wuauclt.exe problem

[jeff1955]

A friend of mine has suddenly developed a PC problem. As soon as he boots his PC he gets a series of Security Centre messages telling him his PC is infected and he is UNABLE TO CONNECT TO THE INTERNET. The files that are reported as infected are wuauclt.exe and wscntfy.exe. The error message he gets offers to scan his computer and then finds several 'critical' infections. The software then offers to remove the infections but only if he buys the program.

I have installed Spy Bot and also AVG, and run both (and his resident Anti-virus/Anti-malware; Bullguard) in Safe Mode. Each finds nothing. the two implicated files are found in Window's System32 directory. He is running Windows XP SP3.

I have contacted you to ask for advice because he is unable to connect to the Internet to do so himself - Is there anything that I can do to help him? I am able to download HijackThis etc - copy onto disc and run them on his machine, copy files back and send them to you if this is possible.

Thanks in anticipation ...

Jeff

[Blade81]

Hello Jeff,

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt
• Save both reports to your desktop. Post them back to your topic.

Download GMER here by clicking download exe -button and then saving it your desktop:

• Double-click .exe that you downloaded
• Click rootkit-tab and then scan.
• Don't check
  Show All
  box while scanning in progress!
• When scanning is ready, click Copy.
• This copies log to clipboard
• Post log (if the log is long, archive it into a zip file and attach instead of posting) in your reply.

[jeff1955]

Hi Blade,

Thanks for the reply - in a fit of frustration my friend has bought himself a new laptop and has 'scrapped' his old computer. So he is no longer in trouble - thx again for offering the help and I apologise for wasting your time.

I think we can close this thread

Jeff

[Blade81]

Ok. Thanks for letting us know