What is winupdate86.exe?
winupdate86.exe is part of Microsoft(R) Windows (R) 2000 Operating System and developed by Microsoft Corporation according to the winupdate86.exe version information.
winupdate86.exe's description is "IIS Fortezza Setup Utility"
winupdate86.exe is usually located in the 'C:\WINDOWS\system32\' folder.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Vendor and version information [?]
The following is the available information on winupdate86.exe:
| Property | Value |
|---|---|
| Product name | Microsoft(R) Windows (R) 2000 Operating System |
| Company name | Microsoft Corporation |
| File description | IIS Fortezza Setup Utility |
| Internal name | fortutil.exe |
| Original filename | fortutil.exe |
| Legal copyright | Copyright (C) Microsoft Corp. 1981-1999 |
| Product version | 5.00.2195.6620 |
| File version | 5.00.2195.6620 |
Here's a screenshot of the file properties when displayed by Windows Explorer:
| Product name | Microsoft(R) Windows (R) 2000 Operat.. |
| Company name | Microsoft Corporation |
| File description | IIS Fortezza Setup Utility |
| Internal name | fortutil.exe |
| Original filename | fortutil.exe |
| Legal copyright | Copyright (C) Microsoft Corp. 1981-1.. |
| Product version | 5.00.2195.6620 |
| File version | 5.00.2195.6620 |
Digital signatures [?]
winupdate86.exe is not signed.
Hashes [?]
| Property | Value |
|---|---|
| MD5 | 799436bdfa557f21752d4388f297a516 |
| SHA256 | bb8593c4be49eafadb637da201c2d9280de3946f106d5fd68d41255636d29e86 |
Error Messages
These are some of the error messages that can appear related to winupdate86.exe:
winupdate86.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
winupdate86.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
IIS Fortezza Setup Utility has stopped working.
End Program - winupdate86.exe. This program is not responding.
winupdate86.exe is not a valid Win32 application.
winupdate86.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with the file?
To help other users, please let us know what you will do with the file:
What did other users do?
The poll result listed below shows what users chose to do with the file. 86% have voted for removal. Based on votes from 147 users.
NOTE: Please do not use this poll as the only source of input to determine what you will do with the file.
Malware or legitimate?
If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.
And now some shameless self promotion ;)
Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.
If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
Bojan writes
Hi my computer is infected last night 17/11/2009 01:05 am on site http://trinixy.ru/. NOD32 v4 (always updated) is recognized infection as trojandownloader.fakealert.AOP but it is not deleted. After restart and scan in safe mod, trojan is deleted. Now i got this message "the application or DLL C:\WINDOWS\system32\winhelper86.dll is not a valid windows image. please check this against your installation diskette". This message appear when I start application: skype, goggletalk, chrome, vypresschat(chat in local network)...
My browsers,IE,Mozilla,chrome and meesangers doesn't work but when i ping sites in CMD (ping www.google.com)i got replay message from all(100% packets sent and recived).
I cant open task manager. In System32 exist winupdate86.exe and winhelper86.dll.
p.s. sorry for english.
# 17 Nov 2009, 6:19
Robert Larson writes
Running Vista Ultimate. Became infected yesterday with Winupdate86.exe. I have been battling with it since. Also, when I reboot, my computer tells me it is infected with Worm.Win32.NetSky. Using Windows Defender, SuperAntiSpyware, FreeFixer v0.49, and FxNetsky from the Symantec website. I seem to be winning, as I have regained the use of TaskManager, which disappeared when the infection started.
# 22 Nov 2009, 13:20
Bojan writes
I solved the problem with ComboFix. It's powerful application (3MB).
# 23 Nov 2009, 4:24
christine writes
Spyhunter has located this malware on my machine but I have to purchase the program in order to remove it - we had several "fake" warnings, I am pretty sure it is on the machine. I downloaded freefixer, which appears to be a useful tool, but it did not find the same file - I'd like to find out how to remove it without having to purchase anything.
# 28 Nov 2009, 20:19
Mel nebres writes
I recently worked on a machine that was infected and it did a number of crazy things. Task Manager was disabled so it wouldn't start, cmd command was recognized as a hazzard so you couldn'r get a command prompt, and the PC would blue screen when you tried to boot in Safe Mode or Safe Mode Command Prompt. I got so fed up that I just formatted.
# 1 Dec 2009, 6:51
_Jim_ writes
I got this virus when my wife clicked a message on Facebook. Very difficult to remove! I've been able to get to the task manager after I left the warning message on the screen, after I try and start SmitfraudFix.exe. I could then also delete it from the registry. However, even after terminating it in the Task Mgr processes, deleting and all that, it still is coming back!
# 2 Dec 2009, 18:15
Clint writes
This is also associated with the winlogon86.exe malware also located in the c:\windows\system32 folder.
http://www.freefixer.com/library/file/44908/
Be cautious in deleting these files though, you might find that you are unable to login to your computer if you delete winlogon86.exe
Follow Roger's steps in the link above and your problem will be fixed. The Registry key with the userinit.exe file associated needs to be restored to what it was originally or the virus will keep coming back.
# 3 Dec 2009, 22:20
dominic F writes
I also got winupdate86.exe. it's very smart. came in through a google prompt. it blocks safe mode, regedit, taskmgr and most everything else. i used a different task manager to identify it. removed it from the files and register but it kept coming right on back. i finally restored my ghost copy. just got tired of trying to track it down.
# 4 Dec 2009, 15:54
elmo writes
hi there. i have discovered a number of files associated with this throughout my systems folder. winhelper86.dll is definately 1 of them. winlogon86 is a copycat that is associated which stores and uses your password when you are not online with the program you caught it through. i.e. if u installed it from a fake youtube site it will log onto your youtube account. if you infected from facebook, it will use your facebook account. i have incountered these programs before due to my silly flatmates using my computer. hope that helps
# 6 Dec 2009, 19:28
TakeNotes writes
What a nightmare! I had pop-ups indicating I had a problem. After much review, I finally discovered the problem was winupdate86.exe. Since REGEDIT and TASKMGR were locked out, I had to pull these files from my other computer, and re-name them. But TASKMGR did not work until I edited registry. While in safe-mode, I killed winupdate86, and that revealed it was the problem program. I decided to delete winupdate86.exe manually. Also did a file sort by date, and discovered related files, including some 0 byte files. I deleted all of them. I did not realize deleting WINLOGON86.exe would mean my computer will NEVER BOOT UP AGAIN. But then I found your other page with instructions on how to burn a BOOTABLE CD, and got untangled from that problem. Thanks for your helpful info!
# 12 Dec 2009, 12:32
Shakthi Saran S writes
We can remove this file manually or using scans. But removing this file alone will lead to NO BOOT. The will be associated with userinit in Registry. The Winlogon entry in registry will have the key for Userinit referring to Winupdate86.exe. So if we are removing the file either by scan or manual steps change the key for Userinit to "C:\Windows\System32\Userinit.exe"
HKLM>Software>Microsoft>Windows NT>Current Version>Winlogon
# 18 Dec 2009, 22:38
Andrew Record writes
This is the first root kit I have ever encountered so I'm not sure what the *best* procedure to use is.
After using taskmanagerfix to reaccess task manager and end the winupdate86 process I used regedit to look for culprits manually.
Searching the registry for win*86.* revealed two entries.
I *deleted* the winupdate86 entry in the run folder and *changed* the winlogon86 entry in Winlogon.
Rootkit versions can change and rewrite your registry all kinds of different ways. If freefixer does not perform a Diff of the registry and some restore save points you might be safer to just roll your system back a few days using restore before deleting the files that freefixer finds.
# 20 Dec 2009, 8:53
Mike writes
To fix problem that does not allow you to login to windows after virus winupdate86 removal, do the following:
(1) using your windows installation disk login to system - enable feature boot from CD drive in BIOS,
(2) insert Windows installation disk
and reboot PC
(3) when CD brings up menu, hit (R) for Repair
(4) login into your account from command prompt
(5) change directory by typing "cd system32" and press enter
(6) rename winlogon.exe by typing " rn winlogon.exe winulogin86.exe" and press enter
(7) reboot your system as usual an login to Windows to do reverse renaming winulogin86.exe to winlogon.exe
# 20 Dec 2009, 10:10
Harris writes
Mike,
Are your sure about renaming the file to "winulogin86.exe"
Should this be "winlogon86.exe"
# 29 Dec 2009, 17:53
Roger Karlsson writes