Wuauclt.exe

[CcXD]

Hi everyone!
Well im new in this forum, but not new to the page.
I have a prob in my pc! When I run applications such as new games (swat 4, Dawn of war, AOE3, Silkroad, or play DVDs, my computer stars... "Blinking, that is, it turns black and then turns on again. For example,
I click my pc, then monotor becomes black, and then turns on again, with the my pc window open. When I restart, an error message appear. Its always the 2 messages
"Windows has recovereds from a serious error"
-and-
"Wuauclt.exe has encontered an error and must shut down"

I googled for this error, and it says i must find wuauclt.exe and rename it to "wuauclt.old" but i keep getting the same error.

I have Spybot search and destroy, regcleaner, and avast. (And i already used them)
My computer is AMD Athlon +2800, 512 DDR, Shuttle motherboard.

PD: For those experimented guys, Formatting is not an option. =)

help please?

TNX
CcXD

 

[pscowboy]

Good be a couple of possibilities. If it's not a trojan in disguise, wuauclt.exe is a legitimate XP file: the Windows Automatic Update tool. If you have the okay file, it should not be renamed.

Firstly, if you can get to your desktop, do a search for it. The "good" file will be found in system32; i386; & dllcache. Right clicking and going to Properties should reveal version 5.8.0.2469 and a size of 124,184 for a completely up-to-date SP2 OS. The first SP2 version was 5.4.3790.2182; size 113,944.

Any files of this name that are found that DO NOT HAVE THOSE PROPERTIES, SHOULD BE DELETED. It is a trojan then.

Another possibility is that you were hit with something else that is interrupting the "good" files' work. This is the most likely. If you can still function Internet-wise, go to the Hijackthis site, and enlist their help (Spybot & Avast will not clean this up).

If you get yourself back together, get yourself a disk-cloning image app and always keep an up-to-date copy of your hard drive on a cd. Then when the machine gets into trouble, you wipe the hd and clone it back. When you get used to this process, it takes less than an hour.

 

[CcXD]

I went to the site, I think it was www.hijackthis.com, plis correct me if im wrong.
The thing is this is not only my pc, its also ma father's, who knows little about computers. I cant' backup all his info, that is why i can't really format HDD without loosing info that he uses.

If this was my personal pc, i would've done it months ago.

 

[CcXD]

Hi again!

I was told to go and download hijackthis program, and copy the log i get from it, and i'll recieve help from people with experience in trojans and stuff... so here it is..

Logfile of HijackThis v1.99.1
Scan saved at 22:43:46, on 14/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Archivos de programaAlwil SoftwareAvast4aswUpdSv.exe
C:Archivos de programaAlwil SoftwareAvast4ashServ.exe
C:WINDOWSSystem32tcpsvcs.exe
C:WINDOWSsystem32fxssvc.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32wscntfy.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSsystem32ctfmon.exe
C:Archivos de programaMSN Messengermsnmsgr.exe
C:ARCHIV~1MOZILL~1FIREFOX.EXE
D:CcAplicacioneshijackthisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.web--search.com/
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Vínculos
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: DAPBHO Class - {0096CC0A-623C-4829-AD9C-19AF0DC9D8FE} - C:Archivos de programaDAPDAPIEBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Archivos de programaAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:Archivos de programaTGTSoftStyleXPTGT_BHO.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..RunServices: [Win32 USB2 Driver] rofl.exe
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [STYLEXP] C:Archivos de programaTGTSoftStyleXPStyleXP.exe -Hide
O8 - Extra context menu item: &Define - C:Archivos de programaArchivos comunesMicrosoft SharedReference 2001AERS_DEF.HTM
O8 - Extra context menu item: &Download with &DAP - C:ARCHIV~1DAPdapextie.htm
O8 - Extra context menu item: Bajar web con LeechGet - file://Cocuments and SettingsccMis documentosCcAplicacionesLeechGet 2004\Parser.html
O8 - Extra context menu item: Descargar usando el Asistente de Descargas - file://Cocuments and SettingsccMis documentosCcAplicacionesLeechGet 2004\Wizard.html
O8 - Extra context menu item: Descargar usando LeechGet - file://Cocuments and SettingsccMis documentosCcAplicacionesLeechGet 2004\AddUrl.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:ARCHIV~1MICROS~2Office10EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:Archivos de programaArchivos comunesMicrosoft SharedReference 2001AERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:Archivos de programaArchivos comunesMicrosoft SharedReference 2001AERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:Archivos de programaArchivos comunesMicrosoft SharedReference 2001AERS_ENC.HTM
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:Archivos de programaNet2PhoneNet2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:Archivos de programaNet2PhoneNet2fone.exe
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:Archivos de programaArchivos comunesMicrosoft SharedReference 2001AERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:Archivos de programaArchivos comunesMicrosoft SharedReference 2001AERS_DEF.HTM
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:Archivos de programaArchivos comunesMicrosoft SharedReference 2001EROProj.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Archivos de programaMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Archivos de programaMessengermsmsgs.exe
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/ww/games3.cab
O17 - HKLMSystemCCSServicesTcpip..{89243940-FF1B-407A-BA88-F4FE120FB9F0}: NameServer = 10.0.0.1 10.0.0.2
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:Archivos de programaAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:Archivos de programaAlwil SoftwareAvast4ashServ.exe
O23 - Service: StyleXPService - Unknown owner - C:Archivos de programaTGTSoftStyleXPStyleXPService.exe


Tnx

CcXD

 

[RonKlim]

Wuauclt.exe is a system file, it isn't any kind of virus (although it might theoretically be), and these errors usually popup when it becomes corrupt, the best way fix this is via Windows sfc (system file check) - you can find detailed instructions here on how to fix this error.

 

[Mousemonkey]

This topic has been closed by Mousemonkey