Donate SIGN UP

Windows Update

Avatar Image
LeMarchand | 10:37 Wed 12th May 2004 | Technology
4 Answers
Zone Alarm recently lost it's settings, and when this program asked for access, I noticed that it said that wuauclt.exe was built by lab04_n and not Microsoft. I found some reference on the net to a Trojan naming itself as that file, but could find no definite answers. I've run a virus scan (with updated definitions) and it didn't pick anything up. Does anyone know if this is a legit file?
Gravatar

Answers

1 to 4 of 4rss feed

Best Answer

No best answer has yet been selected by LeMarchand. Once a best answer has been selected, it will be shown here.

For more on marking an answer as the "Best Answer", please visit our FAQ.
On the Windows XP and 2000 machines we have the wuauclt.exe is signed as a Microsoft Corporation file so I guess it could be a Trojan http://www.sophos.com/virusinfo/analyses/trojcultb
.html
Question Author
Under Properties>Version mine says Microsoft under all the relevant tabs except "file version" (5.4.3790.20 built by: lab04_n). I did find an online reference to a different version built by lab04_n as a beta version that people thought was strange to be on a "normal" PC. It seems odd that the version tab mentions lab04, but I checked my virus definitions, and they include the Trojan mentioned on the Sophos link.
Windows 2000 has version 5.4.3630.2554 (SP4) and Windows XP has version 5.4.3630.2550 (SP1). Both are Microsoft Corporation.
Question Author
Cheers! Although the registry key isn't there, I think I'll just deny it access for now.

1 to 4 of 4rss feed

Do you know the answer?

Windows Update

Answer Question >>