wrd.exe / "Microsoft Up Machine"

A few days ago I installed XP SP1 and a few updates on my
PC. Now I find a file in my C:\windows\system32 folder
called wrd.exe that was created around the time I was
installing these. The file has three registry keys for it
to run at startup:
HKLM\software\microsoft\windows\currentversion\run,
HKLM\software\microsoft\windows\currentversion\runservices
and HKCU\software\microsoft\windows\currentversion\run,
all of which label it as "Microsoft Up Machine" - yet I
can't find anything about it anywhere and the file
doesn't have any Microsoft Corp. info in the file
properties so I'm suspicious - even if my antivirus
software doesn't detect anything.

Does anyone know what it is? Any info here would be
apprecaited.

Aaron,

This is not a standard out of the box Windows File put it that way. Is
your Anti-Virus up-to-date and have you scanned that specific file??. The
possibility is it could also be spyware or a virus, so you should get
something like Spybot or Adaware and run that also. May I suggest, firstly
scanning your machine online at:

http://housecall.trendmicro.com/

If that comes up clean, then I suggest downloading either of:

AdAware (www.lavasoftusa.com)

SpyBot (http://www.safer-networking.org/en/download/index.html)

Run on to clean any Adware e.t.c off you PC, and if the file still exists
post back.

Hope this helps

Mike Bright MCP, MSP

e:mike.bright@brightweb.co.uk

Well I checked for updates to my AV software (none), ran Housecall and
downloaded, installed and ran SpyBot S&D and none picked up the file. So I've
just moved it for the time being and rebooted. Everything seems to be ok
without the process running so I'll remove the registry entries eventually.

Thanks anyway

"Mike Bright MSP" wrote:

> Aaron,
>
> This is not a standard out of the box Windows File put it that way. Is
> your Anti-Virus up-to-date and have you scanned that specific file??. The
> possibility is it could also be spyware or a virus, so you should get
> something like Spybot or Adaware and run that also. May I suggest, firstly
> scanning your machine online at:
>
> http://housecall.trendmicro.com/
>
> If that comes up clean, then I suggest downloading either of:
>
> AdAware (www.lavasoftusa.com)
>
> SpyBot (http://www.safer-networking.org/en/download/index.html)
>
> Run on to clean any Adware e.t.c off you PC, and if the file still exists
> post back.
>
> Hope this helps
>
> Mike Bright MCP, MSP
>
> e:mike.bright@brightweb.co.uk
>
>
>