wuauclt.exe - Any idea what it does?

[peterwilkes]

I have recently downloaded an update using the Windows Update Auto Update tool on my Windows XP Pro Machine. The update downloaded quickly and so I chose to install it, an alert box popped up from Zone Alrm Pro alerting me that the program wuauclt.exe has changed.

Could this be a virus / trjoan that someone has sent to my PC?

I have serched for a while on the internet and found several pages about wuauclt.exe being a networking component and another page saying it could be a trojan.

I have denied the access for now just on the safe side.

[beppodmime]

Well, you could download and install AVG antivirus along with the latest reference files, and run a scan and find out. AVG is a free AV program, and it performs very well. They keep up on the updates even with the free version, although they do offer a pay version with a few more features, and a better interface.

Go here to download AVG Free version:

http://www.grisoft.com/us/us_dwnl_free.php

They do ask you a few questions on how the software will be used, and they do require a valid E-mail address to mail you a liscensing key.

[peterwilkes]

Thanks, it's all sorted now, Norton said it was ok, I checked out a few more of the details like the version numbers etc and it seems to be a genuine windows file.

Thanks for the help.

possibly could be a virus

http://www.symantec.com/avcenter/ven...kdoor.clt.html

When Backdoor.Clt is executed, it performs the following actions:


Copies itself as %System%\WUAUCLT.EXE.


Adds the value:

"Microsoft auto update"="%System%\wuauclt.exe"

to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run

so that the Trojan runs when you start Windows.


Connects to an IRC server to receive commands. By default, the Trojan will connect to irc.icq.com on port 6667 and join a specific channel.

the link also includes removal information



here is a link for a free online scan

http://housecall.trendmicro.com/

FILENAME: Wuauclt.exe.
PROGRAM NAME: Windows Update AutoUpdate client.
DESCRIPTION: Retrieves updates from Windows Update server.
RECOMMENDED ACTION: Always permit. But be warned: According to Microsoft, updates may invoke DRM restrictions, preventing you from playing multimedia content already on your system. Read the details of each update before applying it.

http://www.pcmag.com/article2/0,4149,640479,00.asp

[Mister_L]

Easy, Easy.... the Windows Update Automatic Update client (Wuauclt.exe) is just the Client for this Service. It was updatet by the update that is all

true Mister_L but never hurts to scan for viruses like i suggested

[peterwilkes]

This is tricky, assuming that the virus checker doesn't know about / can't detect the virus / trojan, how do I know whether I have the good or the bad file on my system?

[puk]

Originally posted by peterwilkes
This is tricky, assuming that the virus checker doesn't know about / can't detect the virus / trojan, how do I know whether I have the good or the bad file on my system?

You can d/l Active Ports it's free! to monitor which ports are opened & by what process!......
I do hope you are using a firewall and Ad-aware & SpyBoot!

Puk

[Gait_Keeper]

Originally posted by Mister_L
Easy, Easy.... the Windows Update Automatic Update client (Wuauclt.exe) is just the Client for this Service. It was updatet by the update that is all

you are safe this time, always have anti-virus up to date, and zone alarm is great even the free version, and common sense.

I had one similar " PTsnoop.exe " there is a trojan with that name, and it is a legit program with the same name, it hepls the riser for the modem on my K7S5A board

I got worried just like you.

[peterwilkes]

Just checked everything out and is seems to be all legit.

My computer is behind a NAT Router and is also firewalled by Zone Alarm Pro. Norton 2003 Pro is running all the time. I also use Ad-aware and often run it on a weekly basis. It's amazing what it finds. My cop is oftem disconnected from the net when I am not using it anyway by pulling the plug.

Thanaks for the help.

Peter