wauclt.exe

[John]

I realised this was taking a lot of time and memory at start up and did some
checking around.
I have it in the following locations:

c:\windows\prefetch
c:\windows\system32 - twice - once with a "1" in the filename ie wauclt1
c:\windows\ERDT\cache
c:\windows\servicepackfiles\i386 - twice - once with a "1" in the filename
ie wauclt1
c:\windows\system32\dllcache -- twice - once with a "1" in the filename ie
wauclt1

Some date back to 2005.

Should I be concerned?

Should I remove any?

 

[Jose]

I realised this was taking a lot of time and memory at start up and did some
checking around.
I have it in the following locations:

c:\windows\prefetch
c:\windows\system32  - twice - once with a "1" in the filename ie wauclt1
c:\windows\ERDT\cache
c:\windows\servicepackfiles\i386 - twice - once with a "1" in the filename
ie wauclt1
c:\windows\system32\dllcache -- twice - once with a "1" in the filename ie
wauclt1

Some date back to 2005.

Should I be concerned?

Should I remove any?

Do you mean wuauclt.exe?

wuauclt.exe is part of the Windows Automatic Update Client and is
normally configured as the Automatic Updates service that runs
automatically under one of your svchost.exe Processes that you see in
Task manager.

You can download Process Explorer to determine which svchost is
running wuauclt.exe if you are interested in that:

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

How did you realize that it was taking a lot of time and memory at
startup?

In a general configuration, there should be no wauclt1.exe in system32
or dllcache. If there is, something may have gone wrrong somewhere
along the way, some kind of reinstall or your system is afflicted with
malicious software.

If Process Explorer says wuauclt1.exe is running, that is not normal.

There is probably a reference to wuauclt.exe...pf in the prefetch
folder and that is fine.

I do not have the ERDT folder, but depending on your system history
and what you have installed, you might.

Perform some scans for malicious software first, then fix any
remaining issues:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

They can be uninstalled later if desired.

 

[John]

I realised this was taking a lot of time and memory at start up and did
some
checking around.
I have it in the following locations:

c:\windows\prefetch
c:\windows\system32 - twice - once with a "1" in the filename ie wauclt1
c:\windows\ERDT\cache
c:\windows\servicepackfiles\i386 - twice - once with a "1" in the filename
ie wauclt1
c:\windows\system32\dllcache -- twice - once with a "1" in the filename ie
wauclt1

Some date back to 2005.

Should I be concerned?

Should I remove any?

Do you mean wuauclt.exe?

wuauclt.exe is part of the Windows Automatic Update Client and is
normally configured as the Automatic Updates service that runs
automatically under one of your svchost.exe Processes that you see in
Task manager.

You can download Process Explorer to determine which svchost is
running wuauclt.exe if you are interested in that:

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

How did you realize that it was taking a lot of time and memory at
startup?

In a general configuration, there should be no wauclt1.exe in system32
or dllcache. If there is, something may have gone wrrong somewhere
along the way, some kind of reinstall or your system is afflicted with
malicious software.

If Process Explorer says wuauclt1.exe is running, that is not normal.

There is probably a reference to wuauclt.exe...pf in the prefetch
folder and that is fine.

I do not have the ERDT folder, but depending on your system history
and what you have installed, you might.

Perform some scans for malicious software first, then fix any
remaining issues:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

They can be uninstalled later if desired.

Thanks Jose. Yes - wuauclt.

I have malwarebytes and Process Explorer.

I noticed the programme running from Task Manager when I was checking to see
why there was a delay (after AVG had loaded) before I could start a
programme. wuauclt was one of them.
I have now removed some versions to a sentencing folder and the PC started
ok with the version in System32. Should I also remove the version with a "1"
in its name?

 

[Jose]

Do you mean wuauclt.exe?

wuauclt.exe is part of the Windows Automatic Update Client and is
normally configured as the Automatic Updates service that runs
automatically under one of your svchost.exe Processes that you see in
Task manager.

You can download Process Explorer to determine which svchost is
running wuauclt.exe if you are interested in that:

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

How did you realize that it was taking a lot of time and memory at
startup?

In a general configuration, there should be no wauclt1.exe in system32
or dllcache.  If there is, something may have gone wrrong somewhere
along the way, some kind of reinstall or your system is afflicted with
malicious software.

If Process Explorer says wuauclt1.exe is running, that is not normal.

There is probably a reference to wuauclt.exe...pf in the prefetch
folder and that is fine.

I do not have the ERDT folder, but depending on your system history
and what you have installed, you might.

Perform some scans for malicious software first, then fix any
remaining issues:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM):  http://malwarebytes.org/
SUPERAntiSpyware: (SAS):  http://www.superantispyware.com/

They can be uninstalled later if desired.

Thanks Jose. Yes - wuauclt.

I have malwarebytes and Process Explorer.

I noticed the programme running from Task Manager when I was checking to see
why there was a delay (after AVG had loaded) before I could start a
programme. wuauclt was one of them.
I have now removed some versions to a sentencing folder and the PC started
ok with the version in System32. Should I also remove the version with a "1"
in its name?

I do not see wuauclt running in TM as a single process - it runs
"under" one of my svchost processses, which is how it should be. I
can only see it through Process Explorer.

If I stop the AU service and restart it, then wuauclt starts as its
own process and can be seen separately in TM but things go back to
normal when I reboot.

All this makes sense.

If you reboot your system, do you see wuauclt in TM as a separate
process?

I have no idea how you got some versions with "1", but it doesn't make
sense for something like that to be in system32 or dllcache. You
could sentence (move) them to some other folder and remove them from
system32 and dllcache - they do not belong there, reboot and then
troubleshoot any remaining issues.

When you are done poking around, reboot and make sure the AU service
is running and set to automatic in the Services applet:

%SystemRoot%\system32\services.msc /s

Then and see if wuauclt appears as a separate running Process in TM.

 

[Patrick Keenan]

I realised this was taking a lot of time and memory at start up and did
some checking around.
I have it in the following locations:

c:\windows\prefetch
c:\windows\system32 - twice - once with a "1" in the filename ie wauclt1
c:\windows\ERDT\cache
c:\windows\servicepackfiles\i386 - twice - once with a "1" in the filename
ie wauclt1
c:\windows\system32\dllcache -- twice - once with a "1" in the filename ie
wauclt1

Some date back to 2005.

Should I be concerned?

Should I remove any?

No, you should not. This is the Automatic Windows Update client, so
officially, it's "safe". However, it is not appropriate for it to run on
all systems or internet connections; if you are using dialup, for example,
or an older system, you do *not* want to allow this to run whenever it feels
like it. On some systems, the check for updates can effectively disable the
machine for five to ten minutes or more.

On such systems, it's a better idea to simply set Automatic Windows Update
to OFF. Then, reboot. The system will start faster; you will have to
make a practice of manually checking for updates. To do that, open
Internet Explorer, and under TOOLS, select WINDOWS UPDATE. Large updates,
such as XP SP3, should be downloaded using a faster system with a high-speed
connection, then burned to CD or copied to a flash drive, and installed
offline.

HTH

 

[Richard]

I do not see wuauclt running in TM as a single process - it runs
"under" one of my svchost processses, which is how it should be. I
can only see it through Process Explorer.

If I stop the AU service and restart it, then wuauclt starts as its
own process and can be seen separately in TM but things go back to
normal when I reboot.

All this makes sense.

If you reboot your system, do you see wuauclt in TM as a separate
process?

I have no idea how you got some versions with "1", but it doesn't make
sense for something like that to be in system32 or dllcache. You
could sentence (move) them to some other folder and remove them from
system32 and dllcache - they do not belong there, reboot and then
troubleshoot any remaining issues.

When you are done poking around, reboot and make sure the AU service
is running and set to automatic in the Services applet:

%SystemRoot%\system32\services.msc /s

Then and see if wuauclt appears as a separate running Process in TM.

- - -

Hi Jose,

There seems to be some confusion surrounding Windows Update stuff.

Your message was the first I read after starting my computer and starting
Outlook Express. I checked Task Manager, and wauclt.exe appeared in the
processes tab after the last SysTray item and before msimn.exe (Outlook
Express). When I got to the last line in your message TM blinked, and the
process wauclt.exe was gone. The elapsed time it was active was about 5
minutes. (Probably a 600 second timeout, since I was not connected to the
internet.) I used "tasklist /svc" to check, and in the svchost.exe process
with 29 services, "wuauserv" is one of them. My Automatic Updates is set
to notify. Have you checked TM for wauclt.exe immediately after starting?

I have no idea how you got some versions with "1", but it doesn't make
sense for something like that to be in system32 or dllcache. You
could sentence (move) them to some other folder and remove them from
system32 and dllcache - they do not belong there, reboot and then
troubleshoot any remaining issues.

Windows XP installation setup puts them there for a reason. Windows File
Protection puts a copy in dllcache for a reason. Look in your i386 folder
on your local drive, or your WinXP setup CD:

D:\I386
WUAU.AD_ becomes: wuau.adm in INF and system32\GroupPolicy\Adm
WUAU.CH_ becomes: wuau.chm in %windir%\help
WUAUCLT.EX_ becomes: wuauclt.exe in system32 and dllcache
WUAUCLT1.EX_ becomes: wuauclt1.exe in system32 and dllcache
WUAUCPL.CP_ becomes: wuaucpl.cpl in system32 and dllcache
WUAUENG.DL_ becomes: wuaueng.dll in system32 and dllcache
WUAUENG1.DL_ becomes: wuaueng1.dll in system32 and dllcache
WUAUHELP.CH_ becomes: wuauhelp.chm in %windir%\help
WUAUSERV.DL_ becomes: wuauserv.dll in system32 and dllcache

wuau.chm = The help file for the Group Policy settings for Automatic
Updates ADM File: wuau.adm [an Administrative template]

wuauhelp.chm = The main help file for Automatic Updates

wuauclt.exe - Windows Update - [Digitally Signed]
Version: 7.4.7600.226 (winmain_wtr_wsus3sp2(wmbla).090806-1834)

wuauclt1.exe - Windows Update AutoUpdate Client
Version: 5.4.3790.5512 (xpsp.080413-0852)

wuaucpl.cpl - Automatic Updates Control Panel - [Digitally Signed]
Version: 7.4.7600.226 (winmain_wtr_wsus3sp2(wmbla).090806-1834)

wuaucpl.cpl.manifest - 749 bytes
[apparently an XML publicKeyToken document]

wuaucpl.cpl.mui - Automatic Updates Control Panel - [Digitally Signed]
Version: 7.4.7600.226 (winmain_wtr_wsus3sp2(wmbla).090806-1834)
[apparently dialog box messages and controls]

wuaueng.dll - Windows Update Agent - [Digitally Signed]
Version: 7.4.7600.226 (winmain_wtr_wsus3sp2(wmbla).090806-1834)

wuaueng.dll.mui - Windows Update Agent - [Digitally Signed]
Version: 7.4.7600.226 (winmain_wtr_wsus3sp2(wmbla).090806-1834)
[MUI = Multilingual User Interface]

wuaueng1.dll - Windows Update AutoUpdate Engine
Version: 5.4.3790.5512 (xpsp.080413-0852)

wuauserv.dll - Windows Update AutoUpdate Service
Version: 5.4.3790.5512 (xpsp.080413-0852)

How do I reset Windows Update components
http://support.microsoft.com/kb/971058
(Check out how many other DLL's are involved with Windows Update.)

How to obtain the latest version of the Windows Update Agent
http://support.microsoft.com/kb/949104

Windows Update website:
http://update.microsoft.com/windowsupdate/v6/default.aspx

How to read the Windowsupdate.log file
http://support.microsoft.com/kb/902093

During the normal 23 seconds from the time Windows began to load, until my
desktop was full operational and ready for me to start, the Windows Update
process apparently used .485 seconds of time, of which most was idle.
However, my computer does not automatically connect to the internet when it
starts so YMMV. (Your Mileage May Vary.)

(Triple-click here, to be of good cheer.
--Richard

- - -
Special Veteran's Day Remembrance
http://www.avbtab.org/rc/veterans.htm

 

[Richard]

:
No, you should not. This is the Automatic Windows Update client, so
officially, it's "safe". However, it is not appropriate for it to run
on all systems or internet connections; if you are using dialup, for
example, or an older system, you do *not* want to allow this to run
whenever it feels like it. On some systems, the check for updates can
effectively disable the machine for five to ten minutes or more.

Hi Patrick,

My system has never been disabled for even 1 second during a check. There
have been server delays on the other end, but I could continue doing
whatever else I wanted with the computer. Just because the dialup download
speed is slower doesn't mean other computer programs get sluggish either.

On such systems, it's a better idea to simply set Automatic Windows
Update to OFF. Then, reboot. The system will start faster; you will
have to make a practice of manually checking for updates. To do that,
open Internet Explorer, and under TOOLS, select WINDOWS UPDATE.
Large updates, such as XP SP3, should be downloaded using a faster
system with a high-speed connection, then burned to CD or copied to a
flash drive, and installed offline.

It is not a good idea to turn it off completely. With mine set to notify,
about 1/2 second cpu time is consumed once every 5 hours. That is totally
NOT a big deal! On another machine here with Home Edition and a processor
about half as fast, SP3 downloaded and installed without a glitch. You're
right that a high-speed connection for large files speeds up the process,
but with BITS (Background Intelligent Transfer Service) the downloads from
Windows Update can proceed gradually during idle time, without interfering
with other activities of the computer. When you download with a browser,
it downloads things while YOU wait, but AU with BITS, waits for you.

In the wuau.chm help file topic on "How does Automatic Updates work?" It
says: "It makes no difference whether you use a dial-up or broadband
connection; important updates are downloaded behind the scenes and do not
interfere with other downloads. If you disconnect from the Internet before
updates are fully downloaded, nothing is lost. The download process will
continue the next time you connect to the Internet."

Windows Update website:
http://update.microsoft.com/windowsupdate/v6/default.aspx

How to read the Windowsupdate.log file
http://support.microsoft.com/kb/902093

HTH. (Hope This Helps.
--Richard

- - -
Special Veteran's Day Remembrance
http://www.avbtab.org/rc/veterans.htm

 

[Jose]

I do not see wuauclt running in TM as a single process - it runs
"under" one of my svchost processses, which is how it should be.  I
can only see it through Process Explorer.

If I stop the AU service and restart it, then wuauclt starts as its
own process and can be seen separately in TM but things go back to
normal when I reboot.

All this makes sense.

If you reboot your system, do you see wuauclt in TM as a separate
process?

I have no idea how you got some versions with "1", but it doesn't make
sense for something like that to be in system32 or dllcache.  You
could sentence (move) them to some other folder and remove them from
system32 and dllcache - they do not belong there, reboot and then
troubleshoot any remaining issues.

When you are done poking around, reboot and make sure the AU service
is running and set to automatic in the Services applet:

%SystemRoot%\system32\services.msc /s

Then and see if wuauclt appears as a separate running Process in TM.

- - -

Hi Jose,

There seems to be some confusion surrounding Windows Update stuff.

Your message was the first I read after starting my computer and starting
Outlook Express. I checked Task Manager, and wauclt.exe appeared in the
processes tab after the last SysTray item and before msimn.exe (Outlook
Express). When I got to the last line in your message TM blinked, and the
process wauclt.exe was gone. The elapsed time it was active was about 5
minutes. (Probably a 600 second timeout, since I was not connected to the
internet.) I used "tasklist /svc" to check, and in the svchost.exe process
with 29 services,  "wuauserv" is one of them. My Automatic Updates is set
to notify. Have you checked TM for wauclt.exe immediately after starting?

I have no idea how you got some versions with "1", but it doesn't make
sense for something like that to be in system32 or dllcache.  You
could sentence (move) them to some other folder and remove them from
system32 and dllcache - they do not belong there, reboot and then
troubleshoot any remaining issues.

Windows XP installation setup puts them there for a reason. Windows File
Protection puts a copy in dllcache for a reason. Look in your i386 folder
on your local drive, or your WinXP setup CD:

D:\I386
WUAU.AD_        becomes: wuau.adm      in INF and system32\GroupPolicy\Adm
WUAU.CH_        becomes: wuau.chm      in %windir%\help
WUAUCLT.EX_     becomes: wuauclt.exe   in system32 and dllcache
WUAUCLT1.EX_    becomes: wuauclt1.exe  in system32 and dllcache
WUAUCPL.CP_     becomes: wuaucpl.cpl   in system32 and dllcache
WUAUENG.DL_     becomes: wuaueng.dll   in system32 and dllcache
WUAUENG1.DL_    becomes: wuaueng1.dll  in system32 and dllcache
WUAUHELP.CH_    becomes: wuauhelp.chm  in %windir%\help
WUAUSERV.DL_    becomes: wuauserv.dll  in system32 and dllcache

wuau.chm = The help file for the Group Policy settings for Automatic
Updates ADM File: wuau.adm  [an Administrative template]

wuauhelp.chm = The main help file for Automatic Updates

wuauclt.exe - Windows Update - [Digitally Signed]
Version: 7.4.7600.226 (winmain_wtr_wsus3sp2(wmbla).090806-1834)

wuauclt1.exe - Windows Update AutoUpdate Client
Version: 5.4.3790.5512 (xpsp.080413-0852)

wuaucpl.cpl - Automatic Updates Control Panel - [Digitally Signed]
Version: 7.4.7600.226 (winmain_wtr_wsus3sp2(wmbla).090806-1834)

wuaucpl.cpl.manifest - 749 bytes
[apparently an XML publicKeyToken document]

wuaucpl.cpl.mui - Automatic Updates Control Panel - [Digitally Signed]
Version: 7.4.7600.226 (winmain_wtr_wsus3sp2(wmbla).090806-1834)
[apparently dialog box messages and controls]

wuaueng.dll - Windows Update Agent - [Digitally Signed]
Version: 7.4.7600.226 (winmain_wtr_wsus3sp2(wmbla).090806-1834)

wuaueng.dll.mui - Windows Update Agent - [Digitally Signed]
Version: 7.4.7600.226 (winmain_wtr_wsus3sp2(wmbla).090806-1834)
[MUI = Multilingual User Interface]

wuaueng1.dll - Windows Update AutoUpdate Engine
Version: 5.4.3790.5512 (xpsp.080413-0852)

wuauserv.dll - Windows Update AutoUpdate Service
Version: 5.4.3790.5512 (xpsp.080413-0852)

How do I reset Windows Update componentshttp://support.microsoft.com/kb/971058
(Check out how many other DLL's are involved with Windows Update.)

How to obtain the latest version of the Windows Update Agenthttp://support.microsoft.com/kb/949104

Windows Update website:http://update.microsoft.com/windowsupdate/v6/default.aspx

How to read the Windowsupdate.log filehttp://support.microsoft.com/kb/902093

During the normal 23 seconds from the time Windows began to load, until my
desktop was full operational and ready for me to start, the Windows Update
process apparently used .485 seconds of time, of which most was idle.
However, my computer does not automatically connect to the internet when it
starts so YMMV. (Your Mileage May Vary.)

(Triple-click here, to be of good cheer.
--Richard

- - -
Special Veteran's Day Remembrancehttp://www.avbtab.org/rc/veterans.htm

Thanks for clearing that up.

Mine runs for 5 minutes on reboot, then goes away - like it should
with nothing to do.