I think I have a virus...I'm not sure because I don't have a virus scanner. But whenever I go to run and type in msconfig or regedit, the window closes automatically and very fast. So I'm like wtf? So I try to move very fast to see what's starting up and I notice a file Winsock. I try to uncheck it but it keeps coming back. So when i look for the file, wuaumqr.exe, I try to delete it, but it says I can't because the file is in use. It's in the windows/system files. I was wondering if that file could be the problem? And I was wondering if I can delete it in ms-dos?

Hijack This!
Spybot 1.2 (first thing to do is update the definitions for these programs)
AdAware
Run these 3 programs in the above order.
http://www.spywareinfo.com/articles/hijacked/#removal
http://www.tek-tips.com/gviewthread.cfm/lev2/67/lev3/70/pid/779/qid/647594
Don't waste time with dos unless you are running F-Prot antivirus from dos.You have a problem affecting the IE and you need to do some cleaning.The above 3 programs are run from Windows.Good luck.

Hi lbkhmerpimp, Petit Jean, hi everyone,

OK I agree with Petit Jean but prior to scanning, empty any Temporary folder: Cookies (unless you've some useful ones), Temp, Temporary Internet Files

I wouldn't be surprised if your virus were W32.Spybot.Worm

Have a good day,
Gérard from Paris, France

lbkhmerpimp, Follow the instructions at the link below to get rid of that "W32.Spybot.Worm" including the part:

"Note: Due to certain malware functionalities, you will need a third party process viewer to terminate the malware in memory. TrendLabs recommends using Process Explorer from Sysinternals".

You must End Process on the "WUAUMQR.EXE" file to be able to get rid of it.

W32.Spybot.Worm Removal Instructions

HTH
Tufenuf

For the future, did you know that you can download AVG Anti-Virus with regular updates, all free? It's not bloatware and it works fine.

Derek

the file wuaumqr isn't even in task manager, so it's kinda hard for me to close it. I was trying to do that so I can just delete the wuaumqr.exe in my systems file.

lbk ..
>>not sure because I don't have a virus scanner.

So you like playin' Russian Roulette with a machine gun .. don't come cryin' here. You have been adequately warned... from Derek .. and me. Don't want to hear from you about a virus again .. you're self-infected.

Don

Did you follow the instructions from the link I gave you in Response Number 3 and run the Free on-line virus scanner (Housecall)?

Running TREND MICRO Antivirus

Scan your system with TREND MICRO antivirus and delete all files detected as WORM_SPYBOT.G. To do this, TREND MICRO customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, TREND MICRO’s free online virus scanner.

Tufenuf

umm...the page is in russian???? I'm not sure what language, kinda hard to translate and navigate.

Below is the English link for the Free Housecall online virus scan.

Housecall Virus Scan

Tufenuf

I just got this by my girlfriend clicking on a bad link in AOL Instant Messanger. HouseCall was unable to clear the wuaumqr.exe file because it was currently in use. When I used a third party program (jbv) to clear my registry, it popped back up again, even before restarting windows.

My solution:
On win2k, i popped in a Win ME boot disk, manually unhid the file in \system32 (attrib c:\windows\system32\wuaumqr.exe -H) and then erased it. (erase c:\windows\system32\wuaumqr.exe)
Reboot windows, THEN cleared the registry. Problem solved.

I realize this can be an intensive method, but hey, I'm oldschool. =) Just might be an alternative to the people unable to get it cleared with Housecall and other utilities.

-MT
-MTS-Internet Radio-