I found out that the file is infected with the w32/sdbot.worm.gen.j virus. It
must be a recent variant because my McAfee antivirus didn't detect it, even
though I am running the latest definition files.
Steven, thanks for your response. The name of the file is actually
wuaucls.exe. Wuauclt.exe is a valid file as you mention but this is a
different file. I thank you for your response and will check the virus
scanners you suggest to see if those detect this type of virus.

"David" wrote:

> Recently some end users are unable to login. After they type the username and
> password, the sand glass appears and nothing happens. Only Task Manager is
> available, nothing else shows up on the screen. I have found that removing a
> file called wuaucls.exe allows them to login normally. this file is loaded
> several times, even as a service, and it is under a group called Windows
> Security Control. I have tried to find info regarding the file but strangely
> I haven't been able to find anything, only a couple of German pages that I
> can't read. I hope somebody can help on this one. thanks.

OK. Good luck with it. I guess I should have been more specific as I was
referring to that Wuauclt.exe was a legitimate file for the OS meaning that
wuaucls.exe was not but close enough to make many thing it might be. ---
Steve


"David" wrote in message
news:B7C76D96-59D3-4F50-BAD7-DE898658541F@microsoft.com...
> I found out that the file is infected with the w32/sdbot.worm.gen.j virus.
It
> must be a recent variant because my McAfee antivirus didn't detect it,
even
> though I am running the latest definition files.
> Steven, thanks for your response. The name of the file is actually
> wuaucls.exe. Wuauclt.exe is a valid file as you mention but this is a
> different file. I thank you for your response and will check the virus
> scanners you suggest to see if those detect this type of virus.
>
> "David" wrote:
>
> > Recently some end users are unable to login. After they type the
username and
> > password, the sand glass appears and nothing happens. Only Task Manager
is
> > available, nothing else shows up on the screen. I have found that
removing a
> > file called wuaucls.exe allows them to login normally. this file is
loaded
> > several times, even as a service, and it is under a group called Windows
> > Security Control. I have tried to find info regarding the file but
strangely
> > I haven't been able to find anything, only a couple of German pages that
I
> > can't read. I hope somebody can help on this one. thanks.