Can't get rid of XP wuauclt.exe error message

[Lorilei]

I'm trying to help neighbor with a problem that seems to have been the result of a power outage. She was running Windows Update > power failure > neverending wuauclt.exe error messages. I've followed the Cleanup Threads and am having some issues deleting some of the files (in use).
I've run ATF, DDS, Windows Malware Removal, MBA-M, but when I tried to run GMER it crashes after 45 minutes (tried 3 times today). Machine seizes up and needs hard reboot.

Exceptions to Cleanup Thread efforts:
1) del entire contents of c:\windows\temp -- can't get rid of JETC052.tmp; perflib_perfdata_170; or perflib_perfdata_198 ("in use")
2) del contents of c:\temp -- no such animal on this computer
3) search *.tmp and del all -- can't del c:\winxp\temp\JETC052.tmp (same as above in 1)
4) clean each user:
>local service\temp - can't del CMLS--2010-05-04--17-04-51.log or
WER1dba.dir00
>cookies file -- can't del username\cookies\index.dat or
networkservice.NTAuthority\cookies\index.dat
and these items also appear in content IE5 and History

Never had such a difficult time fixing something like this before. Any clues would be gratefully accepted! Thanks for your help!

[jholland1964]

Hello and welcome to daniweb, sorry it has taken so long for you to receive a reply.
Give us the exact wording of the neverending wuauclt.exe error messages.
There appears to only be one notation in the event log generated by the DDS scan pointing to this file. It reads;

4/29/2010 3:00:56 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\winxp\system32\wuauclt.exe. This file was restored to the original version to maintain system stability. The file version of the system file is 7.4.7600.226.

There were no other errors noting this file. There is an error noted for a file with a "similar" name but certainly not this one, which says;

wuaucpl.cpl was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is Priscilla Yagel. The file version of the bad file is unknown.

Where did you get those Cleanup Thread steps? Here on this forum or someplace else? What program are you using to attempt to clean out the temp files?

Can you update MBA-M and this time do a Full Scan. Of course have it remove/quarantine anything found and post back with the resulting log.
Judy

[Lorilei]

s'okay Judy! and thanks for the welcome! I just appreciate the assistance - this little monster makes me want to format c: and rebuild.

Yes, I followed the instructions on Daniweb cleanup threads after following MS' instructions for over a week without resolve. I thought I did run the full MBA-M so I'll go back and try again. I started with PhillyPhan's Read Me thread in Viruses and Spyware, and also dlh6213's thread Cleaning Procedures and Detecting Tools.

It's not my computer (parent's friend) and I won't be able to access it again until Monday so I apologize in advance for the resulting delay in answering the rest of your questions.

Check back here Monday? Mille grazie!

Lorilei

[jholland1964]

dlh6213's thread Cleaning Procedures and Detecting Tools.

That set of instructions is over 4 and 1/2 years old, many of those procedures are now out of date. The key instructions are PhilliePhans Read Me thread in Viruses and Spyware which he keeps updated, if you note there it says Last edited by PhilliePhan; 27 Days Ago

[Lorilei]

That set of instructions is over 4 and 1/2 years old, many of those procedures are now out of date. The key instructions are PhilliePhans Read Me thread in Viruses and Spyware which he keeps updated, if you note there it says Last edited by PhilliePhan; 27 Days Ago

That's good - because that's where I started with PhillyPhan. If I remember, that's where I got the links for ATF, DDS, GMER and MBA-M.

[jholland1964]

That's good - because that's where I started with PhillyPhan. If I remember, that's where I got the links for ATF, DDS, GMER and MBA-M.

That's right. Glad of that.

[Lorilei]

Hello! Sorry for delay!

Here's a screen cap of the dreaded wuauclt.exe error and the log of a mba-m full scan (which did not find anything this time around. Just for grins and giggles I tried going back to MS Updates and got the same result - freeze/hang.

Error signature
szAppName : wuauclt.exe szAppVer : 7.4.7600.226 szModName : esent.dll
szModVer : 5.1.2600.5512 offset : 000c42d2

[jholland1964]

Download HiJackThis
Run a system scan and please copy/paste the log back here. We prefer this rather than attachments. If an attachment is needed we will tell you.

[Lorilei]

Thanks for your patience -- freshly run hijack this log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:56:45 PM, on 5/11/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINXP\stsystra.exe
C:\Program Files\Common Files\AOL\1259949287\ee\AOLSoftware.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\AOL 9.5\waol.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
C:\WINXP\system32\nvsvc32.exe
C:\WINXP\system32\HPZipm12.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\wanmpsvc.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\WINXP\System32\dmadmin.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\WINXP\system32\wscntfy.exe
C:\WINXP\System32\svchost.exe
C:\Program Files\AOL 9.5\shellmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\program files\aol toolbar\aoltbServer.exe
L:\HiJack This\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AOL Toolbar Loader - {3ef64538-8b54-4573-b48f-4d34b0238ab2} - C:\Program Files\AOL Toolbar\aoltb.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files\AOL Toolbar\aoltb.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINXP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1259949287\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.5\AOL.EXE" -b
O4 - Global Startup: WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O4 - Global Startup: WDSmartWare.lnk = C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINXP\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINXP\system32\browseui.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINXP\system32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINXP\wanmpsvc.exe
O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe

--
End of file - 6186 bytes

[jholland1964]

Try updating once more but this time totally turn off the Norton program. If that doesn't work we will try something else.

[Lorilei]

That didn't work either. Turned off Norton and still can't update and I'm still getting the error message. What next, Obi-Wan?

[jholland1964]

Try this first:
Reset the Windows UPdate components and check if you still get that error message.
Click on the Fix It button in the article below to do that automatically or you may do it manually. For more information refer to the article below.
How do I reset Windows Update components?
http://support.microsoft.com/kb/971058

Then try to update.
If that doesn't work then try this:

Install Windows Update Agent to manage the updates on your computer.
Download and install Windows Update Agent to manage the updates for your computer.
Follow the link below to download and install Windows Update Agent:
http://support.microsoft.com/kb/949104

After doing that see if Updates will work.

[Lorilei]

will go do that now and check back when it's done - thanks

[Lorilei]

Okay: latest results

"How do I reset Windows Update components?
http://support.microsoft.com/kb/971058"

Tried to run this and reboot three times. Each time it flashed a message that "you may not have the authority to run this program" and then it continued on without correcting the problem. Yes, I am signed in as the owner/administrator.

Then tried
"install Windows Update Agent:
http://support.microsoft.com/kb/949104"

but it asks you to go the the very page that I'm locked out of: support.microsoft.com. Which has been trying to connect in an adjacent tab for about 7 minutes now.

Tried going to Control Panel>User Accounts to see if there was anything useful under the owner/admin's name but it was pretty useless.

[Lorilei]

new hijack log if it helps:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:02:26 PM, on 5/12/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINXP\stsystra.exe
C:\Program Files\Common Files\AOL\1259949287\ee\AOLSoftware.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINXP\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\WINXP\system32\nvsvc32.exe
C:\WINXP\system32\HPZipm12.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\wanmpsvc.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\WINXP\System32\dmadmin.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\WINXP\System32\svchost.exe
c:\program files\aol toolbar\aoltbServer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINXP\system32\wuauclt.exe
L:\HiJack This\HiJackThis.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AOL Toolbar Loader - {3ef64538-8b54-4573-b48f-4d34b0238ab2} - C:\Program Files\AOL Toolbar\aoltb.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files\AOL Toolbar\aoltb.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINXP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1259949287\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O4 - Global Startup: WDSmartWare.lnk = C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINXP\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINXP\system32\browseui.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINXP\system32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINXP\wanmpsvc.exe
O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe

--
End of file - 6034 bytes

[jholland1964]

Here is the actual Windows Update Agent file. See if this works.

http://download.windowsupdate.com/windowsupdate/redist/standalone/7.4.7600.226/windowsupdateagent30-x86.exe

[Lorilei]

I was able to download and run the Update Agent File from this link but it told me that Update Agent was already loaded and working. And while this window was up, the stupid error message flashed again! >XP

[jholland1964]

Your list of installed programs does not show the Microsoft® Windows® Installer
Try downloading that and then again try the updates.
http://www.microsoft.com/downloads/details.aspx?familyid=889482fc-5f56-4a38-b838-de776fd4138c&displaylang=en

But again also turn off the Norton program, make sure the firewall is turned off and also any pop up blockers you may have on there also.

[Lorilei]

Hi!
Did all that. Got new error message: KB893803v2 Setup Error. Setup has detected that the Service Pack version of this system is newer than the update you are applying. There is no need to install this update.

Going back to MS Downloads and looking for WinInstaller update that works with SP 3.

Sorry for delay - RL job usurped my life.

[jholland1964]

http://www.microsoft.com/downloads/details.aspx?FamilyID=5a58b56f-60b6-4412-95b9-54d056d6f9f4&displaylang=en

[Lorilei]

Thanks for hanging in there with me! I did download v 4.5 from the link above and followed the directions. It download and install but I still can't get the updates to work at all, and I'm still getting the stupid error messages. Did I miss a step in the process?

here's a HT log if it helps. Again - many thanks! Anyone who wants to jump in I'm taking WAGs (wild A$$ guesses) at this point out of sheer frustration. Coming Soon to a Computer Near Me: format c:\ -- the sequel

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:39:55 PM, on 5/20/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\WINXP\system32\nvsvc32.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\wanmpsvc.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\WINXP\System32\dmadmin.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\WINXP\Explorer.EXE
C:\WINXP\stsystra.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
C:\WINXP\system32\wscntfy.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
c:\program files\aol toolbar\aoltbServer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
L:\HiJack This\Trend Micro\HiJackThis\HiJackThis.exe
C:\WINXP\system32\wuauclt.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AOL Toolbar Loader - {3ef64538-8b54-4573-b48f-4d34b0238ab2} - C:\Program Files\AOL Toolbar\aoltb.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files\AOL Toolbar\aoltb.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINXP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1259949287\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O4 - Global Startup: WDSmartWare.lnk = C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINXP\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINXP\system32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\AdAware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINXP\system32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINXP\wanmpsvc.exe
O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe

--
End of file - 5838 bytes

[jholland1964]

I posted the info for you one week ago but you have done nothing for a week. If you wanted to fix the computer you would have stayed with this thread.

[Lorilei]

Please excuse me, this isn't my computer and I don't have unlimited access to it. I also have a job that takes precedence. I have done everything you suggested. It hasn't worked so far. I'm sorry to have been an inconvenience, I will search elsewhere for assistance.

[kristain]

Press "Ctrl," "Alt" and "Delete" together to open the Windows Task Manager. Click the "Processes" tab to show the currently running processes on your computer.
Scroll down and click "wuauclt.exe ." Click "End Process" to stop this program from running. Close the Task Manager.
Double-click "My Computer" on the desktop and double-click the "C:" drive. Double-click the "WINDOWS" folder and double-click the "System32" folder.
Locate the "wuauclt.exe" file. Right-click it and click "Delete." Empty the recycle bin to complete the removal process.

[Lorilei]

I've tried that and "wuauclt.exe" relaunches itself immediately. I also did a search on all "wuauclt.exe" and related items as suggested by microsoft and changing the extension to ".old" and that didn't help either. I will be going over to this lady's house shortly and will try your suggestion before I format c: as this has been going on since April and I am tired of messing around with it and she is tired of these stupid error messages.

THANK YOU - I really *do* appreciate all the support I've had here and although this incident may not have been the easiest thing to solve, my first Daniweb help request is positive. I will post the results on how I finally got it solved once it's done.

[paulas24]

please try this
Click Start, click Run, and then type net stop wuauserv.
On the desktop, double-click My Computer, and then delete the drive:\WuTemp folder.
Click Start, click Run, and then type net stop cryptsvc.
Delete the drive:\Windows\System32\Catroot2 folder.
Open the drive:\Windows folder, and then rename the SoftwareDistribution folder as SoftwareDistributionOLD.
Open the drive:\Windows\system32 folder, and then follow these steps:
Rename the Wuweb.dll file as Wuweb.dll.old.
Rename the Wuapi.dll file as Wuapi.dll.old.
Rename the Wuauclt.exe file as Wuauclt.exe.old.
Rename the Wuaucpl.cpl file as Wuaucpl.cpl.old.
Rename the Wuaueng1.dll file as Wuaueng1.dll.old.
Rename the Wuaueng.dll file as Wuaueng.dll.old.
Rename the Wuauserv.dll file as Wuauserv.dll.old.
Rename the Wucltui.dll file as Wucltui.dll.old.
Rename the Wups2.dll file as Wups2.dll.old.
Rename the Wups.dll file as Wups.dll.old.
Restart the computer

[kristain]

To fix the wuauclt.exe error follow the given steps:
1) Copy and paste wuauclt.exeto C:\WINDOWS\system32. But before doing this, you have to make sure that there is no copy wuauclt.exe in this directory. Then please go to Start, and then "Search" to find whether there is a wuauclt.exefile on your computer. If it is placed at the wrong place, simply cut and then paste it under C:\WINDOWS\system32.
If you unfortunately can not find wuauclt.exe on your own computer, you can copy it from another computer and then paste it on your own. Also, you can reinstall your system to fix this annoying problem, but frankly, it will take you more time. To save your time and easily fix wuauclt.exe error,I highly recommend you to try the solution below.
2) Rely on a professional registry utility to fix wuauclt.exe error. Wuauclt.exe error always occurs when there is something wrong with Windows registry, which decides the proper running of the programs on your computer. And it can be easily fixed by fixing the registry. With a professional registry cleaner in hands, you can not only fix the wuauclt.exe error, but also helps you to effectively fix other kinds of registry errors, manage your system, optimize your computer to top performance every day.

[jholland1964]

2) Rely on a professional registry utility to fix wuauclt.exe error. Wuauclt.exe error always occurs when there is something wrong with Windows registry, which decides the proper running of the programs on your computer. And it can be easily fixed by fixing the registry. With a professional registry cleaner in hands, you can not only fix the wuauclt.exe error, but also helps you to effectively fix other kinds of registry errors, manage your system, optimize your computer to top performance every day.

Absolutely NEVER advice that is given here. Using registry cleaners and repair programs is never, ever recommended. If you are going to post here, please follow the steps and recommendations used here.

[jjra0706]

i have a sus laptop with vista on it and everytime i turn it on , windows will not boot up ..... Says something about device driver hardware can be removed (error 0000001122 ) not exactly the error code but something to that nature. If anyone could help me out I would really appreciate the time and knowledge...... Thanks again

[jholland1964]

i have a sus laptop with vista on it and everytime i turn it on , windows will not boot up ..... Says something about device driver hardware can be removed (error 0000001122 ) not exactly the error code but something to that nature. If anyone could help me out I would really appreciate the time and knowledge...... Thanks again

jjra0706 you need to begin your own thread rather than hijacking another's. Begin with our Read Me sticky and follow the steps there.
http://www.daniweb.com/forums/thread134865.html
Then begin your own thread stating your problems and including all the requested logs.