Issue with Wuauclt.exe

Hello all.

As per instructed from this thread:

http://forums.majorgeeks.com/showthread.php?p=1881277&posted=1#post1881277

I am posting here.

The biggest issue is the behaviour of Wuauclt.exe. This started about a month ago.
The computer started taking up to 7 minutes to start (usual 1-2m), and everything on it was functioning "sloppy".

I found the root of the problem to be wuauclt.exe, and after examining it's behavior I suspected it was infected.

You can see the details of examination we went through in the previous thread.

Best regards.

 

I read through your entire thread in the Malware Forum.

Wuauclt is a System Process which runs in the background in Windows XP and CANNOT be removed. It monitors Microsoft's site for potential security updates for your Windows operating system. Please look at the attached for the amount of RAM it uses on my XP System. More important would be CPU usage. That might cause a slowdown. The fact that Kestrel13! found nothing in your other thread indicates to me you don't have any infection.

Mobogenie is not malware. I've used it and Moroboro to play games that are on my Android phone on my computer. It's more like Virtual Machine software.

Be advised that Microsoft ended support for XP on 4/8/14. Unless you've incorporated the POSReady registry key on your XP machine(s), there are no further updates available for XP. You'll need to upgrade to Vista or 7 and update the software you mentioned in your other thread so it will run on the upgraded OS.

 

I know it is used by Windows, but it should NOT run if all updates are turned off... Should it? It turns off on other systems. THAT is why I wanted to delete it.

Yours is only taking up 22k it seems... I wrote that mine takes ~670k

Yes, that might be causing a slowdown (didn't check), but it should not do that as a windows process. Also, I should not have a low system memory pop-up whenever I start Gravostyle, Corel or some other "larger" software.

I know he tried everything, it might not be Malware, but the fact remains it is causing issues that it did not before.

That might be true, but I did not install it. Especially if it is used for games.
Company policy does not allow playing games during work hours.
Good thing that scan found it... well, not so good for the user.

I am fully aware of that. However, Vista is by my experience unstable, and W7 requires more memory and processor power, which would then slow down the performance of programs such as Gravostyle and Corel DRAW.
The other reason for no upgrade is financing. We would have to Upgrade our all our Engraving software because it does not work on newer versions (HASP issues), which is quite expensive. Maybe in some not so distant future, but I am required to fix the issue now.
ooh, the pressure... :cry

What is that POSReady You mentioned? Can I have a further explanation on what it does? Quick look on google suggests it is another platform for automated machines.

As I stand now, it seems I need to keep it disabled since WXP does not have any more updates as it is.

 

If you check again, you'll find that it's 22,000 KB or about 21 MB. If yours is only 670 KB, I wouldn't worry.

I'm presuming you're the IT Pro at your company with Administrative rights? Are you running a server and work stations or are they stand alone computers?

 

Ah, my bad it's 670 MB... I have no Idea why I wrote kB... It's actually taking away one third of the total RAM.

They are all standalone Computers. The only "central" computer is the storage room PC which is used for control of goods in storage from remote computers on the network, other computers can only be accessed to a certain degree from the network. The network itself is A LAN based network with a router that has it's own IP through which other PCs access the internet.

 

I fired up my XP computer having last looked at it 7 days ago. I have automatic updates turned off but I am running MS Security Essentials which updated when I fire the computer up.
wuauclt it is using 20,248kb. Now that large amount could be because Security Essentials updated.

 

Yeah, 670 MB is a lot! But I don't know how you have updates set up. I've got mine set to notify but don't download or install. Today is Microsoft's patch Tuesday for August. With that POSReady registry key I mentioned in place, I received 4 updates today including a cumulative security update for Internet Explorer 8 that I, otherwise, wouldn't have received. As it stands now, you're not going to get updates of any kind and if you go online in XP, you're becoming increasingly vulnerable to exploits.

But getting back to that 670 MB, there could be some type of file corruption but, not necessarily malware. If you have the XP install CD, go to Start -> Run and type in "sfc /scannow" without the quotes and including the space between the c and forward slash. It should ask for the CD and begin a System File Check repairing or replacing any corrupt or damaged System files. After getting my updates today, wuauclt RAM usage dropped to 16.5 MB from 21 MB.

 

I sincerely apologize. Nothing pointed out to that (I did not go to Your profile) and I just assumed your gender. :-o

I turned them off. It was still apearing. Also, I think I mentioned in Malware thread, but just to be sure:
There were 2 instances of wuauclt.exe, one of them had low usage, but I cannot remember how much exactly (2**** kB).

I am fully aware of this, that is the reason I am trying to solve it, and not just disable it permanently.

I actually ran System File check before coming to the forums here, I haven't tried it since... But I did remove all instances of startup using Amigo360... So maybe I could run it now?

The only reason I still think there is something wrong with it is that I cannot delete it. However, if this is normal behaviour, then perhaps I can reenable it to see what happens?

 

I think I may have found an answer. You run Avast and I believe it's "piggybacking" wuauclt.exe for updates. I went to this page and found that a number of antivirus software apps use wuauclt.exe to obtain their updates. Hence, the heavy RAM usage. Avast has issues with heavy resource usage.

 

Hmmm... Might be after a certain update...
But why after terminating it I have released resources, and Avast is functioning and updating properly? What does it use Windows Update for then?

 

Sorry, I'm afraid that is beyond my scope of knowledge. Why AV software would use wuauclt.exe for updates instead of it's own update processes is beyond me.

Hopefully, someone with more experience will be able to assist you further.

 

I was searching through Avast's official forums, and did not find ANY notion that they are using Windows update... Apparently it's only the AVs in that thread.
Only mentions of wuauclt.exe is that avast! blocks it, which is not case on this PC.

I did however followed some links there and found similar issues. Will tell how it went.