I have the same exact thing. Take a real close look at the process listing,
a 'c' and a 'l' together, look very much like a 'd'. I notice that Symantec
lists it as a Trojan:
http://securityresponse.symantec.com...kdoor.clt.html

However, I notice the process only starts running after I visit the Windows
Update site! Also, after a large amount of bytes transferred, it tries to
install what looks like a Microsoft Works update (Word 2002), asking me for
the original disk. Perhaps the 'wu' stands for Works Update and not Windows
Update. Anyway, I followed the instructions on the Symantec site - turning
off Restore, running a full system scan, and editing registry item. The
system scan found no such trojan file, and there is no such registry item.

However, the fact that the process only starts after visiting Windows Update
site, in addition to the fact that I read Microsoft recently updated Works,
leads me to believe that something else is going on here, probably just a
Works Update coming through the Windows Update site, since we all have been
told to set our computers to automatically download and update.

Possible??


"Ummagumma" wrote:

OS: XP Home Edition

Around 10 A.M. today (10 August), while browsing, I
noticed a lot of disk activity that seemed to be
associated with the process wuauclt.exe. I assumed that
an automatic update was being downloaded. However, I was
never prompted to install an update, and the Windows
Update site showed that my last update was downloaded on
1 August.

I haven't noticed any performance problems, in fact the
only thing that I noticed is that the appearance of the
Windows Update site has changed. My anti-virus software
scan reported nothing.

Comments?