update History claims I did successfully install on first try; but I did get some error reports and when I did a manual check for Microsoft Updates there were some 'repeats' from first try - and so I tried a manual update again
    - got error code - I then lowered ZA Program Control from 'high' temporarily to 'medium' and it seems to have worked.
    You may try lowering ZA Program Control - to see if it will work.

Page 1 of 2 12 LastLast

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •