WerFault problem Vista

Hello,
I have been cleaning malware off of a Vista laptop, I can post logs if necessary. Everything seems to be working except for a problem with WerFault.exe. Once this service starts it does not allow applications to end. For example if you open Word and close it, the window disappears but the process is still active. Once applications are in this state and you start another application the process will appear as active but the window does not appear.

Werfault doesn't report any problems, but if you end the Werfault process then World will also end. When Werfault is not active, applications start and end normally.

I tried disabling it, but the process still becomes active.

So I would either like to fix WerFault, or disable it in such a way the the process does not start.

Thank you

 

I would also suggest that you up-date all your drivers aswell, also if you have not installed SP2 for Vista I strongly advise that you do as that contains a fix for WerFault.exe high cpu resources, it has been noted that it can max out the cpu with more than one instance.

iain.t :major

 

I have turned it off, when I open it there is a dialog that says 'Windows problem reporting is turned off'

However looking at Process Explorer there is still a WerFault.exe process. It is under svchost.exe.

Command Line:
c:\Windows\System32\WerFault.exe -u -p 1028 -s 1424
Path:
c:\Windows\System32\WerFault.exe

The description for svchost.exe is:
Command Line:
c:\Windows\System32\svchost.exe + WerSvcGroup
Path
c:\Windows\System32\svchost.exe (WerSvcGroup)
Services:
Windows Error Reporting Service [WerSvc]

Thanks

 

I have sp2 installed.

Thanks

 

On a Vista machine that has no problems this process does not seem to automatically run. Does it only start when there is an error?

How can I tell what is starting it?

Also, does anyone know what the command line parms are for?
c:\Windows\System32\WerFault.exe -u -p 1028 -s 1424

Thanks

 

I just ran sfc /scannow attached are the results. It looks like I have some corrupt files. Maybe I should start a new thread?

Anyway I have attached the log

 

Turn it off.

 

It looks like the corrupt wuapi.dll was the culprit. I replaced it with one from another Vista machine. At first I could not delete this system file, so I followed the instructions here.
http://support.microsoft.com/kb/929833

 

It looks like the corrupt wuapi.dll was the culprit. I replaced it with one from another vista machine. I had trouble deleting it, so I followed the instructions here

http://support.microsoft.com/kb/929833

After I replaced it, I ran command
regsvr32 wuapi.dll