wuaueng2.dll

[kyrcy]

Comodo Internet Security recently started reporting "C:\Windows\System32\wuaueng2.dll" as "Unrecognized". File description is "Windows Update Agent". Was this part of a recent update? What is it about?

[october262]

1st - check to see if your antivirus software up to date ??
see this post - https://file-intelligence.comodo.com/windows-process-virus-malware/DLL/WUAUENG

[kyrcy]

I found that both "wuaueng2.dll" and "wuaueng.dll" are in the same folder. Comodo Internet Security is up to date, but only reports "wuaueng2.dll" and does not offer to remove it.

[johns0]

It's a windows file and isn't essential,it's your comodo that's at fault.

[kyrcy]

It's a windows file and isn't essential,it's your comodo that's at fault.

What do you mean isn't essential?

[johns0]

Means it's not required for running windows,it's an update item.

[kyrcy]

I believe it's an update for Windows Update Agent.

https://support.microsoft.com/en-us/help/949104/how-to-update-the-windows-update-agent...latest-version

But I wonder why Comodo did not complain about this before.

[aedipuss]

lots of times virus/trojans hide as files that sound like windows files. i have no wuaueng2.dll in my systems folder, but i do have wuaueng.dll(the update agent). i'd upload it to https://www.virustotal.com/gui/home/upload and see if other anti-virus also think it's suspicious.

[kyrcy]

lots of times virus/trojans hide as files that sound like windows files. i have no wuaueng2.dll in my systems folder, but i do have wuaueng.dll(the update agent). i'd upload it to https://www.virustotal.com/gui/home/upload and see if other anti-virus also think it's suspicious.

"No engines detected this file" for both "wuaueng.dll" and "wuaueng2.dll". File hashes are different, but Virustotal detects both as "wuaueng.dll".

[Nilzzon]

You could try to run sfc /scannow to be on the safe side.

[aedipuss]

yeah,,,,,,, i'd be deleting the "2" file if it were me. it shouldn't have a name close to the actual windows file. if it's a for real windows file you could download it again later if needed.

[kyrcy]

C:\>sfc /verifyfile=c:\windows\system32\wuaueng.dll


Windows Resource Protection did not find any integrity violations.

C:\>sfc /verifyfile=c:\windows\system32\wuaueng2.dll


Windows Resource Protection could not perform the requested operation.

[aedipuss]

C:\>sfc /verifyfile=c:\windows\system32\wuaueng.dll


Windows Resource Protection did not find any integrity violations.

C:\>sfc /verifyfile=c:\windows\system32\wuaueng2.dll


Windows Resource Protection could not perform the requested operation.

could be because wuaueng2.dll is not a windows resource....

[kyrcy]

Latest Malwarebytes (Free) detects nothing.

[davexnet]

Latest Malwarebytes (Free) detects nothing.

You can search the registry for references to this file,
secondly you can use something like Agent Ransack to see if you can find any references to it from an
exe file. (You can also repeat this search to see if another dll references this dll) For example:

[kyrcy]

I think "wuaueng2.dll" is related to Simplix UpdatePack.