±Recent Visitors

Recent Visitors to Com-Central!

±User Info-big


Welcome Anonymous

Nickname
Password

Membership:
Latest: spadgham
New Today: 0
New Yesterday: 0
Overall: 6643

People Online:
Members: 0
Visitors: 160
Total: 160
Who Is Where:
 Visitors:
01: CPGlang
02: Community Forums
03: Home
04: Community Forums
05: Community Forums
06: Community Forums
07: CPGlang
08: Home
09: Photo Gallery
10: CPGlang
11: Home
12: Community Forums
13: Community Forums
14: Community Forums
15: Community Forums
16: Photo Gallery
17: Community Forums
18: Community Forums
19: Community Forums
20: Home
21: Community Forums
22: Photo Gallery
23: Photo Gallery
24: Home
25: Community Forums
26: Home
27: Home
28: Photo Gallery
29: Community Forums
30: CPGlang
31: Community Forums
32: Home
33: Downloads
34: Home
35: Community Forums
36: Community Forums
37: CPGlang
38: Community Forums
39: Community Forums
40: Community Forums
41: Home
42: CPGlang
43: Community Forums
44: Community Forums
45: CPGlang
46: Community Forums
47: Photo Gallery
48: Photo Gallery
49: Community Forums
50: Home
51: Community Forums
52: Photo Gallery
53: Downloads
54: Community Forums
55: Home
56: Community Forums
57: Home
58: Downloads
59: Home
60: Home
61: Photo Gallery
62: Home
63: Community Forums
64: CPGlang
65: Community Forums
66: CPGlang
67: CPGlang
68: Community Forums
69: Community Forums
70: Community Forums
71: Home
72: Community Forums
73: Community Forums
74: Photo Gallery
75: Community Forums
76: CPGlang
77: Community Forums
78: Home
79: CPGlang
80: Home
81: Home
82: Community Forums
83: Community Forums
84: Community Forums
85: Photo Gallery
86: Community Forums
87: Home
88: Community Forums
89: Photo Gallery
90: CPGlang
91: Community Forums
92: Home
93: CPGlang
94: CPGlang
95: CPGlang
96: News
97: Community Forums
98: Home
99: Home
100: Community Forums
101: CPGlang
102: Community Forums
103: Photo Gallery
104: CPGlang
105: CPGlang
106: Home
107: Community Forums
108: Community Forums
109: CPGlang
110: Photo Gallery
111: Home
112: CPGlang
113: Community Forums
114: CPGlang
115: CPGlang
116: CPGlang
117: Community Forums
118: Community Forums
119: Community Forums
120: Home
121: Home
122: Community Forums
123: Community Forums
124: Community Forums
125: Home
126: Member Screenshots
127: Home
128: Community Forums
129: CPGlang
130: Community Forums
131: Community Forums
132: CPGlang
133: Community Forums
134: Member Screenshots
135: CPGlang
136: Community Forums
137: Community Forums
138: Photo Gallery
139: CPGlang
140: Home
141: Community Forums
142: Home
143: Community Forums
144: Community Forums
145: Community Forums
146: Community Forums
147: CPGlang
148: Community Forums
149: CPGlang
150: Community Forums
151: CPGlang
152: Community Forums
153: Community Forums
154: Community Forums
155: CPGlang
156: Home
157: CPGlang
158: Community Forums
159: Community Forums
160: Home

Staff Online:

No staff members are online!
Neighbor caught a bug.... :: Archived
This is a forum for Software related items such as OS', Virus notices, cool or free programs, etc. Gaming software should go in the gaming folder pertaining to the current info.
Post new topic    Revive this topic    Printer Friendly Page     Forum Index ›  Software

Topic Archived View previous topic :: View next topic  
Author Message
JG300-Ascout
Power User

Offline Offline
Joined: Jan 05, 2005
Posts: 6256
Location: Cyberspace
PostPosted: Tue Aug 10, 2010 8:34 pm
Post subject: Neighbor caught a bug....

Next door neighbor contracted "wuausclt.exe" bug, that affects several system files. Tried to help him out (he's using Firefox and Windows on a laptop. Windows of a version I'm not familiar with). Has no AV, so I tried to do a system restore, but the bug saw right through my little trick and bumps from that page in a fraction of a second. Tries to sell you a wipe for it's own virus.

Next move is to "reset to as system was new", if we can. He doesn't have any special apps on there so only some image files will be lost, if even those. Not critical.

Any other ideas?

_________________
"All facts go to clearly prove that Shades is a thrice-cursed traitor & mentally deranged person steeped in inveterate enmity toward mankind"
Back to top
View user's profile Photo Gallery
Shades
Forum Tree-Rat

Offline Offline
Joined: Mar 07, 2005
Posts: 6453
Location: 3rd Branch up, 'Ye Olde Oak', Green Wood.
PostPosted: Tue Aug 10, 2010 9:01 pm
Post subject: Re: Neighbor caught a bug....

I don't think it's a virus (but it could become one, or more).
It sounds more like adware.
Whatever he does, he MUST NOT click the link to the anti-virus it's trying to sell.
The trouble with that stuff is that it could be relatively harmless in itself, but they tend to also have a secondary package which can install a trojan subsequently to download more serious stuff by clicking their link.

I looked it up in the Symantec database and it's apparently quite adept at chainging registry files.
THIS might help (although it's not quite the same name as yours, with the 's' missing).

I would do the following in sequence:-

1) get good anti-virus, spyware, and firewall ready.

2) Clean disk of everything. Wipe it. There's nothing left on there you want because it's highly likely that thing will have left roots that will just re-install it, or worse, in a few weeks.
Save any important files to DVD for repair later.

3) Start again.

4) Install appropriate security.

5) Load DVD to drive and check for viruses before transferring any old files.

I had one of these a couple of years ago (my fault, I was clicking a sequence of messages without looking and clicked one of these without even seeing it. It was resident in my System Restore memory so, every time I cleaned it out, it would simply re-install itself (and a trojan I can't remember the name of) from there.

One thing, if your friend is still adamant about not bothering with security, just point out how easy it is for someone to take control of his computer, use it as a zombie, and start downlowing (for example) child porn. If someone does, he'd be responsible until and unless he can prove it wasn't him.
He should get security.

_________________
Skwerl's place.

Com-Central's cutest, fluffiest, twitchiest, tail.
CPU > Intel i9-9900k (o/c 4.9GHz); COOLING > BeQuiet! Dark Rock Pro 4;
MOBO > ASUS PRIME Z390-A; RAM > 2x32GB Corsair LPX 2666MHz;
GPU > Gigabyte GEFORCE GTX650Ti PCI-e 3.0 2Gb GDDR5;
AUDIO > Creative X-Fi Xtreme Music (plus - Universal Audio UAD2 Quad Custom accelerator);
HDD > 3x1TB+ M.2. SSDs; LCD > DELL - S2419HGF (1920x1080);
PSU > 650W be quiet Straight Power 11 - 80+ Gold;
CASE > BeQuiet! SILENT BASE 601; OS > Windows 10 Home Advanced (64-bit).
Back to top
View user's profile Visit poster's website ICQ Number
JG300-Ascout
Power User

Offline Offline
Joined: Jan 05, 2005
Posts: 6256
Location: Cyberspace
PostPosted: Tue Aug 10, 2010 11:00 pm
Post subject: Re: Neighbor caught a bug....

Thanks,

I already admonished him about some form of protection and browser settings. It was, in all likelihood, wide open...just used for wife's "facebook". Rolling Eyes

...apart from 7 Y.O. daughter playing a game which also led to an....unsavory link.

I think he needs to wipe it and institute some serious controls.

_________________
"All facts go to clearly prove that Shades is a thrice-cursed traitor & mentally deranged person steeped in inveterate enmity toward mankind"
Back to top
View user's profile Photo Gallery
piney
Power User

Offline Offline
Joined: Jan 24, 2006
Posts: 2330
Location: Republic of Southern New Jersey
PostPosted: Tue Aug 10, 2010 11:47 pm
Post subject: Re: Neighbor caught a bug....

from another forum

"I spent the morning trying to get rid of a virus called AV Security. It tells you that you are infected and the only way out is to buy the AV Security software ($50 for a 3 month license!) This is bogus, they are really after a credit card number. It came right through my AVG free antivirus. I googled it and found it is really running amuck and very hard to delete in that it disables ALL the executables in your Windows files and all your apps like Photoshop, FSDS, FSX, etc. I solved the problem by restoring to yesterday noon (July 3, 2010). "
The Bad news is you may have picked it up days or even weeks ago, one of the newest tricks they are using is a dorman period and or a wait time before the malware payload is released. I had a system infected in March that had been offline for almost 3 weeks and the user triggered the payload part way though the first day back to work after their vacation. In that case the system was off line but powered up while the user was away, when they reutrned the system received a security patch the first thing after they logged in, a complete system scan found nothing (normal procedure for Trend Micro - after any update it runs a full system scan).

The user had still not connected to our Intranet let alone the Internet, however they ran a report and saved it in HTML format, when they double clicked on the html file to open it ie was the program that opened the report, and poof the scareware Infection message, Luckly they were smart enough to pull the plug and call me before they did anything. After some serious investigating I foumd the file that had carried the payload, it had been dormant for almost a month. I was able to clean it with some serious effort and as far as I can tell it was using a cookie counter to trigger the payload, simply stated it went wild when the number of stored cookies reached a specifec amount the payload was released and the next time ie was started the message appears.

I am not trying to scare you or anyone, I just want to point out even if it appears you were infected by a specific site, or had only visited a few in a specific period of time, it is not absolute proof, of the cause you might have picked up the bug weeks ago and something you did or some external signal set it loose."

HTH

"
"

_________________
The only good skwerril is a dead un
Back to top
View user's profile Send e-mail
Shades
Forum Tree-Rat

Offline Offline
Joined: Mar 07, 2005
Posts: 6453
Location: 3rd Branch up, 'Ye Olde Oak', Green Wood.
PostPosted: Wed Aug 11, 2010 7:31 am
Post subject: Re: Neighbor caught a bug....

This is a good description/explanation of what you're dealing with;
www.symantec.com/norto...id=mislead

www.symantec.com/conne...w-me-money

www.symantec.com/conne...ney-part-2

www.symantec.com/conne...ney-part-3

www.symantec.com/conne...rt-tipping

Also, I still can't find anything on the file you list but "wuauclt.exe" seems to be a required file for Windows to update.
This may just be a file where the actual problem has been detected;These things will evolve and re-install themselves in a number of new places each time you find /remove them from another.
That makes it very hard to remove all traces of it, not to mention any damage it's already done to your registry which a simple anti-virus won't fix.

_________________
Skwerl's place.

Com-Central's cutest, fluffiest, twitchiest, tail.
CPU > Intel i9-9900k (o/c 4.9GHz); COOLING > BeQuiet! Dark Rock Pro 4;
MOBO > ASUS PRIME Z390-A; RAM > 2x32GB Corsair LPX 2666MHz;
GPU > Gigabyte GEFORCE GTX650Ti PCI-e 3.0 2Gb GDDR5;
AUDIO > Creative X-Fi Xtreme Music (plus - Universal Audio UAD2 Quad Custom accelerator);
HDD > 3x1TB+ M.2. SSDs; LCD > DELL - S2419HGF (1920x1080);
PSU > 650W be quiet Straight Power 11 - 80+ Gold;
CASE > BeQuiet! SILENT BASE 601; OS > Windows 10 Home Advanced (64-bit).
Back to top
View user's profile Visit poster's website ICQ Number
Display posts from previous:   
Post new topic    Revive this topic    Printer Friendly Page    Forum Index ›  Software
Page 1 of 1
All times are GMT - 6 Hours

Archive Revive
Username:
This is an archived topic - your reply will not be appended here.
Instead, a new topic will be generated in the active forum.
The new topic will provide a reference link to this archived topic.