Computing.Net > Forums > Windows XP > running process wuauclt.exe

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

running process wuauclt.exe

Reply to Message Icon

Name: martin16v
Date: February 9, 2007 at 07:01:02 Pacific
OS: xp pro
Comment:

my daughter bought her PC over for me to have a look at as it started to run extremely slowly.
when i first booted up i had a windows error staring me in the face "wuauclt unable to start".
i then had a look in the task manager and the process wuauclt.exe is using %100 of the CPU and its eating the ram big time, think it pecked at 250Mb.
i tryed to kill it which didn't work "unable to end process".
so at the moment as you can Imagen the PC struggles to do anything.
having searched through google it seems its to do with ms auto updates so i disabled the auto updates but i have still got the problem??.
i need some suggestions please
xp pro/sp 2
120gb hdd
plextor dvd-r
mats---a dvd-rom
Abit NF7-S V2.0 Mobo,
xp2500 mobile @ 200x11/1.575v,
2X512 crucial Pc3200,
MSI X800 Pro-TD256 AGP 256M
PA9C-42CU cooper hea



Sponsored Link
Ads by Google

Response Number 1
Name: mattie
Date: February 9, 2007 at 07:16:34 Pacific
Reply:

wuauclt.exe usually is the windows automatic update client ... or malware if NOT located in the system32 windows-subfolder.

you can stop the automatic update service (run 'services.msc'), if necessary in safe mode to check if the problem persists.

more info:

http://www.geocities.com/lclane2/wu...

http://www.ppedia.com/p1_wuauclt-wu...

http://www.bleepingcomputer.com/sta...

Today's subliminal thought is: 'Calm down ... it's only ones and zeros.'


0

Response Number 2
Name: martin16v
Date: February 9, 2007 at 07:28:34 Pacific
Reply:

i ran the services.msc to originally to disable it but the process is still running?
i also did a search and i have wuauclt in....

c\windows\system32
" \temp
" \lastgood\system32
" \software\distribution
" \i386

xp pro/sp 2
120gb hdd
plextor dvd-r
mats---a dvd-rom
Abit NF7-S V2.0 Mobo,
xp2500 mobile @ 200x11/1.575v,
2X512 crucial Pc3200,
MSI X800 Pro-TD256 AGP 256M
PA9C-42CU cooper hea


0

Response Number 3
Name: mattie
Date: February 9, 2007 at 08:05:31 Pacific
Reply:

rename the file in system32 (i.e. wuauclt.bak) in safe mode and check again.

Today's subliminal thought is: 'Calm down ... it's only ones and zeros.'


0

Response Number 4
Name: martin16v
Date: February 9, 2007 at 08:38:52 Pacific
Reply:

well.......... this is driving me nuts.
iv just cleared wuauclt from

c\windows\system32
" \temp
" \lastgood\system32
" \software\distribution
" \i386
while i was wating for a reply(safe mode)
may have overdone it.
i still have it still running, help!!!
the wuauclt in c\windows\temp that i delete resporns everytime i reboot.


xp pro/sp 2
120gb hdd
plextor dvd-r
mats---a dvd-rom
Abit NF7-S V2.0 Mobo,
xp2500 mobile @ 200x11/1.575v,
2X512 crucial Pc3200,
MSI X800 Pro-TD256 AGP 256M
PA9C-42CU cooper hea


0

Response Number 5
Name: AKBessy
Date: February 9, 2007 at 09:01:26 Pacific
Reply:

martin16v,

neuber.com says the following,
" Process name: Windows Update AutoUpdate Client

Product: Windows

Company: Microsoft

File: wuauclt.exe

Security Rating:
Windows Update AutoUpdate Client. Background process which checks with Microsoft website for updates to the operating system. Shows up on the Task Manager's processes list when it is waiting for a response, e.g. to confirm permission to download an update.

Note: The wuauclt.exe file is located in the folder C:\Windows\System32. In other cases, wuauclt.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.

Virus with same name:
Backdoor.Clt - Symantec Corporation
Troj/Cult-B - Sophos"

Are you guys on dial-up or somehow turn off internet access when not using it? I have noticed that programs that want to call home will keep trying and trying even though there is no internet connection - thus slowing down a computer. But, in your daughter's PC case, I am thinking that she may have a virus considering this file was found in the temp folder

I would first turn off Windows Update by right-clicking on "My Computer," select "Properties" from the sub-menu, select the Automatic Updates" tab and turn off the Automatic Updates for now.

Go to "C:\WINDOWS\Prefetch" and delete everything in that folder except the "layout.ini" file. Then make sure to empty the Recylce Bin.

See if you can get the anti-virus program to run and do a thorough scan of the system. If not, try Symantec's free online scanner at http://security.symantec.com/sscv6/... .

Post back and tell us what you found.


0

Related Posts

See More



Response Number 6
Name: AKBessy
Date: February 9, 2007 at 09:03:22 Pacific
Reply:

martin16v,

neuber.com says the following,
" Process name: Windows Update AutoUpdate Client

Product: Windows

Company: Microsoft

File: wuauclt.exe

Security Rating:
Windows Update AutoUpdate Client. Background process which checks with Microsoft website for updates to the operating system. Shows up on the Task Manager's processes list when it is waiting for a response, e.g. to confirm permission to download an update.

Note: The wuauclt.exe file is located in the folder C:\Windows\System32. In other cases, wuauclt.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.

Virus with same name:
Backdoor.Clt - Symantec Corporation
Troj/Cult-B - Sophos"

Are you guys on dial-up or somehow turn off internet access when not using it? I have noticed that programs that want to call home will keep trying and trying even though there is no internet connection - thus slowing down a computer. But, in your daughter's PC case, I am thinking that she may have a virus considering this file was found in the temp folder

I would first turn off Windows Update by right-clicking on "My Computer," select "Properties" from the sub-menu, select the Automatic Updates" tab and turn off the Automatic Updates for now.

Go to "C:\WINDOWS\Prefetch" and delete everything in that folder except the "layout.ini" file. Then make sure to empty the Recylce Bin.

See if you can get the anti-virus program to run and do a thorough scan of the system. If not, try Symantec's free online scanner at http://security.symantec.com/sscv6/... .

Post back and tell us what you found.


0

Response Number 7
Name: Tufenuf
Date: February 9, 2007 at 09:51:10 Pacific
Reply:

martin16v, That file belongs in your C:\Windows\System32 folder as well as the C:\I386 folder. What I would do is turn off System Restore then restart your computer. Do a full virus scan in SAFE mode and if it comes up clean turn on System Restore again. Whatever your computer may have picked up could very well be hiding in the System Restore files thus the reason that after you delete that file in the C:\Temp folder it keeps on coming back. The actual Windows wuauclt.exe file in the C:\Windows\System32 folder should be 136 KB in size. The file in the C:\I386 folder (WUAUCLT.EX_) should be 48.8 KB in size as it's compressed.

Tufenuf


0

Response Number 8
Name: martin16v
Date: February 10, 2007 at 01:34:45 Pacific
Reply:

many thanks for all your help.
iv followed all you suggestions but I'm still in the same boat.
before i turned of system restore i thought i would have a look at the restore points, all grayed out "you have no restore points"??
i then turned it of and did a scan with avg, 5 Trojans found.
Ad-Aware SE Professional Edition, 275 entry's.
rebooted and wuauclt.exe started running again.
i opened ProcessExplorer and it found the path to wuauclt in the temp folder,thats the only one i have on the system.
i cannot connect to the ie so i cannot do a online scan.
my next thought was to plug the hdd to my PC to rescue all her photos,home movies then throw some heavy artillery at it :-0

xp pro/sp 2
120gb hdd
plextor dvd-r
mats---a dvd-rom
Abit NF7-S V2.0 Mobo,
xp2500 mobile @ 200x11/1.575v,
2X512 crucial Pc3200,
MSI X800 Pro-TD256 AGP 256M
PA9C-42CU cooper hea


0

Response Number 9
Name: AKBessy
Date: February 10, 2007 at 13:43:49 Pacific
Reply:

martin16v, are you sure you want to connect the two computers if the other one has a virus?

What version AVG is on the infected computer? Newer version? I found this information at the Symantec website for what I believe you guys are dealing with (copy and paste the link into your browser or go to Symantec and type in wuauclt.exe and see what all it comes up with in the search of their site.)

http://www.symantec.com/security_re...

Here's a bit of information from that link that I thought was interesting since you said it started running again just as soon as you started up the computer:

"Discovered: February 12, 2003
Updated: January 28, 2007 10:01:12 AM
Also Known As: W32.Cult,
Type: Trojan Horse
Infection Length: 7,072 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP


When Backdoor.Clt is executed, it performs the following actions:

Copies itself as %System%\WUAUCLT.exe.


Adds the value:

"Microsoft auto update"="%System%\wuauclt.exe"

to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that the Trojan runs when you start Windows.


Connects to an IRC server to receive commands. By default, the Trojan will connect to irc.icq.com on port 6667 and join a specific channel."


0

Sponsored Link
Ads by Google
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Windows XP Forum Home


Sponsored links

Ads by Google


Results for: running process wuauclt.exe

After SP2 update, wuauclt.exe takes www.computing.net/answers/windows-xp/after-sp2-update-wuaucltexe-takes/116215.html

wuauclt.exe in eventID crash sudden www.computing.net/answers/windows-xp/wuaucltexe-in-eventid-crash-sudden/119819.html

Running process: cwdefscn.exe www.computing.net/answers/windows-xp/running-process-cwdefscnexe/159277.html