help with removing wuaudit.exe

[yov99]

ok JRT has finished, log is attached

also - each time the os boots up im presented with the following message
"There was a problem starting c:\users\**username**\appData\local\temp\tsivi132.dll the specific module could not be found"

[gen-hackman]

ok that's not a problem it'll disappear...

Launch Pre_Scan again , click on "Diag"

Accommodate the report c:\ Pre_Diag_xx_xx_xx.txt on http://cjoint.com then give the link obtained

I'll do a script to delete the rests

[yov99]

diag log
http://cjoint.com/?3Hshkh83WFW

[gen-hackman]

hello

confirm that you're in Israel please

==

Select the bold text below, then CTRL + C :

Kill::

Key::
[HKU\S-1-5-21-2369604876-1934198422-3652077016-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]|[tsiVideo]
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}]     
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\Settings\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}]     
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}]
[HKU\S-1-5-21-2369604876-1934198422-3652077016-1000\Software\65]
[HKLM\Software\Object]     
[HKLM\Software\SOFTWARE]
[HKLM\Software\Wow6432Node\Object]     

File|Fold::
C:\Program Files (x86)\Spybot - Search & Destroy 2
C:\765d3b4619528d698803bc997e50a6
C:\Windows\1C4551A64743409391E41477CD655043.TMP
C:\Windows\6833245EDD86479A882A8360D62C8194.TMP
C:\Windows\MultiKMS
C:\Users\Yoav\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BS.Player
C:\ProgramData\Spybot - Search & Destroy
C:\Users\Yoav\AppData\Local\28050
C:\Program Files (x86)\Spybot - Search & Destroy 2

Driver::
21675396
AVGIDSDRIVER
AVGIDSEH
AVGIDSFILTER
AVGIDSHA
AVGRKX64
AVGTDIA
AVG_ANTI-SPYWARE_DRIVER
AVG Anti-Spyware Driver

MBR::

Clean::

Reboot::

Attention!!! Think in re - deactivate your protections

launch Pre_scan again, then choose the option "Script"

A page is going to open

Logically the text which you selected is there already, thus you close and the program is going to work.

Otherwise stick him(it) (right click/paste or ctrl+V) in the blank page.

Then tab file = > register(record) (not to register(record) under), then close the text

Black windows risk to flash, it is normal, it is the program which works

Post Pre_Script.txt who will appear on the office(desk) at the end of work

[yov99]

hey
what do you mean by "re - deactivate your protections"?

[gen-hackman]

switch off the protections the time you do the script ( antivirus ,etc...)

[yov99]

script log

[gen-hackman]

ok is there still any problem ?

you didn't aswer to this :

confirm that you're in Israel please

[yov99]

oh, yes my location is Israel

it seems like you managed to fix it, though i don't really understand half of it (:
i guess i should be more cautious in the future..

it was so frustrating to see it come back no matter what i tried
Thank you so much for helping me and other around here

[gen-hackman]

ok just to finish , I asked to googleTraduction to translate my french page of end of disinfection (cause i'm french ^^ ), here it is :

http://translate.google.fr/translate?hl=fr&sl=fr&tl=en&u=http%3A%2F%2Fsecurity-helpzone.com%2Fgen-hackman%2Fnettoyage-en-fin-de-desinfection%2F

if you don't understand something.....

[yov99]

will do
thanks again!

[gen-hackman]