Link to home
Start Free TrialLog in
Avatar of cparker15
cparker15

asked on

wupdater.exe

I'm on a Windows 98 machine and every time it boots, I get a "Missing Shortcut" error, saying the shortcut is linking to wupdater.exe. When I go to Browse..., it brings me out to the Common Files folder.

I've seen around that wupdater.exe is a part of KeenValue software... I ran SpyBot S&D and it did detect KeenValue cursors and such. However, this error was showing up before I removed all of the KeenValue stuff.

I've searched the registry everywhere for "wupdater.exe", and it's not to be found anywhere.

In the StartUp Start menu folder, there's nothing calling "wupdater.exe".

Any idea what's causing this? There are no results for searching for "keen", "incredifind", or "perfectnav" in either file or the registry.

C:\Program Files\Common files\updater\updater.exe (not wupdater) DID exist, but it was removed with the round of SpyBot fixes.

It's getting to be somewhat annoying. Does anyone know of any other programs that may call wupdater.exe??

Thanks.
Avatar of Luc Franken
Luc Franken
Flag of Netherlands image

Hi cparker15,

>>I get a "Missing Shortcut" error, saying the shortcut is linking to wupdater.exe
Please check Start => Programs => Startup for entries that point to wupdater.exe
Delete them if you find them.

Greetings,

LucF
btw. Note the "Point to" so the entry might be called differently, just right-click them and choose properties.
ASKER CERTIFIED SOLUTION
Avatar of SheharyaarSaahil
SheharyaarSaahil
Flag of United Arab Emirates image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial

Download RegSupreme:

http://www.macecraft.com/downloads/

Install and run it.

It's possible it's just an obsolete pointer in the registry that this utility will clean.

Zee
Hello cparker15,

Wupdate.exe is related to spyware. here is a description from
http://www.2-spyware.com/file-wupdater-exe.html :
************************************************************************************
wupdater.exe description:
"KeenValue.Updater is an updater for eUniverse's products, such as KeenValue, IncrediFind and PerfectNav. KeenValue.Updater runs in the background, connects to update.thunderdownloads.com (12.129.205.220) looking for updates. KeenValue.Updater is bundled with Kazaa 2.6." Located in "%ProgramsDir%\Common Files\updater\".
************************************************************************************

Try "scanner & remover" from the above site.
Also, make a search for any file containing "wupdater.exe" from Start -> Search -> For file and folders.
Avatar of cparker15
cparker15

ASKER

Wow, a lot of responses...

I'm not near the Win98 computer right now, so I can't test your suggestions. What people have suggested already has been pretty much what I've done..

There's nothing inside of the Startup Start menu folder calling wupdater.exe.

There's nothing in either HKLM/Software/Microsoft/Windows/CurrentVersion/Run or HKCU/Software/Microsoft/Windows/CurrentVersion/Run that is running wupdater.exe...

Are any of your suggestions going to detect programs being told to run from other places?

I have NOT tried MSCONFIG, so the next time I'm near the Win98 computer, I'll try it out.

Also, once again, I have tried both Spybot and Ad-Aware. I've seen multiple references to HijackThis, so I'll give that one a whirl.

I didn't realize it was possible to search the contents of files for strings... This is possible from WIn98?

Thanks, everyone!
Of couse, cparker.

You can search for strings inside all files. The search will even try to find the string in .exe & other files, if you do not apply a filter.
also check this reg key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
and the win.ini and system.ini and look in c:\windows for a file named winstart.bat
may be being called from there
I have not abandoned this question. I am still awaiting confirmation of the solution to the problem.

I have not been able to test the solution, so I have not awarded points.

Please do not close this question.
Note: I'm certain the problem lies within win.ini (actually, I remember posting about this after stevenlewis's comment, but it's not here). Once I've gotten to test it, I will be able to award points.

I noted earlier that I'm not near the Win98 computer. I really meant it.

I will update this question when I've tested the solution. Do not close this question, do not delete it, do not mark it as abandoned, or otherwise nullify the points I have allocated toward it.

Thank you.
>>I'm certain the problem lies within win.ini<<
Personally I'm pretty sure the problem isn't there. If it was in win.ini you'd have been able to track it down by now.
The problem lies most likely in the registry where it's found to be a RUN or RUNSERVICES entry which has now been removed by an antivirus/antispyware or similar program. But the entry is still there. Most likely even MSCONFIG will be able to find it for you if it's not in the "startup" portion of the startmenu.

Like you said: "C:\Program Files\Common files\updater\updater.exe (not wupdater) DID exist, but it was removed with the round of SpyBot fixes."
So, only the reference to the file exists somewhere, which you need to get rid of it.

LucF
Correct. I've already combed the registry of this machine. Run, RunServices, RunOnce, RunOnceEx, et al., for both HKLM and HKCU. I found nothing. msconfig didn't show anything, either.

However, I completely forgot that win.ini is one place programs can be started from. I did not check win.ini at all before. This is why I'm sure the problem rests within win.ini...

I should be able to get to the machine in question sometime this week, and I'll be able to update this question and (hopefully) Accept an Answer.

Thank you.
No, none yet, sorry.

I will be working on the computer in question tomorrow, so I'll be able to provide feedback on it after that.

Thanks.
I'm in the middle of doing a system-wide search of every file for "wupdater.exe", and so far, only one file has come up with results: Hwinfo.dat

Is there a reason this file would cause a program to be launched? Is there any sort of a viewer I could use to edit this file?
I don't think that hwinfo.dat can cause any problem.

MrScary has given a good description of Hardware Diagnostic Utility here :
http://members.bellatlantic.net/~mrscary/post98se.htm
Something interesting to note...

I used msconfig, and wupdater.exe showed up on the Startup tab, but nowhere else. wupdater.exe isn't being referenced in the "StartUp" folder on the Start menu, either.

I unchecked the wupdater.exe entry on the msconfig Startup tab, and the computer no longer has the problem, but the entry for wupdater.exe is still there, even after successive reboots.

Is there ANY way to find out where wupdater.exe is being referenced? It's not in config.sys, it's not in system.ini, it's not in win.ini, it's not anywhere in the registry, and it's not in the StartUp folder in the Start menu. I'm stumped. Apparently, however, msconfig isn't. If only it would tell me where it's being called from.

Are any of the other programs that were suggested earlier in this thread capable of showing me this information?

Thanks!
how about msinfo32
software environment -->startup programs
I have also seen it called from batch files (usually winstart.bat)
of course now that it's unchecked it won't show where it's being loaded from
>>I used msconfig, and wupdater.exe showed up on the Startup tab<<
Strange... before you mentioned: "msconfig didn't show anything, either" (http:#12814864)

Do you mean that it got added now? Or might it just be that you missed it before?

Anyway, HJT which is mentioned above should be able to give you the location of this file (if it's checked in msconfig, it won't be able to give you the location if you disable it with msconfig)

LucF

Have you tried RegSupreme as I suggested above?

Zee

To LucF: Yes, I believe I just missed it before. I went to the Startup tab and scrolled all the way to the bottom, and there it was, with a name of "updater" and a path of "C:\Program Files\...\wupdater.exe".

What I'll do now is re-check it, and then I will try msinfo32 first, since it seems as though it's a program built in to Windows. If that doesn't show anything, then I'll try RegSupreme, although I doubt that'll show anything (I've done a thorough search of the registry for "updater" and have gotten no results). If RegSupreme doesn't work, then I'm going to count on HijackThis. Or perhaps I'll just go with HijackThis, since it seems as though it's a guarantee it will show me where wupdater.exe is being called from.

Oh, also, I checked autoexec.bat, and it wasn't there, either. I've never heard of winstart.bat...

Hopefully, either msinfo32, HJT, or RegSupreme will catch something.

Thank you all for your help.
That "updater" name did ring a bell for me.
Please see Adware.Incredifind => http://sarc.com/avcenter/venc/data/adware.incredifind.html

If you enable "updater" again in MSCONFIG, you should be able to find it at:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Please see if you can find any of the other files mentioned on your harddisk.

LucF
There's one problem, though.

When I was getting the error of wupdater.exe not being found, that key did not exist.

Was regedit malfunctioning, and not showing that key for some reason?

I should be working on this machine again (and hopefully one of the last times I touch it) this weekend. I'll update this thread then, and get to the bottom of this predicament.

Thanks!
Oh, and thanks for the Symantec link. I'll be able to use the non-Symantec-specific instructions to ensure that the system is fully restored.
>>Was regedit malfunctioning, and not showing that key for some reason?<<
Most likely one of the registry entries was removed by some antivirus/antimalware program, but at least one stayed there. You might have just missed a single entry triggering this error message. The wupdater.exe file itself is most likely allready gone from the system.

Hope you'll come back with some good news.

LucF

P.S. remember that if that line is disabled in MSCONFIG, you won't find the entry in the registry either, but please check for all other files.
Did I mention that I hate browser hijackers? I don't know if I hate them, virus/trojan writers, spammers, or people who use popup ads on their sites more.

Just $0.02...
To LucF: If you'll skim the history of this thread, you'll probably see (and remember) that I already removed all other components of IncrediFind, and this is the end result. I used Ad-Aware and SpyBot S&D to pinpoint IncrediFind and nuke it. However, neither of these programs removed a reference to wupdater.exe. I also did a thorough scan of the registry (with regedit) for the string "updater" and didn't get anything relating to wupdater.exe out of it...
>> Did I mention that I hate browser hijackers?<<
Don't we all?

From the moment I started giving all my clients Firefox (and prior, Mozilla) I never faced this problem thankfully :)
All browser hijackers I know use IE exploids to install themselves, but as I've seen some recent flaws in Firefox, I'm affraid for the future... :(

LucF

Maybe you want to try the fully functional trial version of SpySweeper:

http://www.webroot.com/downloads/

Zee
The updater entry MUST be in the registry.

Check again, particularly under HKLM/Software/Microsoft/Windows/CurrentVersion.

Under this key, there will be a few sub-keys names Run, RunOnce etc.

Since you have disabled updater.exe from MSCONFIG, it should be under Run- or Run_Disabled.

Also check under HKCU/Software/Microsoft/Windows/CurrentVersion.
Wow.

*PLEASE* don't close this thread. You know the routine.

Are you going to try to close this thread EVERY time there is a period of time where it's not updated for a little while? It's getting kind of annoying.

>>It's getting kind of annoying.<<

You haven't posted a comment since 01/12/2005....
Well, thank you for the information, but I've read these already.

Do you suggest I keep my question active by posting random junk every week that has nothing to do with the topic?

I want to verify the solution and give credit where it's due. If it takes more than however much time it takes for you to flag messages even though they're obviously active, then that's how long it takes. I don't need admins jumping down my throat for it.

I'll put a larger priority on getting this issue solved so I can close this question (with credit appropriately affixed) so I don't have to keep on doing this to keep the question open.

Thank you for your help and your "suggestions".
>How long does it take to "try the fully functional trial version of SpySweeper" (from blue_zee) and report back on the results, or to check a few registry keys that were specified by paraghs and report back on that?

>My recommendation stands.  If the cleanup Moderator disagrees, so be it...

Well, considering I'd have to travel to another state to test things, it takes a while.

If you want to lose a paying supporter of E-E, this is a sure way to do it. I'd expect a higher caliber of behavior from a Page Editor of E-E.
Oh, I thought I might point out:

> No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

My last comment was on 01/12. Let's go over simple "Mathematics 101": 12 + 21 = 33. Is today at least January 33? Use your head.


Also:

> If that is what your understanding of those links about "staying active" and "communicating" means... well, I can't say much for your ability to duplicate what they say.

If you expect me to give my life story on these forums, you've got another thing coming to you. I already made it clear (IMHO) that I was not physically near the computer. For instance:

"I'm not near the Win98 computer right now, so I can't test your suggestions."

"I have not abandoned this question. I am still awaiting confirmation of the solution to the problem."

"I have not been able to test the solution, so I have not awarded points."

"I will be working on the computer in question tomorrow, so I'll be able to provide feedback on it after that."

If this is not considered staying active and communicating with others, then I can't say much for your cognitive ability to interpret what others say in a conversation.

If you want to be rude, Mr. LeeTutor, then I can be rude, as well. However, *MY* response will be followed up with a negative Feedback. If you treat other E-E users the way you've treated me, then I feel sorry that they're still E-E users. Nobody should have to put up with treatment such as this, ESPECIALLY if they're paying to use the service. You can be sure that, once I find the solution to this problem and affix credit to the nice people where it is due, I will be ceasing any paid account services with E-E. I will be making sure this is noted in your Feedback I leave for you.

Have a nice day, Mr. LeeTutor.
Okay. I used HJT and it turned out there was a shortcut in the Startup menu in the Start Menu with the "hidden" attribute attached to it. I didn't think to show hidden files, but I found it and deleted it. So, it appears as though points go to SheharyaarSaahil. Thanks go out to everyone who has helped find the solution to this problem. Your help and your patience are much appreciated.