Windows Update

[LeMarchand]

Zone Alarm recently lost it's settings, and when this program asked for access, I noticed that it said that wuauclt.exe was built by lab04_n and not Microsoft. I found some reference on the net to a Trojan naming itself as that file, but could find no definite answers. I've run a virus scan (with updated definitions) and it didn't pick anything up. Does anyone know if this is a legit file?

[j2buttonsw]

On the Windows XP and 2000 machines we have the wuauclt.exe is signed as a Microsoft Corporation file so I guess it could be a Trojan http://www.sophos.com/virusinfo/analyses/trojcultb
.html

[LeMarchand]

Under Properties>Version mine says Microsoft under all the relevant tabs except "file version" (5.4.3790.20 built by: lab04_n). I did find an online reference to a different version built by lab04_n as a beta version that people thought was strange to be on a "normal" PC. It seems odd that the version tab mentions lab04, but I checked my virus definitions, and they include the Trojan mentioned on the Sophos link.

[j2buttonsw]

Windows 2000 has version 5.4.3630.2554 (SP4) and Windows XP has version 5.4.3630.2550 (SP1). Both are Microsoft Corporation.

[LeMarchand]

Cheers! Although the registry key isn't there, I think I'll just deny it access for now.