WUAUDT.EXE vs WUAUCLT.EXE question 1

[mscallisto]

While investigating some periodic slowness on a desktop (XP sp3 all up to date) and has monthly runs of CCleaner, Glary Utils, RegScrubXP, HijackThis, Malwarebytes, Avira Antivirus, Superantispyware, Smart Defrag II and MSCONFIG startup cleanup I still have slow periods right after Boot.

In windows task manager (processes tab), I noticed WUAU[highlight #FCE94F]DT[/highlight].EXE eating a bunch of memory all while my hard drive LED was lit steady.

Google searches led to links that said wuaudt.exe was ok and periodically performed “update audits” lasting as long as 40 minutes, while other links said it’s probably a Trojan meant to look like WUAU[highlight #FCE94F]CLT[/highlight].EXE, the real MS program for update audits..

Further Google searches produce more of the same conflicting info.

Does anyone know the truth about WUAUDT.EXE vs WUAUCLT.EXE?

Thanks in Advance

Sam

 

[guitarzan]

I believe that only WUAUCLT.EXE is legit, and that WUAUDT.EXE is not a windows file. But are you sure task manager is showing you wuau[highlight #FCE94F]dt[/highlight].exe and not wuau[highlight #FCE94F]clt[/highlight].exe? They look almost identical due to a cl looking nearly the same as a d in some fonts. And the behavior you describe is typical of problems with the Automatic Update service, which is what wuau[highlight #FCE94F]clt[/highlight].exe is from.

You can try disabling the "Automatic Update" service in services.msc and reboot. If the process persists, then it's probably malware.

 

[mscallisto]

Thx guitarzan

It was wuauclt.exe not wuaudt.exe

I had to do a DIR WUAUD*.* and got nothing while
DIR WUAUC*.* yielded the following:
c:\windows\system32\WUAUCLT.exe
c:\windows\system32\WUAUCLT1.exe
c:\windows\ServicePackFiles\i386\WUAUCLT.exe
c:\windows\ServicePackFiles\i386\WUAUCLT1.exe

 

[mscallisto]

Sorry...I somehow prematurely hit Submit Post

Thx guitarzan

It was wuauclt.exe not wuaudt.exe

I had to do a DIR WUAUD*.* and got nothing while:

DIR WUAUC*.* yielded the following:
c:\windows\system32\WUAUCLT.exe
c:\windows\system32\WUAUCLT1.exe
c:\windows\ServicePackFiles\i386\WUAUCLT.exe
c:\windows\ServicePackFiles\i386\WUAUCLT1.exe

I wish I could control when it runs or how much resources it uses (like priority) because it only happens when I need to show my wife something and I end up waiting forever for a response. If I [highlight #C4A000]never[/highlight] need to show my wife something, it runs like a dream.

I also don't know the diff between WUAUCLT.exe and WUAUCLT1.exe

Sam

 

[mscallisto]

and yes I can probably disable the "Automatic Update" service then re-enable later but I'd rather have control of WHEN it runs and the resource requirements e.g. Priority.