PCTech Forums

by **liljim** » Fri Apr 30, 2004 5:35 am

With all due respect...that doesnt mean it isnt there.Read the first link i gave you.

by **brad** » Fri Apr 30, 2004 10:10 am

Just to clairify:
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup is legit.
The Worm referred to inserts itself as:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Run "CriticalUpdate" = C:\WINDOWS\wucrtupd.exe
As for telling you to remove your AV, I disagree. As much as I despise NAV removing it and not installing another is asking for trouble.
brad

by **liljim** » Fri Apr 30, 2004 3:03 pm

Ah...i bow to the king. :classic:

by **Geekgirl** » Fri Apr 30, 2004 3:12 pm

ok now what? Brad clarified it was a worm whats steps do I take to remove. Obviously N.A.V. does not have the definition for it or it would of detected it. I do know how to edit registry but would like a more educated computer geek to point me in direction and proper way to remove. Thx for everyones help in advance.

by **liljim** » Fri Apr 30, 2004 3:37 pm

Brad is saying that this isnt a worm.

O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup

is not a bad entry as i said it was,i "jumped the gun" when going over your log.

The worm i thought you had would have the key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Run "CriticalUpdate" = C:\WINDOWS\wucrtupd.exe

You are clear...i apologize for the misdiagnosis and thank brad for correcting it.

by **Cactus** » Fri Apr 30, 2004 3:47 pm

by **liljim** » Fri Apr 30, 2004 4:59 pm

man im so lost now...im taking a vacation.

*Alright,look.

Geekgirl...you do not have the worm i said you did.This was an error on MY behalf.

The key i labeled worm was indeed a valid key.

The actual key that would have indicated you had said worm is not on your system,therefore your system is clean.

by **Cactus** » Fri Apr 30, 2004 5:04 pm

HeeHee....liljim

To many HiJackThis Logs!!

So the correct one to remove is:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Run "CriticalUpdate" = C:\WINDOWS\wucrtupd.exe

Is that right?

by **liljim** » Fri Apr 30, 2004 5:13 pm

IF it were there....yes

by **icecube** » Fri Apr 30, 2004 7:45 pm

by **brad** » Fri Apr 30, 2004 8:04 pm

by **Geekgirl** » Fri Apr 30, 2004 8:26 pm

by **liljim** » Fri Apr 30, 2004 9:11 pm

PCTech Forums

what tis it maaaan......

what tis it maaaan......

what tis it maaaan......

Who is online