Multiple copies of WUAUCLT.EXE files

G

Guest

I have 6 WUAUCLT.EXE files on my XP computer.
there are 2 in the System32 folder: WUAUCLT.EXE and WUAUCLT1.EXE
there are 2 in the i386 folder:WUAUCLT.EXE and WUAUCLT1.EXE
and 2 in the download Windows\SoftwareDistribution\Download
folder:WUAUCLT.EXE and WUAUCLT1.EXE

I also haven't rec'd a Windows Update since I downloaded SP2.

Do I have a Problem?


Thanks for your time
 
D

David H. Lipman

Sounds like you are infected !

1) Download the following four items...

McAfee Stinger
http://vil.nai.com/vil/stinger/

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download Sysclean.com and place it in that directory.
Dowload the Trend Pattern File by obtaining the ZIP file.
For example; lpt246.zip

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) Update Adaware with the latest definitions.
3) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode
5) Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using the three
utilities; Trend Sysclean, Stinger and Adaware
7) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) Create a new Restore point

You can also try some of the below online scanners.

BitDefender:
http://www.bitdefender.com/scan/license.php

Computer Associates:
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

DialogueScience:
http://www.antivir.ru/english/www_av/

F-Secure:
http://support.f-secure.com/enu/home/ols.shtml

Freedom Online scanner:
http://www.freedom.net/viruscenter/index.html

Kaspersky:
http://www.kaspersky.com/de/scanforvirus

McAfee:
http://www.mcafee.com/myapps/mfs/default.asp

Panda:
http://www.pandasoftware.com/activescan/

RAV
http://www.ravantivirus.com/scan/

Symantec:
http://security.symantec.com/

Trend:
http://housecall.antivirus.com
http://housecall.trendmicro.com


* * * Please report your results ! * * *

Dave





| I have 6 WUAUCLT.EXE files on my XP computer.
| there are 2 in the System32 folder: WUAUCLT.EXE and WUAUCLT1.EXE
| there are 2 in the i386 folder:WUAUCLT.EXE and WUAUCLT1.EXE
| and 2 in the download Windows\SoftwareDistribution\Download
| folder:WUAUCLT.EXE and WUAUCLT1.EXE
|
| I also haven't rec'd a Windows Update since I downloaded SP2.
|
| Do I have a Problem?
|
|
| Thanks for your time
 
G

Guest

Hi David,

I ran Sysclean it found no viruses. Many of the files that were written to
the log had "ACCESS is DENIED" at the end of the entry. I also ran Adaware
and Search & Destroy and deleted some entries from them.

Since I have 6 duplicate WUAUCLT files should I delete the wrong ones?
If so, which ones?
 
D

David H. Lipman

Use some of the online scanners such as; BitDefender, Panda, Freedom and DialogueScience.

In addition, you may want to submit WUAUCLT1.EXE to;
http://www.virustotal.com/flash/index_en.html this site will test the file against several
AV Vendors software and provide a results in a couple of minutes.

At this time, delete NONE.

Dave




| Hi David,
|
| I ran Sysclean it found no viruses. Many of the files that were written to
| the log had "ACCESS is DENIED" at the end of the entry. I also ran Adaware
| and Search & Destroy and deleted some entries from them.
|
| Since I have 6 duplicate WUAUCLT files should I delete the wrong ones?
| If so, which ones?
|
|
|
|
| "David H. Lipman" wrote:
|
| > Sounds like you are infected !
| >
| > 1) Download the following four items...
| >
| > McAfee Stinger
| > http://vil.nai.com/vil/stinger/
| >
| > Trend Sysclean Package
| > http://www.trendmicro.com/download/dcs.asp
| >
| > Latest Trend Pattern File.
| > http://www.trendmicro.com/download/pattern.asp
| >
| > Adaware SE (free personal version v1.05)
| > http://www.lavasoftusa.com/
| >
| > Create a directory.
| > On drive "C:\"
| > (e.g., "c:\New Folder")
| > or the desktop
| > (e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")
| >
| > Download Sysclean.com and place it in that directory.
| > Dowload the Trend Pattern File by obtaining the ZIP file.
| > For example; lpt246.zip
| >
| > Extract the contents of the ZIP file and place the contents in the same directory as
| > sysclean.com.
| >
| > 2) Update Adaware with the latest definitions.
| > 3) Disable System Restore
| > http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
| > 4) Reboot your PC into Safe Mode
| > 5) Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of your
| > platform and clean/delete any infectors/parasites found.
| > (a few cycles may be needed)
| > 6) Restart your PC and perform a "final" Full Scan of your platform using the three
| > utilities; Trend Sysclean, Stinger and Adaware
| > 7) Re-enable System Restore and re-apply any System Restore preferences,
| > (e.g. HD space to use suggested 400 ~ 600MB),
| > 8) Reboot your PC.
| > 9) Create a new Restore point
| >
| > You can also try some of the below online scanners.
| >
| > BitDefender:
| > http://www.bitdefender.com/scan/license.php
| >
| > Computer Associates:
| > http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
| >
| > DialogueScience:
| > http://www.antivir.ru/english/www_av/
| >
| > F-Secure:
| > http://support.f-secure.com/enu/home/ols.shtml
| >
| > Freedom Online scanner:
| > http://www.freedom.net/viruscenter/index.html
| >
| > Kaspersky:
| > http://www.kaspersky.com/de/scanforvirus
| >
| > McAfee:
| > http://www.mcafee.com/myapps/mfs/default.asp
| >
| > Panda:
| > http://www.pandasoftware.com/activescan/
| >
| > RAV
| > http://www.ravantivirus.com/scan/
| >
| > Symantec:
| > http://security.symantec.com/
| >
| > Trend:
| > http://housecall.antivirus.com
| > http://housecall.trendmicro.com
| >
| >
| > * * * Please report your results ! * * *
| >
| > Dave
| >
| >
| >
| >
| >
| > | > | I have 6 WUAUCLT.EXE files on my XP computer.
| > | there are 2 in the System32 folder: WUAUCLT.EXE and WUAUCLT1.EXE
| > | there are 2 in the i386 folder:WUAUCLT.EXE and WUAUCLT1.EXE
| > | and 2 in the download Windows\SoftwareDistribution\Download
| > | folder:WUAUCLT.EXE and WUAUCLT1.EXE
| > |
| > | I also haven't rec'd a Windows Update since I downloaded SP2.
| > |
| > | Do I have a Problem?
| > |
| > |
| > | Thanks for your time
| >
| >
| >
 
G

Guest

I submitted the WUAUCLT1.EXE to Virus Total and it came back without an error
message. It listed all the AV software and the Result field was blank.
 
W

Wesley Vogel

No, you do not have a problem.

Both wuauclt.exe and wuauclt1.exe are Windows Update AutoUpdate Client.

wuauclt1.exe is from Microsoft Windows XP Service Pack 2.

Those who do not have SP2 will not have wuauclt1.exe.


The two in WINDOWS\SoftwareDistribution\Download folder are from SP2.

The two in WINDOWS\system32 folder are the ones that are actually used.

The two in the i386 folder are backups.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top