Help to eliminate the wuaudit.exe

[Joe Canelas]

Hi there,
I have the avast red box popping up every 15 to 20 minutes informing this 'wuaudit.exe' was trying to be install but blocked by avast.
I've found the same problem here and the ways to eliminate it -> http://forum.avast.com/index.php?topic=131595.msg972419#msg972419.
I've done the same procedures and have the log files already saved to my desktop. Think I'll need a fix code to generate a file to be fixed by FRST
So, would someone help me on this issue?

files attached are: FRST.txt; Addition.txt; DDS.txt and Attach.txt.

Thanks in advance

[mikaelrask]

hey a malware expert will help you when one is online later today.

[essexboy]

Hi download the attached fixlist.txt to the same location as FRST
Run FRST as before and press Fix

THEN

Download OTL  to your Desktop
Secondary link

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

• Select All Users
  
• Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
dir "%systemdrive%\*" /S /A:L /C
CREATERESTOREPOINT

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Post  both logs

[Joe Canelas]

Hi essexboy, thanks for you reply.
Ok. I did part of what you said. The part of FRST to fix via fixlist.txt. The second part I'm having a bit of problem here. This OTL is running for more than 3 hours now and doesn't seem to be stopping any moment soon. It keeps going, scanning folders I din't even know exist such as C:\...\application data\application data\aplication data\...\microsoft...  an endless path. What should I do? I've also noticed some new redudant folders were created. BTW the wuaudit.exe alert stopped showing right after the first part, ever since the system was restarted.

[Joe Canelas]

Hi
Files were created but I'm affraid I won't be able to attach the OTL one cause of restrictions. It has more than 42Mb. The Extras.txt is ok to send
Hope to hear from you.
Thanks

[essexboy]

Looks like it went into a recursive loop, second time I have seen that in about 5 years.  Still could you confirm the alerts have ceased 

[Joe Canelas]

Oh God, and should have to be with me this second time lol. As for the alert, yep, it's been quiet since the first part of your tut was performed and system restarted. And what about those new folders eating my HD? can I delete them? they seem to be redudant. (ex. C:\$recycle.bin\recycle) means rubbish files are present twice in HD.
Thanks very much for your time.

[essexboy]

Those folders are not actually present as it was a recursion within OTL itself.  Run OTL and press the cleanup button and it will hide all system files again and delete itself

[Joe Canelas]

Thanks again, i'll do that!!
May I consider that my desktop is ridded of that wuaudit?
Is there a 'solved' button for the topic?

[essexboy]

If the alerts have gone then so has the malware

[Joe Canelas]

 

[Joe Canelas]

Hi essexboy! me again. As a residual of the wuaudit: there's a rundll message everytime I start the PC. It tells 'Had a initialization problem of the C:\users\...\AppData\Local\Temp\\tsiVi332.dll. Couldn't find the especific  module'. It started showing after the fixing yesterday. Surely connected to that s**t! any ideia how to get rid of it? tks

[essexboy]

Run MSconfig and there will be a startup entry for tsiVideo disable that.  Normally I would use OTL to remove the run key but it does not like your system 

[Joe Canelas]

sure it doesn't  . Already done. Thanks again. Cheers mate!!