What is Temp:winupd.exe?

Temp:winupd.exe is usually located in the 'C:\Users\Jason\AppData\Local\' folder.

Some of the anti-virus scanners at VirusTotal detected Temp:winupd.exe.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

Vendor and version information [?]

Temp:winupd.exe does not have any version or vendor information.

Digital signatures [?]

Temp:winupd.exe is not signed.

VirusTotal report

15 of the 43 anti-virus programs at VirusTotal detected the Temp:winupd.exe file. That's a 35% detection rate.

ScannerDetection Name
AntiVir TR/Crypt.XPACK.Gen
Avast Win32:Malware-gen
AVG Dropper.Generic5.LDB
BitDefender Gen:Variant.Kazy.50829
Comodo TrojWare.Win32.Trojan.Agent.Gen
Emsisoft Win32.SuspectCrc!IK
F-Secure Gen:Variant.Kazy.50829
Fortinet W32/Rorpian.C!tr
GData Gen:Variant.Kazy.50829
Ikarus Win32.SuspectCrc
Kaspersky Trojan-Dropper.Win32.Pihar.mb
McAfee Generic BackDoor.rz
Microsoft Trojan:Win32/Alureon.FK
NOD32 a variant of Win32/Kryptik.YDE
VIPRE Trojan.Win32.Generic!BT
15 of the 43 anti-virus programs detected the Temp:winupd.exe file.

Temp:winupd.exe removal instructions

The instructions below shows how to remove Temp:winupd.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the Temp:winupd.exe file for removal, restart your computer and scan it again to verify that Temp:winupd.exe has been successfully removed. Here are the removal instructions in more detail:

  1. Download and install FreeFixer: http://www.freefixer.com/download.html
  2. Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
    Screenshot of Start Scan button
  3. When the scan is finished, locate Temp:winupd.exe in the scan result and tick the checkbox next to the Temp:winupd.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate Temp:winupd.exe in the scan result.
    Red arrow point on the unwanted file
  4. Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the Temp:winupd.exe file.
    Screenshot of Fix button
  5. Restart your computer.
  6. Start FreeFixer and scan your computer again. If Temp:winupd.exe still remains in the scan result, proceed with the next step. If Temp:winupd.exe is gone from the scan result you're done.
  7. If Temp:winupd.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
  8. Restart your computer.
  9. Start FreeFixer and scan your computer again. Verify that Temp:winupd.exe no longer appear in the scan result.
Please select the option that best describe your thoughts on the removal instructions given above

Free Questionnaires

Hashes [?]


Error Messages

These are some of the error messages that can appear related to temp:winupd.exe:

temp:winupd.exe has encountered a problem and needs to close. We are sorry for the inconvenience.

temp:winupd.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.

temp:winupd.exe has stopped working.

End Program - temp:winupd.exe. This program is not responding.

temp:winupd.exe is not a valid Win32 application.

temp:winupd.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.

What will you do with the file?

To help other users, please let us know what you will do with the file:

What did other users do?

The poll result listed below shows what users chose to do with the file. 97% have voted for removal. Based on votes from 38 users.

User vote results: There were 37 votes to remove and 1 vote to keep

NOTE: Please do not use this poll as the only source of input to determine what you will do with the file.


Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.

I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.

christine primm writes

0 thumbs

In the last couple of days, I keep getting report of temp winupd.exe on my computer. I've read that it's a virus or a trogen horse. I want to remove it, but Norton isn't helping me. Will your freefixer get rid of this unwanted file for me.
Say's high cpu usage by: temp.winupd exe. just came up again, by Norton.

# 30 Dec 2011, 6:37

Joseph Popailo writes

0 thumbs

I have this file on my computer as well. It is labeled with "Adobe Inc." as the publisher.- Display Name: Bauble Doc Pines Scot Phrase - Description: Pink Pro Hen Worn Hatch - I believe this file is a used as a doorway for other viruses, trojans, etc. If I disable and remove this from startup applications my computer works fine however just disabling it allows it to try running again later at which point I receive messages from McAfee that viruses and trojans have been blocked and an error message that "Pink Pro Hen Worn Hatch" has stopped working. If I do nothing on startup the 2012 Vista Security Virus is allowed to take over and I have to then use a restore point to get my computer back up and running properly.

# 30 Dec 2011, 11:22

Roger Karlsson writes

0 thumbs

I found a scan result for "Temp:winupd.exe" here and is malware: http://www.virustotal.com/file-scan/report.html?id=63c51c20245941b81378c409fd834e3ad857c94f4d5e7ca64b736710e84c678a-1325260500

I think FreeFixer should be able to remove this file. "Temp:winupd.exe" appears under "Processes" in FreeFixer's scan result.

@christine: Did this solve the problem?

# 30 Dec 2011, 15:26

*Roger* writes

0 thumbs

Oh, finally! I'm so relieved to find someone else with Pink Hen Pro Worn Hatch. Joseph, have you taken any action since? I'm dying to know to rid myself of this thing.

Norton warned me that something was doing a lot of reading and writing. ts name was just a long string of numbers. I tried to end it, but it said it was in use by Pink Hen Pro Worn Hatch. I took "worn" to mean "worm". Anyway, it started running Internet Explorer invisibly. I only know this because I got messages from webpages trying to get me to download things. I closed the messages, then got alerts from Norton that an attack had been blocked.

Norton scanned the full system an found nothing. I downloaded Norton Power Eraser, which told me to remove some applications I'd had for months. I did it, just in case, since it said they were created the same hour as my computer was infected. It didn't remove the problem.

I noticed that it was trying to send emails from the default Windows email client (the name is escaping me). Luckily, I don't use it, do it had no account to send with.

Looking at the processes running, I noticed several that had names identical to Windows or Microsoft processes, but weren't published under either name. I couldn't end these processes or view their locations - I didn't have permission, which is odd, since there are no other computers on my network. I figured it must be the work of whatever the malware is.

I restarted in safe mode and tried to find them, but couldn't. I ran another full system scan, which found only massive amounts of tracking cookies. I'm at a loss right now. Maybe if I could update my Norton virus definitions, it could find something. Sadly, I can't seem to do this in safe mode.

By the way, it might be worth mentioning that nothing seems to happen when I'm not connected to my wifi network.

Any help you guys have to offer would be very much appreciated.

# 8 Jan 2012, 23:07

Roger Karlsson writes

0 thumbs

@Joseph and @Roger: Did you try to remove the Temp:winupd.exe malware with FreeFixer? Temp:winupd.exe should appear under "Processes" in FreeFixer's scan result.

# 11 Jan 2012, 12:23

*Roger* writes

0 thumbs

No, I haven't tried yet. I did a live update with Norton and I'm scanning now. Hopefully that'll find this thing.

I don't see winupd.exe running. I see crss.exe, nvvsvc.exe, Pen_Tablet.exe, winlogon.exe, and wisptis.exe running. None of them are Microsoft or Windoes. The "Description" field is blank for all of them and I'm denied access when I try to end them or see where they're from.

@Rofer Karlsson, do you think Free Fixer would be able to rid me of whatever's causing these things (and the Pink Hen Pro Worn Hatch)?

# 11 Jan 2012, 18:32

*Roger* writes

0 thumbs

UPDATE: I found it. The Temp:winupd.exe is in C:\windows\system32 (yes, all lower case). When I look for it, I can't find it. I would delete the whole folder (which is growing by the second. It's several GB big now.)

I also noticed "TrustedInstaller" as a user on my computer. I never created this. Can I get rid of these things?

# 11 Jan 2012, 18:42

*Roger* writes

0 thumbs

Sorry for commenting so many times. So I found the folder. It was in C:\Windows\System32\Tasks. I had to grant myself permission to view it. There are a lot of other things in there, whose veracity I can't confirm. I deleted winupd, but the processes posing as Windows processes are still running. I don't know what to do from here.

# 11 Jan 2012, 20:27

Joey writes

0 thumbs

Thanks for your input Roger, figure anything else out? I don't have it running anymore. My temp:winupd.exe had a different name then yours, it was shorter and just random stuff. Something about Meadow Varys or something. Same deal here, no Norton response, will run AVG Free, I didn't even see it listed under FreeFixer (though I already unchecked it in msconfig). I also ctrl-alt-del ended it. I don't have the Vista Security thing coming up though. I went to the C:\Windows\System32\Tasks and deleted that winupd file. I read it first in Notepad (whose link is jacked up). Are others having problems with their links as well?

# 12 Jan 2012, 19:25

Margo writes

0 thumbs

Thank goodness other people have seen this! As I write I am getting Pink Pro Hen popping up and Malicious Tool Kit being blocked by Norton. I had this popping up (Pink) in late Dec, I went overseas for 2 weeks and it didn't show up on my computer!!!

The moment I hook up back in the States (now), Pink Pro Hen is popping up in MINUTES! Scary!

I am a non-tech person. Please tell me the quickest way to GET RID OF THIS! It's bugging me!!!

# 13 Jan 2012, 17:19

Roger Karlsson writes

0 thumbs

@Margo: Do you also have the "Temp:winupd.exe" running on your system?

# 15 Jan 2012, 13:48

Margo writes

0 thumbs

I couldn't find it when I searched for it as specified by other comments... but after I got rid of the tracking cookies with Norton it stops; however if I turn of the PC and turn it back on and go online, it pops up again until I get rid of the tracking cookies.

# 15 Jan 2012, 14:15

*Roger* writes

0 thumbs

I'm calling myself Roger 2 to differentiate myself from Roger Karlsson. I've found some more suspicious files an folders that have appeared since I deleted Temp:winupd. That means something else is going on too. I'm about to restart and see if all the strange processes can start up without it. If not, hopefully I'm in the clear.

# 16 Jan 2012, 16:33

*Roger* writes

0 thumbs

The phony Windows processes still start up immediately even without Temp:winupd. I have a feeling I might be done for, fellas.

Strangely enough, some stuff doesn't appear to be here in safe mode. Maybe it moved stuff around before I went into safe mode.

# 16 Jan 2012, 16:51

Roger Karlsson writes

0 thumbs

@Roger: Please upload the phony windows processes that appear on your machine to the http://www.virustotal.com/ scanner site. Does the anti-virus programs there report them as malware?

# 17 Jan 2012, 13:14

Leave a reply