Member Avatar for james_eblin

I suspect that my wscntfy.exe and wuauclt.exe have either been corrupted or ifected with a virus. I have been working on fixing this on/off for a week and found no solution

My problem is wscntfy.exe is spamming me with pop up messages in the lower right corner tool bar "Your computer might be at risk Automatic Updates are turned off click this bubble to fix this problem" every time I go to task manager and try to end wscntfy.exe another shield icon apears and tells me the same thing as the other if I try to end both I get a third shield and message. I did a search on mycomputer and found two copies of wscntfy.exe in my system 32 folder. I deleated them but after I did four more copies apeard a few seconds later. I immiedetley saw red flags and yanked my internet. I did multiple scans with: Spybot Search and destroy, ad-aware se, and e-z antivirus, all came up clean.

ever sense wscntfy.exe started giving me problems I noticed multiple copies of svchost.exe running in the background and my computer has slowed down.

I'll write down a list of running tasks and and my xp version when i get home and post them tomorrow (i'm using a public library computer)

  • 2 Contributors
  • 7 Replies
  • 277 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by gerbil

Dani AI

Generated

As described, the repeated “Your computer might be at risk” bubbles and copies of wscntfy.exe / wuauclt.exe are alarming — but the behavior you see can come from two different things: legitimate Windows file‑protection/repair or a cleverly named malware. Both executables are standard Windows components, and Windows can and will replace protected system files it thinks are missing, which explains why deleted copies sometimes reappear. That alone does not prove an infection.

Practical checks to tell the difference:

  • Use Task Manager or, better, Sysinternals Process Explorer to right‑click the running process and choose “Open File Location” or view Properties. Note the full path.
  • Check the file Properties → Digital Signatures and Publisher. Legitimate files normally live in C:\Windows\System32 and are signed by Microsoft.
  • If a file with the same name is running from a temp, user profile, or random folder, or is unsigned, treat it as suspicious.

If it looks suspicious, follow this order:

  • Update signatures and run a full scan with a reputable anti‑malware product (preferably an offline/bootable scanner or Microsoft Defender Offline).
  • Submit the exact EXE to a multi‑engine scanner for a second opinion.
  • Do not keep deleting System32 files by hand. Instead run sfc /scannow from an elevated command prompt to verify/repair protected system files, and use Autoruns to inspect startup items. If copies still reappear despite all that, run a trusted rootkit scanner or perform an offline rescue scan, and back up personal data for an image/repair or clean reinstall if needed.

For followup, post the full file paths you found, the Publisher shown in Properties, and any odd startup entries. Multiple svchost processes are normal and not by themselves a sign of compromise. Thanks to for the initial troubleshooting direction — the checks above will help confirm whether this is just Windows restoring protected files or a real infection.

Recommended Answers

All 7 Replies

Member Avatar for gerbil

Try this scanning site: http://virusscan.jotti.org/ - either paste into the box the pathname of each file [eg C:\windows\system32\wscntfy.exe] or browse to them. Post the results.
==Get CCleaner from http://www.ccleaner.com/ - and put it in a new folder. You should aim to keep this one for general use. I set it from the installation checkboxes to only open from the recycle bin. It's neater that way.
Now run CCleaner from the recycle bin rclick menu using its default settings [if you set up CCleaner as i suggested, rclicking the bin icon should give you the Open CCleaner option...]. Select the Cleaner icon, press Run Cleaner.
[For future quick temp file cleaning select the options you wish to use via the Windows and Applications tabs .. ]
==Please use IE to do an online scan at panda:- http://www.pandasoftware.com/products/activescan?
-select a link to the scan... free online virus scan...., enter a valid? email and follow through, choosing My Computer for a full system scan.
Post the log it produces here.
Post a hijackthis log:
==download hijackthis: http://www.majorgeeks.com/download5554.html
-install it to a new folder alongside your program files and then
-in that folder start HijackThis by dclicking the .exe; now close ALL other applications and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button.

Member Avatar for james_eblin

Try this scanning site: http://virusscan.jotti.org/ - either paste into the box the pathname of each file [eg C:\windows\system32\wscntfy.exe] or browse to them. Post the results.
==Get CCleaner from http://www.ccleaner.com/ - and put it in a new folder. You should aim to keep this one for general use. I set it from the installation checkboxes to only open from the recycle bin. It's neater that way.
Now run CCleaner from the recycle bin rclick menu using its default settings [if you set up CCleaner as i suggested, rclicking the bin icon should give you the Open CCleaner option...]. Select the Cleaner icon, press Run Cleaner.
[For future quick temp file cleaning select the options you wish to use via the Windows and Applications tabs .. ]
==Please use IE to do an online scan at panda:- http://www.pandasoftware.com/products/activescan?
-select a link to the scan... free online virus scan...., enter a valid? email and follow through, choosing My Computer for a full system scan.
Post the log it produces here.
Post a hijackthis log:
==download hijackthis: http://www.majorgeeks.com/download5554.html
-install it to a new folder alongside your program files and then
-in that folder start HijackThis by dclicking the .exe; now close ALL other applications and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button.

I am going to do as you said and will post results as soon as I do

Member Avatar for james_eblin

I restared my computer and ran hijack this as soon as my cumputer finished starting up, these are the results:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:14:37 PM, on 8/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-\QOELoader.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program files\steam\steam.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Steam\SteamApps\jim_bob7\GarrysMod\garrysmod\addons\HiJackThis.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-\QOELoader.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Startup: MagicDisc.lnk.disabled
O4 - Startup: TA_Start.lnk.disabled
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmwsock.dll
O15 - Trusted Zone: *.drivecleaner.com
O15 - Trusted Zone: *.errorprotector.com
O15 - Trusted Zone: http://www.rr.com
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.
O15 - Trusted Zone: *.winantivirus.com
O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} (Support.com ActionRunner Class) -
O16 - DPF: {08BCD971-A13B-4D6E-A2A5-E9B2324FC00D} (ClientEXE Class) -
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) -
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) -
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) -
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) -
O22 - SharedTaskScheduler: depreciable - {716002db-288c-4bf0-80cd-a467e78d8b55} - C:\WINDOWS\system32\dxovx.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 7258 bytes

After looking through the log file I'm worried about my svchost.exe I did what I did with wscntfy.exe and it made copies just like wscntfy.

Member Avatar for gerbil

Ignore wscntfy and svchost, they are fine. Svchost generaly has multiple instances running as it handles threads from different applications.
Start hijackthis, select Scan Only, place checkmarks against all the entries listed below that still exist, and then press Fix Checked.

O4 - Startup: MagicDisc.lnk.disabled
O4 - Startup: TA_Start.lnk.disabled
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: *.drivecleaner.com
O15 - Trusted Zone: *.errorprotector.com
O15 - Trusted Zone: http://www.rr.com
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.
O15 - Trusted Zone: *.winantivirus.com
O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} (Support.com ActionRunner Class) -
O22 - SharedTaskScheduler: depreciable - {716002db-288c-4bf0-80cd-a467e78d8b55} - C:\WINDOWS\system32\dxovx.dll (file missing)

LSPFIX:
==Download LSPfix from here http://cexx.org/LSPFix.exe -start it by dclicking the .exe....
On the opening screen, click the "I know what I'm doing" checkbox. Check all instances of "tmwsock.dll" (and nothing else), and move them to the "Remove" pane. Then click Finish.
Delete these files :
C:\WINDOWS\system32\tmwsock.dll

Combofix:
==Download this file to your desktop:
- to run it dclick combofix.exe and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log plus a fresh hijackthis scan in your next reply.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.


Say how things are...

Member Avatar for gerbil

system32\wscntfy.exe: vsn 5.1.2600.2180 size 13.5kb.
There will be another copy in system32\dllcache [this is normally hidden]
There can NOT be multiple copies of it in system32.

Member Avatar for james_eblin

Sorry I wasn't very clear about what is actually happenning, I was using windows search when I kept finding multiple copies in my first post

This is what is really happening:
every time i delete the wuauclt.exe it goes to the recycle bin. Then a few seconds later a copy of the file with the same name reapears in system 32. i open the recycle bin and find the original file still there so I delete the copy and a few secons later another apears.

I ran hijckthis and deleted everything you told me to.

I don't know if the wuauclt.exe should be reapering like that. if it is, sorry for wasting your time, i just really don't trust windows security center, I had a bad experience with a virus imitating it that was called wuuaclt.exe on my old computer.

Member Avatar for gerbil

windows will automatically replace protected system files from its cache.
If you doubt a file, check its properties, if you still doubt it, submit a copy to that scanner address I gave you above...

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.