What is the wuauclt.exe? It is not a virus, it is the Microsoft Windows Update AutoUpdate Client.

Backdoor.Clt is trojan which appears as wuauclt.exe process. It open 6667 port on victim computer and connect to specific IRC server. It copy itself to windows system directory and add to startup.

To remove it use msconfig or regedit, procedure is fairly simple like for Troj/Cult-B, see below. But before restoring, better to disable system restore feature. Because system restore can backup virused file, and all future restores will simply reactivate virus.

Troj/Cult-B is the backdoor program which listen IRC and receive commands on IRC which a performed on victim computer. Every time when computer starts this programs try to login on some IRC server to some IRC channel. And wait for commands from IRC. After the first run this program copy wuauclt.exe as virus program to windows system directory and add it to startup.

Remove Troj/Cult-B is pretty simple, just run msconfig and find the place where wuauclt.exe is started and disable it. The second option is to run regedit and find in subkeys of registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ reference to this binary.

To differ Windows Update client from the virus check the path from which the program was executed. If it executed from windows/system32 then nothing to worry, it is the normal system process. But if path is different (even c:\windows) there is a high suspicion that wuauclt.exe is virus.

If you have any suggestions or you noticed some inaccuracy feel free to contact us. All information provided here is not pretended to be absolutely correct, as said earlier if you want to advice something you are always welcome.

You can download free spyware removal tools from Microsoft. Also good section about removing parasite on CNET.COM. Try searching on SimTel using keyword spyware.

Please listen to our several advises:

• try do not use Internet Explorer and use FireFox instead
• refrain from using Outlook and find more secure alternative as Thunderbird from Mozilla foundation or The Bat from Rit Labs
• be careful with attachment which you receiving from strangers (and even your friends because they can be virused too), very often behind enticing name hiding malicious virus
• do not download programs from suspicious sites (i.e. with bad design or which forces you to install some program to continue viewing, or any dialers)
• do not download cracks and key generators because they often contain viruses or even they are turn up trojan programs
• keep antivirus installed on your computer and check every downloaded program from Net even if you think that you downloaded it from authoritative site
• and final advice is to keep Windows Updating always on, do not grudge for your bandwidth, because is malicious program can waste your bandwidth even more!