i am receiving a a message that pops up constantly that says. Application cannot be executed the file wuauclt.exe is infected.
i have done a a scan with MBAM and it came up with 5 infected files. i removed them all but the problem still persists. i cannot open any virus scanning software unless in safe mode. I have seen other forums with this problem and they post their logs of the scans and they are fixed some how. if anyone can help me with this it would be awesome.
here is my first scan on MBAM. hope this helps
Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 6.0.6001 Service Pack 1 (Safe Mode)
Internet Explorer 7.0.6001.18000
2/15/2010 5:02:50 PM
mbam-log-2010-02-15 (17-02-50).txt
Scan type: Full Scan (C:\|)
Objects scanned: 313588
Time elapsed: 1 hour(s), 9 minute(s), 30 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 5
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\AutoRun.inf (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\RavMon.exe (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\Users\Psychadelic Psyko\Downloads\zoovid_275.40001.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\SVCHOST.EXE (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\Users\Psychadelic Psyko\AppData\Local\Temp\0.8177800538741106.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
