wuauclt.exe

[ozzy]

I suddenly noticed wuauclt.exe is a running process on my
XP SP2 machine. It was very recently that it started
showing up and I have windows update turned off. I've
searched elsewhere, and one virus was mentioned but i
came back negative on everything with it. Some backdoor
virus that copies this filename in, but i have no run key
entry to start it. I have no idea what is starting it.
It's hogging resources and if I kill it, i can still go
to windows update w/o a problem. Anyone else notice this?
thanks.

 

[David H. Lipman]

1) Download the following three items...

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend signature files.
http://www.trendmicro.com/download/pattern.asp

Adaware SE
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download sysclean.com and place it in that directory.
Dowload the signature files (pattern files) by obtaining the ZIP file.
For example; lpt186.zip

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
3) Reboot your PC into Safe Mode
4) Using both the Trend Sysclean utility and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
5) Restart your PC and perform a "final" Full Scan of your platform using both the
Trend Sysclean utility and Adaware
6) If you are using WinME or WinXP,Re-enable System Restore and re-apply any
System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
7) Reboot your PC.
8) If you are using WinME or WinXP, create a new Restore point
9) Please report back your results

Dave





| I suddenly noticed wuauclt.exe is a running process on my
| XP SP2 machine. It was very recently that it started
| showing up and I have windows update turned off. I've
| searched elsewhere, and one virus was mentioned but i
| came back negative on everything with it. Some backdoor
| virus that copies this filename in, but i have no run key
| entry to start it. I have no idea what is starting it.
| It's hogging resources and if I kill it, i can still go
| to windows update w/o a problem. Anyone else notice this?
| thanks.
|