WerFault problem Vista

Discussion in 'Software' started by waterdog5, Mar 10, 2011.

  1. waterdog5

    waterdog5 Private E-2

    Hello,
    I have been cleaning malware off of a Vista laptop, I can post logs if necessary. Everything seems to be working except for a problem with WerFault.exe. Once this service starts it does not allow applications to end. For example if you open Word and close it, the window disappears but the process is still active. Once applications are in this state and you start another application the process will appear as active but the window does not appear.

    Werfault doesn't report any problems, but if you end the Werfault process then World will also end. When Werfault is not active, applications start and end normally.

    I tried disabling it, but the process still becomes active.

    So I would either like to fix WerFault, or disable it in such a way the the process does not start.

    Thank you
     
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    This is not a malware issues so I am moving the thread to the software forum. In the meantime:

    Open your computer's Control Panel by selecting "Start" > "Control Panel" from your computer's Start menu.

    Choose the "System and Maintenance" > "Problem Reports" menu option from the Control Panel menu.

    Select "Change Settings" > "Advanced Settings" from the Problem Reports program menu and turn off the automatic problem reporting feature in Windows.

    Exit the Problem Reporting application by selecting "File" > "Exit" from the File menu. Werfault.exe will now only run on your computer in the event of a catastrophic application problem.
     
  3. iain.t

    iain.t MajorGeek

    I would also suggest that you up-date all your drivers aswell, also if you have not installed SP2 for Vista I strongly advise that you do as that contains a fix for WerFault.exe high cpu resources, it has been noted that it can max out the cpu with more than one instance.

    iain.t :major
     
  4. waterdog5

    waterdog5 Private E-2

    I have turned it off, when I open it there is a dialog that says 'Windows problem reporting is turned off'

    However looking at Process Explorer there is still a WerFault.exe process. It is under svchost.exe.

    Command Line:
    c:\Windows\System32\WerFault.exe -u -p 1028 -s 1424
    Path:
    c:\Windows\System32\WerFault.exe

    The description for svchost.exe is:
    Command Line:
    c:\Windows\System32\svchost.exe + WerSvcGroup
    Path
    c:\Windows\System32\svchost.exe (WerSvcGroup)
    Services:
    Windows Error Reporting Service [WerSvc]

    Thanks
     
  5. waterdog5

    waterdog5 Private E-2

    I have sp2 installed.

    Thanks
     
  6. waterdog5

    waterdog5 Private E-2

    On a Vista machine that has no problems this process does not seem to automatically run. Does it only start when there is an error?

    How can I tell what is starting it?

    Also, does anyone know what the command line parms are for?
    c:\Windows\System32\WerFault.exe -u -p 1028 -s 1424

    Thanks
     
  7. waterdog5

    waterdog5 Private E-2

    I just ran sfc /scannow attached are the results. It looks like I have some corrupt files. Maybe I should start a new thread?

    Anyway I have attached the log
     

    Attached Files:

  8. plodr

    plodr Major Geek Super Extraordinaire

    Turn it off.
     
  9. waterdog5

    waterdog5 Private E-2

    It looks like the corrupt wuapi.dll was the culprit. I replaced it with one from another Vista machine. At first I could not delete this system file, so I followed the instructions here.
    http://support.microsoft.com/kb/929833
     
  10. waterdog5

    waterdog5 Private E-2

    It looks like the corrupt wuapi.dll was the culprit. I replaced it with one from another vista machine. I had trouble deleting it, so I followed the instructions here

    http://support.microsoft.com/kb/929833

    After I replaced it, I ran command
    regsvr32 wuapi.dll
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds