wuauclt.exe in XP Pro

Christer

On August 3, 2004, either we all went to the MS update site and got v5 AU, or the update gave us all that date retroactively, or MS snuck onto our computers that Tuesday and did their thing while we weren't paying attention???

The Nov 11 2003 date is the day I did MS updates after the last clean reinstall. (October 4, 2003) The August 2002 date is the Bios Flash date I had when I did the last install. XP Pro was originally installed on this computer in January 2002.

Johanna

 

Oh my !! You are correct my Friend. Thanks for catching the error.

I am looking at the Rightclick properties of the files in question located in Windows/System32 folder.

wuauclt.exe version "5.4.3790.2182" properties show it as Windows AutoUpdate.
Size 111KB (113,944bytes)
Size on Disk 112KB (114,688bytes)
Created March, 06, 2004
Modified Aug, 03 2004

wuauclt1.exe, version "5.4.3790.2182" properties show it as Windows Update AutomaticUpdate Client.
Size 163KB (167,704bytes)
Size on Disk 164KB (167,936bytes)
Created July, 13, 2004
Modified Aug, 03, 2004.

Both files accessed today. Aug, 20, 2004

What in the world is the difference between SIZE and SIZE ON DISK ?

And where do they get 163KB from 167,704bytes ?

Does it ( or can it ) make a difference where we take the readings.

BillyBob

 

Hi Christer,

From Arie's pinned SP2 thread: Right now, SP2 is available only as a Network Installation. The size of the Network Installation download is 266 MB .The Network installation includes all of the Windows XP SP2 files needed for installation on Windows XP Home Edition, Windows XP Professional and Windows XP Media Center Edition. This is an ideal download mechanism for IT professionals who require a downloadable copy of SP2 that they can use for network deployment.

So why would I want to download a 266 MB install?

I don't know waht the exact size of the "tailored" SP2 is, have read anywhere from 60 MB to 66MB.

That it would be available on the Catalog site is an assumption on my part, but I see no reason why it eventually wouldn't be.Tailoring to me means Home or Pro or enterprise. Again, an assumption on my part, but I'd bet on it.

Saw a post from Abraxas on how he captures the download through AU for cd if that is what your concern is:
http://www.windowsbbs.com/showthread.php?t=34191

Regards - Charles

EDIT: If we keep discussing this subject - maybe a good idea to start a thread on this.

 

Christer

Thank you.

Your reply is now on paper.

BillyBob

 

Conceded, and they were both available as a cd from MS, and this may trun out to be the same, we'll see.

You could always remind me about my tendancy to make assumptions and say I told so

Regards - Charles

 

I was rooting around in my event logs. In the app log, noticed ESENT entries, right clicking brings up our old friend wuauclt - Automatic Update - which connects quite often - multple times per hour. Also noticed entries come in pairs. So I went looking and found that this is a bug w/ v5 update.

http://groups.google.com/groups?hl=...4E32-BAD2-2DD96B48FC21%40microsoft.com&rnum=2

Regards - Charles

 

What the heck does this mean?

Anybody?

Event Type: Information
Event Source: ESENT
Event Category: General
Event ID: 101
Date: 8/24/2004
Time: 8:20:19 AM
User: N/A
Computer: COMPUTER
Description:
wuauclt (2276) The database engine stopped.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Rockit

 

Hi Rockit,

Don't know what it specifically means, but from what I found last night - post above yours - it's a v5 update issue. Since v5 is new, maybe MS doesn't quite know either

Regards - Charles

 

And that is why I do NOT let MS software (or any other software, for that matter) "phone home" without permission. Since I disabled BITS and AU, there have been no wuauclt or update issues, errors or problems. I also set Norton to stop any unauthorized activity.

Now that ver 5 WU is out, I am glad that I burned all the updates, patches, hotfixes, Service Packs, (lotsa words for "corrections" and "improvements ", huh?) to cd. In the future, I think I'll download what I want on the kids' comp, and email it to myself, one room away, AFTER I try it out on their computer to see what kind of problems I might have. I am leaning more and more towards skipping SP2 completely because I might inadvertently trigger more information exchange with MS and who knows what could happen then? The irony is that I am more afraid of MS (because they are "trusted ") than any malware out there.

Johanna

 

Hi, I have been researching wuauclt.exe tryting to figure out if it is a system file on my Windows XP Home (SP2 installed) system or not.

I even wrote up an article on it:
http://www.sawtoothdistortion.com/Articles/wuaudt.exe.html
(Don't mind the name of the article... I originally thought it was wuaudt.exe, not wuauclt.exe, due to the small anti-aliased font in my Windows Task Manager.)

I'm not sure if this has been concluded yet or not... is http://www.liutilities.com/products/wintaskspro/processlibrary/wuauclt/ out of date? Is this a proper Windows update system file for Windows XP with Service Pack 2? I also get the message to insert my Service Pack 2 CD when I delete the files (I found four of them in the Windows directory).

Also, I did a full system scan and no viruses according to Norton Anti-virus.

 

Hi Doucette,

I just turned on AU to see whether it's the same program as pre SP2. The answer is yes. Now I'm going to shut it off again.

Regards - Charles

 

Greetings Christer & Charles,

I checked the "Date Modified" on my occurances of the file, and they were at least 2 weeks before I installed Service Pack 2. So that breaks that connection too.

So, what is it?!

We know that there is a trojon out there that goes by the same name:
- http://www.sophos.com/virusinfo/analyses/trojcultb.html
- http://securityresponse.symantec.com/avcenter/venc/data/backdoor.clt.html

But, seeing that Norton failed to detect it, I have to conclude that the files I have are legitimate Windows systems files. Is that a proper conclusion?

 

But, seeing that Norton failed to detect it, I have to conclude that the files I have are legitimate Windows systems files. Is that a proper conclusion?
I would say yes. But to prove conclusively, shut the AU service down - not just through the control panel - and see if it's running after that.

Regards - Charles

 

You mean shut it down in "services.msc "?

This is funny, I do not see the process (running) any more! I haven't seen it for days. So there's not much sense in shutting it down now. It won't prove anything.

I guess I have to wait until it comes back to test it out... If I do not see it come back, then the files must be just the Automatic Update service.

(The only other possibility is that my files are the trojan files, and I disabled the automatic startup of them in my registry... but I don't remember ever doing that. What a pain these things are to figure out. FYI, I just checked my registry and there is not sign of a registry entry that relates to the trojan's automatic run on startup.)