Possible Infection

[LilBob]

A friend gave me her laptop, Acer Aspire 5050 with XP Media Center SP 2, to clean out a virus. The PC was loaded with viruses,trojans, adware etc. which I was able to delete (mostly anyway). I was also able to repair her Internet connection (again, mostly). I'm able to connect to the Internet as welll as update some apps that I installed but there has to be something else I've missed. Certain apps, Avast, SUPERAntispyware & Windows Defender, to name a few, reply that they cannot connect to the server. I've been able to update only SpywareBlaster and Spybot S&D. In addition, I'm constantly nagged with an error message stating, 'wuauclt.exe has encountered an error and needs to close.' I stopped the Send/Don't Send only to get a Close option. Any suggestions as to what's causing this, how to stop it and why I'm selectively blocked from some sites would be greatly appreciated.

Thanks! Bob

 

[linney]

Have you tried your luck via "Safe Mode with Networking"?

WinXP Connectivity Issues
Lost Connectivity after Registry or Malware Cleanup
faq779-4625

Maybe reregistering some of the Windows Update .dll's mentioned in this article might help too?

You receive a "0x800A01AE" error message or a "0x080070570" error message when you try to connect to the Windows Update Web page or to the Microsoft Update Web page in Windows Server 2003 or Windows XP

http://support.microsoft.com/kb/910359

Try running ChkDsk to check your drive for errors. Right-click your Drive icon/ Properties/ Tools/ Error Checking. Select both boxes.

Run the System File Checker program from the Run Box by typing.....Sfc /Scannow in it and have your XP CD handy.

HOW TO: Verify Unsigned Device Drivers in Windows XP

http://support.microsoft.com/support/kb/articles/q308/5/14.asp

If they don't work you could try repairing windows by running it over itself. You will lose all your windows updates but your files will be untouched.

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/support/kb/articles/q315/3/41.asp

 

[LawnBoy]

wuauclt.exe is the windows update client. I've seen viruses (virii?) replace the original with their own copy. Try replacing it with a known good copy, or you could try reinstalling SP2. That should replace the file.

--
The stagehand's axiom: "Never lift what you can drag, never drag what you can roll, never roll what you can leave.

 

[tlcscousin]

Have you looked for settings in the host file blocking access to the update sites for the programs in question?

 

[LilBob]

Hello to all,
Thanks for your quick replies. Linney, I ran ChkDsk as you stated. All seemed to be going well as I was finally able to update SUPERAntiSpyware and Avast. While running SUPERAntiSPyware, I found 2 folders called FOUND.000 & 001 which I deleted. When the scan was completed, I deleted everything it found. I was prompted to reboot to complete the removal process which I did. On reboot, I was prompted again with 'To begin, click your user name.' Unfortunately, there were no user accounts to choose from. I tried rebooting in Safe Mode, Enable Boot Logging, Enable VGA Mode, Last Good Configuration, Directory Services Restore Mode and Debugging Mode: all to no avail. To add to the problem, my friend can’t find her Windows XP Media Center Reinstallation disc. I have mine for Home & Pro Editions but I don’t think that will work on her laptop. Anybody have any suggestions as to how to proceed? Thanks to all for your input.

Bob

 

[linney]

Are you seeing some form of a Welcome Screen when you say you see "To begin, click your user name". At that point can you Ctrl+Alt+Del (twice) to bring up the Classic Login Screen where you can type a username and password?

297221 - A User Account Does Not Appear in the User Accounts Tool (or Welcome Screen)

http://support.microsoft.com/default.aspx?scid=kb;en-us;297221&FR=1&PA=1&SD=HSCH

305281 - The "Welcome" Logon Screen Does Not Appear

http://support.microsoft.com/default.aspx?scid=kb;en-us;305281&FR=1&PA=1&SD=HSCH

331880 - No User Accounts Appear on the Welcome Screen After You Upgrade to Windows XP Home Edition

http://support.microsoft.com/default.aspx?scid=kb;en-us;331880&FR=1&PA=1&SD=HSCH

Replacement of CD or Product Keys.

To replace a CD or Product Key, you must contact PSS. To locate the appropriate phone number for your product, visit the following Microsoft Web site:

http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS

326246 - How to Replace Lost, Broken, or Missing Microsoft Software or Hardware

http://support.microsoft.com/default.aspx?scid=kb;en-us;326246&FR=1&PA=1&SD=HSCH

 

[LilBob]

Hi linney,
I guess I didn't explain the problem right. When I boot up the PC, the Windows logo comes on with the progress bar below it. The Acer logo screen appears briefly after that. I then get a blue screen with the M$ Windows XP Logo in the center and it stops there. No desktop icons, no task bar or anything else. I no longer get the prompt to select user name. Booting in safe mode gets me only that far as well. Any suggestions???

LilBob

 

[linney]

Apart from a repair install, other options available to you are mentioned in this thread, but remember any that involve restore points (if you have any) also involve possible re-infection.

Cannot logon to winxp...losing lots of valuable documents
thread779-975236

 

[trvlr1]

You should be able to get the correct discs from the manufacturer. Dell is good about sending out replacement discs free of charge, not sure about other companies. Of course you have to prove it's a legit copy, per their records.

 

[tlcscousin]

Are you able to get into safe mode command prompt only?
If so you can do a system restore (providing it was not shut off). This would reinfect the computer but at least you could then start over with trying to remove the infections.