Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Wuauclt.exe-399a8e72


  • Please log in to reply
4 replies to this topic

#1 aidanski

aidanski

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:10 AM

Posted 28 August 2006 - 05:12 AM

Hi there,

I have this file WUAUCLT.EXE-399A8E72 in my prefetch file. It seems to hijack 100% of my CPU usage at boot-up and at other random times. Microsoft has nothing on this file. There is a lot on the web about it, some saying virus others saying harmless. Can anyone answer this one definitively for me.

Thanks in advance,

Aidanski.

BC AdBot (Login to Remove)

 


#2 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:04:10 AM

Posted 28 August 2006 - 06:12 AM

WUAUCLT.EXE is a legit name for a Microsoft file. I don't know what WUAUCLT.EXE-399A8E72 is. Of course you can have two files on your computer with the same name, one could be legit and the other malicious. The way to tell which is which is to see the location on your computer that they are running from. To do this post a HiJackThis log in the appropriate forum here at Bleeping Computer and an expert will help you. Be sure to post your question regarding this particular file very clearly so they know what they are looking for.

In order to do this, follow these instructions:

FIRST
Read the Preparation Guide found HERE. It is very important that you follow ALL of the instructions found within. (There are many important steps in this guide that may clean your computer.)

NEXT
Post your system information along with a brief description of the problems you are having, and your HJT log in the HJT forum found HERE.

NOTE: Please, after you post your HJT log DO NOT make another post in the HJT forum until it has been responded to by a member of the HJT Team. The first thing they look for, when looking for logs to reply to, is 0 replies. If you make another post there will be 1 reply. The team member glancing over the replies might think someone is already helping you out and will not respond. So, just make your post and let it sit there until a team member responds. The volunteers who work that forum are very busy, so please be patient and wait. It can sometimes take a few days for a response. If after 5 days you still have gotten no response, then post a link to your HJT log HERE.


ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#3 ThorXP

ThorXP

  • Banned
  • 880 posts
  • OFFLINE
  •  
  • Local time:04:10 AM

Posted 28 August 2006 - 09:45 AM

Here is what that file is for

http://www.liutilities.com/products/wintas...ibrary/wuauclt/

Running HiajckThis I think is more than appropriate. just because of the numbers attached to it.

Edited by ThorXP, 28 August 2006 - 09:50 AM.


#4 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:04:10 AM

Posted 28 August 2006 - 11:35 AM

Do you have PRIVACY EXPERT installed on this computer? Read this interesting thread:

http://www.wilderssecurity.com/showthread.php?t=110777
ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#5 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,958 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:10 AM

Posted 02 September 2006 - 08:32 PM

I have this file WUAUCLT.EXE-399A8E72 in my prefetch file.


The numbers following the .exe are assigned by the computer. All prefetch files have numbers following the initial extension. The files in prefetch should all have the extenstion .pf after the numbers with the exception of one file: layout.ini

Please read the following post for links to more information on Prefetch: http://www.bleepingcomputer.com/forums/ind...st&p=330498

That said, it is very peculiar that Windows Automatic Update would be using 100% CPU unless the computer is actually searching for the most recent updates, downloading them, or installing them.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users