need help with removal of spyware wupdater.exe

[music1111]

Hi. My broter-in-law has a computer with WinXP and he now has spyware on it and the file is wupdater.exe. I have tried deleting this several ways. It won't close in the task menu, in fact the task menu is incomplete becasue of this thing and you can't stop any program. I tried removing it at its source folder, but you can't delete becasue it says it's in use. This thing runs upon boot and you can't end it. I then downloaded Spybot S&D and it detected it and then it said it fixed it. But, it's still alive and well and Spybot doesn't detect it anymore. When you shut down the computer it always gives you the box that shows that wupdater.exe is running and do you want to end it now. You have to click yes for the computer to shut down. Through research on the web, I haven't found more details on how to remove this thing. I thought Spybot would have done it. Does anyone have any suggestions on how to get rid of this thing? It really slows down the computer.

Thanks,
Christine

 

[THoey]

Try following this FAQ and then let us see what we can find after that...

http://www.tek-tips.com/faqs.cfm?spid=760&sfid=4866

Terry
**************************
* General Disclaimor - Please read *
**************************
Please make sure your post is in the CORRECT forum, has a descriptive title, gives as much detail to the problem as possible, and has examples of expected results. This will enable me and others to help you faster...

 

[carrr]

wupdater.exe is associated with the Keen Value parasite:

http://www.doxdesk.com/parasite/KeenValue.html

Try rebooting, coming in under Safe Mode, and deleting thusly. If the machine in question is running XP, you must disable system restore before you do removal, else ythe problem will come back:

http://service1.symantec.com/SUPPOR...2001111912274039?OpenDocument&src=sec_doc_nam

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[music1111]

THoey,

Do I have to get something else to run a hijackthis log? I never heard of it.

Christine

 

[music1111]

carrr,

what if the computer has the GoBack software installed on it. Will that affect the removal like you say system restore will?

Christine

 

[carrr]

You bet.

The log that THoey mentions is created by Hijack This!
It can be downloaded for free here:

http://mjc1.com/mirror/hjt/

"'Tis an ill wind that blows no minds." - Malaclypse the Younger