waudclt.exe?

[Adam Bailey]

I have recently come across a program on my computer that has me
stumped. It is called waudclt.exe. The program runs in the background
at startup, and while is it running, my CPU useage jumps up to 100% and
stays there. Once I end this program, my CPU usage goes back to normal.
I first became aware of this program when my firewall alerted me to
waudclt.exe wanting to connect to the internet. I denied it access, and
set a rule to never let it access the internet. According to my
firewall log, it appears the program is trying to connect only within my
domain. I have googled 'waudclt' to no avail. No search results
whatsoever. This program only first appeared a few days ago. Does
anyone have any idea what it is or what its doing on my machine?

Thanks
Adam

 

[*Vanguard*]

"Adam Bailey" said in news:[email protected]:

I have recently come across a program on my computer that has me
stumped. It is called waudclt.exe. The program runs in the
background at startup, and while is it running, my CPU useage jumps
up to 100% and stays there. Once I end this program, my CPU usage
goes back to normal. I first became aware of this program when my
firewall alerted me to waudclt.exe wanting to connect to the
internet. I denied it access, and set a rule to never let it access
the internet. According to my firewall log, it appears the program
is trying to connect only within my domain. I have googled 'waudclt'
to no avail. No search results whatsoever. This program only first
appeared a few days ago. Does anyone have any idea what it is or
what its doing on my machine?

Thanks
Adam

You sure you didn't misspell the filename in your post? You sure the
correct filename isn't wuauclt.exe? Heard of Automatic Updates (i.e., the
NT service by that name that performs a periodic check, if enabled using the
Control Panel applet, of new updates that are applicable to your
installation of Windows)?

If indeed you did correctly spell the filename for this mystery file, any
info on it if you search for it, right-click on it to look at Properties,
and look under the Version tab to see maker, description, and program name?

See http://support.microsoft.com/?kbid=810160

 

[Adam Bailey]

Yes, I spelled the filename correctly. I did notice the similarity in
filenames to wuauclt.exe, and thought it was rather curious. Also, the
program has no version tab...just general, security, and summary. I
have renamed the file in question so that it won't do anything...but I
would still like to know what exactly it is.
Thanks,
Adam

 

[David H. Lipman]

Please go to McAfee (http://www.mcafee.com/myapps/mfs/default.asp) and/or Trend
(http://housecall.antivirus.com ) and perform an online scan of your platform then report
back your results.

Dave



| I have recently come across a program on my computer that has me
| stumped. It is called waudclt.exe. The program runs in the background
| at startup, and while is it running, my CPU useage jumps up to 100% and
| stays there. Once I end this program, my CPU usage goes back to normal.
| I first became aware of this program when my firewall alerted me to
| waudclt.exe wanting to connect to the internet. I denied it access, and
| set a rule to never let it access the internet. According to my
| firewall log, it appears the program is trying to connect only within my
| domain. I have googled 'waudclt' to no avail. No search results
| whatsoever. This program only first appeared a few days ago. Does
| anyone have any idea what it is or what its doing on my machine?
|
| Thanks
| Adam
|

 

[*Vanguard*]

"Adam Bailey" said in news:[email protected]:

Yes, I spelled the filename correctly. I did notice the similarity in
filenames to wuauclt.exe, and thought it was rather curious. Also,
the program has no version tab...just general, security, and summary.
I have renamed the file in question so that it won't do
anything...but I would still like to know what exactly it is.
Thanks,
Adam

So how does the program get loaded? In Startup group? In a registry run
key (use WinXP msconfig or Mike Lin's Startup applet to show)? As an NT
service?

 

[*Vanguard*]

"Adam Bailey" said in news:[email protected]:

Yes, I spelled the filename correctly. I did notice the similarity in
filenames to wuauclt.exe, and thought it was rather curious. Also,
the program has no version tab...just general, security, and summary.
I have renamed the file in question so that it won't do
anything...but I would still like to know what exactly it is.
Thanks,
Adam

Forgot to mention to also check Task Scheduler for programs that load on
startup.

 

[Adam Bailey]

I ran both of the online virus scans suggested in this thread, and
neither of them found any visues in the truant program (they did find
some viruses as email attachments in my junk email folder, but I hadn't
downloaded any of those, of course, and I deleted them after the scans).
I also ran Norton's, which found nothing. The program in question
seems to disable Norton's Auto-Protect when its running, so before I
disabled it in msconfig and renamed it so that it wouldn't work, I had
to go in and start up Auto-Protect manually. Also, according to
msconfig, waudclt.exe is run from the registry.

Adam

 

[Bjorn Landemoo]

Adam

If you right click the file, and select Properties, do you get a Version
tab?

In that case, does it reveal anything of it's source?

Best regards

Bjorn

 

[Subhav]

I came across some viruses on a clients computer. Found out that
waudclt.exe was infected by many of them. Neither Norton nor Stinger
by McAfee could fix it. Although Norton claims to have a patch in its
updated version it couldn't fix it. Had to quarantine it. I considered
deleting the file from system32 as I could not find any trace on it at
microsofts websites. Beware of the file... it is used by many
backdoors to let people in your computer.

 

[David H. Lipman]

McAfee's Stinger only targets some 42 or so infectors. It is NOT a cure-all and should not
be used unless you know the specific name of the infector and it is one that Stinger does
indeed target.

In addition:
If you post to UseNet with your TRUE, not a munged, email address then you have invited the
Swen Internet worm [aka; W32/Gibe-F] to visit you.

The Swen is news spelled backwards. The reason it is called this is because the Swen worm
harvests email addresses from UseNet News Groups. It has an engine that allows it to post
itself to UseNet News Groups as well as it has its own email engine. From the list of
email addresses that it has harvested, it will then email itself to those addresses.

Dave



| I came across some viruses on a clients computer. Found out that
| waudclt.exe was infected by many of them. Neither Norton nor Stinger
| by McAfee could fix it. Although Norton claims to have a patch in its
| updated version it couldn't fix it. Had to quarantine it. I considered
| deleting the file from system32 as I could not find any trace on it at
| microsofts websites. Beware of the file... it is used by many
| backdoors to let people in your computer.