Temp:winupd.exe is usually located in the 'C:\Users\Jason\AppData\Local\' folder.
Some of the anti-virus scanners at VirusTotal detected Temp:winupd.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Temp:winupd.exe is not signed.
15 of the 43 anti-virus programs at VirusTotal detected the Temp:winupd.exe file. That's a 35% detection rate.
Scanner | Detection Name |
---|---|
AntiVir | TR/Crypt.XPACK.Gen |
Avast | Win32:Malware-gen |
AVG | Dropper.Generic5.LDB |
BitDefender | Gen:Variant.Kazy.50829 |
Comodo | TrojWare.Win32.Trojan.Agent.Gen |
Emsisoft | Win32.SuspectCrc!IK |
F-Secure | Gen:Variant.Kazy.50829 |
Fortinet | W32/Rorpian.C!tr |
GData | Gen:Variant.Kazy.50829 |
Ikarus | Win32.SuspectCrc |
Kaspersky | Trojan-Dropper.Win32.Pihar.mb |
McAfee | Generic BackDoor.rz |
Microsoft | Trojan:Win32/Alureon.FK |
NOD32 | a variant of Win32/Kryptik.YDE |
VIPRE | Trojan.Win32.Generic!BT |
The instructions below shows how to remove Temp:winupd.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the Temp:winupd.exe file for removal, restart your computer and scan it again to verify that Temp:winupd.exe has been successfully removed. Here are the removal instructions in more detail:
Property | Value |
---|---|
MD5 | 3d947a1664691d0ab0a6e3e79e9a9c64 |
SHA256 | 63c51c20245941b81378c409fd834e3ad857c94f4d5e7ca64b736710e84c678a |
These are some of the error messages that can appear related to temp:winupd.exe:
temp:winupd.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
temp:winupd.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
temp:winupd.exe has stopped working.
End Program - temp:winupd.exe. This program is not responding.
temp:winupd.exe is not a valid Win32 application.
temp:winupd.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
To help other users, please let us know what you will do with the file:
The poll result listed below shows what users chose to do with the file. 97% have voted for removal. Based on votes from 38 users.
NOTE: Please do not use this poll as the only source of input to determine what you will do with the file.
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
In the last couple of days, I keep getting report of temp winupd.exe on my computer. I've read that it's a virus or a trogen horse. I want to remove it, but Norton isn't helping me. Will your freefixer get rid of this unwanted file for me.
Say's high cpu usage by: temp.winupd exe. just came up again, by Norton.
# 30 Dec 2011, 6:37
I have this file on my computer as well. It is labeled with "Adobe Inc." as the publisher.- Display Name: Bauble Doc Pines Scot Phrase - Description: Pink Pro Hen Worn Hatch - I believe this file is a used as a doorway for other viruses, trojans, etc. If I disable and remove this from startup applications my computer works fine however just disabling it allows it to try running again later at which point I receive messages from McAfee that viruses and trojans have been blocked and an error message that "Pink Pro Hen Worn Hatch" has stopped working. If I do nothing on startup the 2012 Vista Security Virus is allowed to take over and I have to then use a restore point to get my computer back up and running properly.
# 30 Dec 2011, 11:22
Oh, finally! I'm so relieved to find someone else with Pink Hen Pro Worn Hatch. Joseph, have you taken any action since? I'm dying to know to rid myself of this thing.
Norton warned me that something was doing a lot of reading and writing. ts name was just a long string of numbers. I tried to end it, but it said it was in use by Pink Hen Pro Worn Hatch. I took "worn" to mean "worm". Anyway, it started running Internet Explorer invisibly. I only know this because I got messages from webpages trying to get me to download things. I closed the messages, then got alerts from Norton that an attack had been blocked.
Norton scanned the full system an found nothing. I downloaded Norton Power Eraser, which told me to remove some applications I'd had for months. I did it, just in case, since it said they were created the same hour as my computer was infected. It didn't remove the problem.
I noticed that it was trying to send emails from the default Windows email client (the name is escaping me). Luckily, I don't use it, do it had no account to send with.
Looking at the processes running, I noticed several that had names identical to Windows or Microsoft processes, but weren't published under either name. I couldn't end these processes or view their locations - I didn't have permission, which is odd, since there are no other computers on my network. I figured it must be the work of whatever the malware is.
I restarted in safe mode and tried to find them, but couldn't. I ran another full system scan, which found only massive amounts of tracking cookies. I'm at a loss right now. Maybe if I could update my Norton virus definitions, it could find something. Sadly, I can't seem to do this in safe mode.
By the way, it might be worth mentioning that nothing seems to happen when I'm not connected to my wifi network.
Any help you guys have to offer would be very much appreciated.
# 8 Jan 2012, 23:07
No, I haven't tried yet. I did a live update with Norton and I'm scanning now. Hopefully that'll find this thing.
I don't see winupd.exe running. I see crss.exe, nvvsvc.exe, Pen_Tablet.exe, winlogon.exe, and wisptis.exe running. None of them are Microsoft or Windoes. The "Description" field is blank for all of them and I'm denied access when I try to end them or see where they're from.
@Rofer Karlsson, do you think Free Fixer would be able to rid me of whatever's causing these things (and the Pink Hen Pro Worn Hatch)?
# 11 Jan 2012, 18:32
UPDATE: I found it. The Temp:winupd.exe is in C:\windows\system32 (yes, all lower case). When I look for it, I can't find it. I would delete the whole folder (which is growing by the second. It's several GB big now.)
I also noticed "TrustedInstaller" as a user on my computer. I never created this. Can I get rid of these things?
# 11 Jan 2012, 18:42
Sorry for commenting so many times. So I found the folder. It was in C:\Windows\System32\Tasks. I had to grant myself permission to view it. There are a lot of other things in there, whose veracity I can't confirm. I deleted winupd, but the processes posing as Windows processes are still running. I don't know what to do from here.
# 11 Jan 2012, 20:27
Thanks for your input Roger, figure anything else out? I don't have it running anymore. My temp:winupd.exe had a different name then yours, it was shorter and just random stuff. Something about Meadow Varys or something. Same deal here, no Norton response, will run AVG Free, I didn't even see it listed under FreeFixer (though I already unchecked it in msconfig). I also ctrl-alt-del ended it. I don't have the Vista Security thing coming up though. I went to the C:\Windows\System32\Tasks and deleted that winupd file. I read it first in Notepad (whose link is jacked up). Are others having problems with their links as well?
# 12 Jan 2012, 19:25
Thank goodness other people have seen this! As I write I am getting Pink Pro Hen popping up and Malicious Tool Kit being blocked by Norton. I had this popping up (Pink) in late Dec, I went overseas for 2 weeks and it didn't show up on my computer!!!
The moment I hook up back in the States (now), Pink Pro Hen is popping up in MINUTES! Scary!
I am a non-tech person. Please tell me the quickest way to GET RID OF THIS! It's bugging me!!!
# 13 Jan 2012, 17:19
I couldn't find it when I searched for it as specified by other comments... but after I got rid of the tracking cookies with Norton it stops; however if I turn of the PC and turn it back on and go online, it pops up again until I get rid of the tracking cookies.
# 15 Jan 2012, 14:15
I'm calling myself Roger 2 to differentiate myself from Roger Karlsson. I've found some more suspicious files an folders that have appeared since I deleted Temp:winupd. That means something else is going on too. I'm about to restart and see if all the strange processes can start up without it. If not, hopefully I'm in the clear.
# 16 Jan 2012, 16:33
The phony Windows processes still start up immediately even without Temp:winupd. I have a feeling I might be done for, fellas.
Strangely enough, some stuff doesn't appear to be here in safe mode. Maybe it moved stuff around before I went into safe mode.
# 16 Jan 2012, 16:51
christine primm writes