wuauclt and process guard

[Guest]

I have racked my little brain and could use a little help:

Below are two forms of code trying to execute on my XP-Media Center 2005. I
have had security issues and run multiple anti-virus, spyware, rootkit and
Norton Internet Security 2005 programs Also running WormGuard, and
ProcessGuard which is where the info. came from.


c:\windows\svchost.exe wants to launch 2 examples of 4 combinations:


"c:\windows\system32\wuauclt.exe" /runstoreascomserver local\[354]
susds462a883070b44b4fa1cda34bd2871fb2 (51 KB)


"c:\windows\system32\wuauclt.exe" /runstoreascomserver local\[354]
susdscd32cbf7e284aa488544f8494cafa75d



Are these legitimate Microsoft applications being launched for update
purposes? I checked to see if part of an update and can not find that they
are. No released updates on the days these tried to run. On the other hand,
I have never been able to install updates from windows update manually

Thank You for any assistance.

 

[MowGreen [MVP]]

Yes, they are legitimate. wuacult.exe is the Windows Update Client that
is connecting to the MS servers to check if any updates are available.
The Automatic Updates service is running it.

On the other hand,
I have never been able to install updates from windows update manually

Either NIS or ProcessGuard are preventing updates from installing. Have
you allowed wuauclt.exe access to the net when ProcessGuard brings up
those messages ?

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============

I have racked my little brain and could use a little help:

Below are two forms of code trying to execute on my XP-Media Center 2005. I
have had security issues and run multiple anti-virus, spyware, rootkit and
Norton Internet Security 2005 programs Also running WormGuard, and
ProcessGuard which is where the info. came from.


c:\windows\svchost.exe wants to launch 2 examples of 4 combinations:


"c:\windows\system32\wuauclt.exe" /runstoreascomserver local\[354]
susds462a883070b44b4fa1cda34bd2871fb2 (51 KB)


"c:\windows\system32\wuauclt.exe" /runstoreascomserver local\[354]
susdscd32cbf7e284aa488544f8494cafa75d



Are these legitimate Microsoft applications being launched for update
purposes? I checked to see if part of an update and can not find that they
are. No released updates on the days these tried to run. On the other hand,
I have never been able to install updates from windows update manually

Thank You for any assistance.