±Recent Visitors

Recent Visitors to Com-Central!

±User Info-big


Welcome Anonymous

Nickname
Password

Membership:
Latest: JerryH
New Today: 0
New Yesterday: 0
Overall: 6595

People Online:
Members: 0
Visitors: 86
Total: 86
Who Is Where:
 Visitors:
01: Statistics
02: Community Forums
03: Photo Gallery
04: Photo Gallery
05: Community Forums
06: Photo Gallery
07: Photo Gallery
08: Community Forums
09: Photo Gallery
10: Community Forums
11: Photo Gallery
12: Photo Gallery
13: Home
14: Community Forums
15: Photo Gallery
16: Community Forums
17: Community Forums
18: Community Forums
19: Community Forums
20: Photo Gallery
21: Photo Gallery
22: Community Forums
23: Community Forums
24: Community Forums
25: Community Forums
26: Photo Gallery
27: Community Forums
28: Photo Gallery
29: Community Forums
30: Community Forums
31: Community Forums
32: Photo Gallery
33: Photo Gallery
34: Downloads
35: Community Forums
36: Community Forums
37: Community Forums
38: Community Forums
39: Community Forums
40: Community Forums
41: Community Forums
42: Photo Gallery
43: Downloads
44: Community Forums
45: Downloads
46: Community Forums
47: Community Forums
48: Community Forums
49: Community Forums
50: Photo Gallery
51: Photo Gallery
52: Community Forums
53: Community Forums
54: Photo Gallery
55: Home
56: Community Forums
57: Home
58: Community Forums
59: Community Forums
60: Community Forums
61: Community Forums
62: Photo Gallery
63: Community Forums
64: Community Forums
65: Community Forums
66: Photo Gallery
67: Photo Gallery
68: Community Forums
69: Photo Gallery
70: Community Forums
71: Community Forums
72: Community Forums
73: Community Forums
74: Downloads
75: Community Forums
76: Photo Gallery
77: Photo Gallery
78: Community Forums
79: Community Forums
80: Home
81: Community Forums
82: Photo Gallery
83: Community Forums
84: Downloads
85: Photo Gallery
86: Community Forums

Staff Online:

No staff members are online!
Neighbor caught a bug.... :: Archived
This is a forum for Software related items such as OS', Virus notices, cool or free programs, etc. Gaming software should go in the gaming folder pertaining to the current info.
Post new topic    Revive this topic    Printer Friendly Page     Forum Index ›  Software

Topic Archived View previous topic :: View next topic  
Author Message
JG300-Ascout
Power User

Offline Offline
Joined: Jan 04, 2005
Posts: 6249
Location: Cyberspace
PostPosted: Tue Aug 10, 2010 2:34 pm
Post subject: Neighbor caught a bug....

Next door neighbor contracted "wuausclt.exe" bug, that affects several system files. Tried to help him out (he's using Firefox and Windows on a laptop. Windows of a version I'm not familiar with). Has no AV, so I tried to do a system restore, but the bug saw right through my little trick and bumps from that page in a fraction of a second. Tries to sell you a wipe for it's own virus.

Next move is to "reset to as system was new", if we can. He doesn't have any special apps on there so only some image files will be lost, if even those. Not critical.

Any other ideas?

_________________
"All facts go to clearly prove that Shades is a thrice-cursed traitor & mentally deranged person steeped in inveterate enmity toward mankind"
Back to top
View user's profile Photo Gallery
Shades
Forum Tree-Rat

Offline Offline
Joined: Mar 06, 2005
Posts: 6404
Location: 3rd Branch up, 'Ye Olde Oak', Green Wood.
PostPosted: Tue Aug 10, 2010 3:01 pm
Post subject: Re: Neighbor caught a bug....

I don't think it's a virus (but it could become one, or more).
It sounds more like adware.
Whatever he does, he MUST NOT click the link to the anti-virus it's trying to sell.
The trouble with that stuff is that it could be relatively harmless in itself, but they tend to also have a secondary package which can install a trojan subsequently to download more serious stuff by clicking their link.

I looked it up in the Symantec database and it's apparently quite adept at chainging registry files.
THIS might help (although it's not quite the same name as yours, with the 's' missing).

I would do the following in sequence:-

1) get good anti-virus, spyware, and firewall ready.

2) Clean disk of everything. Wipe it. There's nothing left on there you want because it's highly likely that thing will have left roots that will just re-install it, or worse, in a few weeks.
Save any important files to DVD for repair later.

3) Start again.

4) Install appropriate security.

5) Load DVD to drive and check for viruses before transferring any old files.

I had one of these a couple of years ago (my fault, I was clicking a sequence of messages without looking and clicked one of these without even seeing it. It was resident in my System Restore memory so, every time I cleaned it out, it would simply re-install itself (and a trojan I can't remember the name of) from there.

One thing, if your friend is still adamant about not bothering with security, just point out how easy it is for someone to take control of his computer, use it as a zombie, and start downlowing (for example) child porn. If someone does, he'd be responsible until and unless he can prove it wasn't him.
He should get security.

_________________

Com-Central's cutest, fluffiest, twitchiest, tail.
CPU > Intel i7-4790k (4.0GHz); COOLING > CoolerMaster Hyper 212 EVO (2x120mm);
MOBO > Gigabyte GA-Z97X-Gaming 5; RAM > 4x8Gb Corsair 'Vengeance' DDR3 1866MHz;
GPU > Gigabyte GEFORCE GTX650Ti PCI-e 3.0 2Gb GDDR5; AUDIO > Creative X-Fi Xtreme Music;
LCD > Viewsonic VA2226w (1680x1050); PSU > OCZ ModXStream Pro 700w (modular);
CASE > CoolerMaster "Storm Scout"; OS > Windows 7 Home Prem (64-bit).
Back to top
View user's profile Visit poster's website ICQ Number
JG300-Ascout
Power User

Offline Offline
Joined: Jan 04, 2005
Posts: 6249
Location: Cyberspace
PostPosted: Tue Aug 10, 2010 5:00 pm
Post subject: Re: Neighbor caught a bug....

Thanks,

I already admonished him about some form of protection and browser settings. It was, in all likelihood, wide open...just used for wife's "facebook". Rolling Eyes

...apart from 7 Y.O. daughter playing a game which also led to an....unsavory link.

I think he needs to wipe it and institute some serious controls.

_________________
"All facts go to clearly prove that Shades is a thrice-cursed traitor & mentally deranged person steeped in inveterate enmity toward mankind"
Back to top
View user's profile Photo Gallery
piney
Power User

Offline Offline
Joined: Jan 23, 2006
Posts: 2330
Location: Republic of Southern New Jersey
PostPosted: Tue Aug 10, 2010 5:47 pm
Post subject: Re: Neighbor caught a bug....

from another forum

"I spent the morning trying to get rid of a virus called AV Security. It tells you that you are infected and the only way out is to buy the AV Security software ($50 for a 3 month license!) This is bogus, they are really after a credit card number. It came right through my AVG free antivirus. I googled it and found it is really running amuck and very hard to delete in that it disables ALL the executables in your Windows files and all your apps like Photoshop, FSDS, FSX, etc. I solved the problem by restoring to yesterday noon (July 3, 2010). "
The Bad news is you may have picked it up days or even weeks ago, one of the newest tricks they are using is a dorman period and or a wait time before the malware payload is released. I had a system infected in March that had been offline for almost 3 weeks and the user triggered the payload part way though the first day back to work after their vacation. In that case the system was off line but powered up while the user was away, when they reutrned the system received a security patch the first thing after they logged in, a complete system scan found nothing (normal procedure for Trend Micro - after any update it runs a full system scan).

The user had still not connected to our Intranet let alone the Internet, however they ran a report and saved it in HTML format, when they double clicked on the html file to open it ie was the program that opened the report, and poof the scareware Infection message, Luckly they were smart enough to pull the plug and call me before they did anything. After some serious investigating I foumd the file that had carried the payload, it had been dormant for almost a month. I was able to clean it with some serious effort and as far as I can tell it was using a cookie counter to trigger the payload, simply stated it went wild when the number of stored cookies reached a specifec amount the payload was released and the next time ie was started the message appears.

I am not trying to scare you or anyone, I just want to point out even if it appears you were infected by a specific site, or had only visited a few in a specific period of time, it is not absolute proof, of the cause you might have picked up the bug weeks ago and something you did or some external signal set it loose."

HTH

"
"

_________________
The only good skwerril is a dead un
Back to top
View user's profile Send e-mail
Shades
Forum Tree-Rat

Offline Offline
Joined: Mar 06, 2005
Posts: 6404
Location: 3rd Branch up, 'Ye Olde Oak', Green Wood.
PostPosted: Wed Aug 11, 2010 1:31 am
Post subject: Re: Neighbor caught a bug....

This is a good description/explanation of what you're dealing with;
www.symantec.com/norto...id=mislead

www.symantec.com/conne...w-me-money

www.symantec.com/conne...ney-part-2

www.symantec.com/conne...ney-part-3

www.symantec.com/conne...rt-tipping

Also, I still can't find anything on the file you list but "wuauclt.exe" seems to be a required file for Windows to update.
This may just be a file where the actual problem has been detected;These things will evolve and re-install themselves in a number of new places each time you find /remove them from another.
That makes it very hard to remove all traces of it, not to mention any damage it's already done to your registry which a simple anti-virus won't fix.

_________________

Com-Central's cutest, fluffiest, twitchiest, tail.
CPU > Intel i7-4790k (4.0GHz); COOLING > CoolerMaster Hyper 212 EVO (2x120mm);
MOBO > Gigabyte GA-Z97X-Gaming 5; RAM > 4x8Gb Corsair 'Vengeance' DDR3 1866MHz;
GPU > Gigabyte GEFORCE GTX650Ti PCI-e 3.0 2Gb GDDR5; AUDIO > Creative X-Fi Xtreme Music;
LCD > Viewsonic VA2226w (1680x1050); PSU > OCZ ModXStream Pro 700w (modular);
CASE > CoolerMaster "Storm Scout"; OS > Windows 7 Home Prem (64-bit).
Back to top
View user's profile Visit poster's website ICQ Number
Display posts from previous:   
Post new topic    Revive this topic    Printer Friendly Page    Forum Index ›  Software
Page 1 of 1
All times are GMT - 6 Hours

Archive Revive
Username:
This is an archived topic - your reply will not be appended here.
Instead, a new topic will be generated in the active forum.
The new topic will provide a reference link to this archived topic.