help with removing wuaudit.exe

[yov99]

hi there
having a problem with this trojan, having struggled with it quite a bit before coming here
i took the first few steps from a similar post in this forum, and attaching the logs
thanks in advance to anyone willing to help

[gen-hackman]

hello

uninstall Spybot search and destroy

==

Attention!!!: Only these links are officials do not download the tool on other links!!
Attention!!!: this tool can be detected wrongly as virus
Attention!!!: this tool is powerful to follow scrupulously the instructions below

All the processes " not vital of Windows " are going to be cut, register(record) your work. There will be an extinction of the office(desk) during the scan - > no panic.

Deactivate all your protections if possible, antivirus, sandbox, firewalls

Download and register(record) Pre_Scan on your office(desk):

http://Http://services.service-webmaster.fr/cpt-clics/clics-30453-6820.html (renamed(reappointed) winlogon)

Or, if the link is not functional:

http://Http://www.archive-host.com/files/1731274/ecd939269bcc7cdfed2d2e726c22709a32db3067/winlogon.exe (Renamed(reappointed) winlogon)
http://Http://www.security-helpzone.com/Tools/g3n/winlogon.exe (renamed(reappointed) winlogon)

If the tool is boosted(relaunched) several times, he will propose you a menu and if no option is asked, launch the option " Scan|Kill "

If the tool is blocked(surrounded) by the infection use this version with these other extensions:

http://Http://www.security-helpzone.com/Tools/g3n/Pre_Scan.scr
http://Http://www.security-helpzone.com/Tools/g3n/Pre_Scan.pif
http://Http://www.security-helpzone.com/Tools/g3n/Pre_Scan.com

If the tool detects a proxy and if you did not install(settle) click " to delete(eliminate) the proxy "

It is possible that black windows flash, let it work.

The tool is going to send on a server the viruses which it quarantined so that I can study these more in-depth infections.

Let the tool restart your computer.

Post Pre_Scan_date_hour.txt which appear in the root of your record(disk) system (generally C:\)

DO NOT POST IT ON THE FORUM!!! it is too long

Accommodate the report on http://cjoint.com then give the link obtained

[yov99]

hey, thanks a lot for helping

spybot is uninstalled

[gen-hackman]

ok I wait for the report

[yov99]

i got a blue screen while in the process, attaching the log file which is shoter than expected

[yov99]

ok managed to finish the run, log is attached

[gen-hackman]

hello

Launch it again , click on "Diag"

Accommodate the report c:\ Pre_Diag_xx_xx_xx.txt on http://cjoint.com then give the link obtained

[yov99]

diag log
http://cjoint.com/?3HroBOAtpLo

[gen-hackman]

do you know that ?

C:\Users\Yoav\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\eclipse.exe

[yov99]

yes

[gen-hackman]

Download and register ( direct link) http://www.bleepingcomputer.com/download/adwcleaner/dl/125/ ADWCleaner on your office(desk):

Wait that the window of confirmation of download arrives

launch it, (For vista / 7 / 8 = > right click " as administrator(director) ")

Click abolition(deletion) and post C:\Adwcleaner[Sx].txt

[yov99]

adwCleaner log

[gen-hackman]

ok it's on a good way

==

Download Junkware Removal Tool:

http://Http://www.bleepingcomputer.com/download/junkware-removal-tool/dl/131/

Do not click Download, wait that the window of download arrives for confirmation

Register(Record) this file on the office(desk).

Close quite your browsers

Under XP, double-click on the icon and presses a touch when it will be asked.
Under Vista/7/8 , right click and " Execute as administrator(director) ".
NB: the office(desk) will disappear one moment, it is normal.
Let the program work, don't touch anything
Post the report generated in the end of the analysis.

[yov99]

i'm getting an error
7-zip internal error code 105

[gen-hackman]

ok deactivate your protections or launch it again in safemode