Spyware Warrior

CalamityKen · Posted: Fri May 21, 2004 8:07 am Post subject: Look out for sysupd.exe

This is a new nasty and tricky to remove.

A system gets infected because the user has not installed ALL Windows Critical Updates.

The sysupd.exe will restart itself in about 5 seconds if terminated. The trick is to boot into Safe Mode then go to the folder where it is located (usually C:\WINDOWS\sysupd.exe) then end the process and quickly rename it to sysupd.old. This works in Win98/ME but not Win2K/XP.

The process is restarted because it is in the prefetch folder and makes it hard to delete in Win2K/XP.

I am watching how to remove it in Win2K/XP.

References:
http://computercops.biz/postt36896.html (there is no taskkill in XP Home)
http://www.dslreports.com/forum/remark,10091594
_________________
Install IE-SPYAD and SpywareBlaster updated regularly available in the following links .
How did I get infected? http://boards.cexx.org/viewtopic.php?t=957
Calendar Of Updates http://www.dozleng.com/updates/index.php?&act=calendar

member

Nick · Posted: Tue May 25, 2004 8:51 pm Post subject:

Any updates?
_________________
Nick's Security Ticker

CalamityKen · Posted: Wed May 26, 2004 4:30 am Post subject:

I haven't seen any updates and I haven't noticed any new infections either.
_________________
Install IE-SPYAD and SpywareBlaster updated regularly available in the following links .
How did I get infected? http://boards.cexx.org/viewtopic.php?t=957
Calendar Of Updates http://www.dozleng.com/updates/index.php?&act=calendar

member

CalamityKen · Posted: Sun May 30, 2004 9:36 am Post subject:

I believe the latest Ad-aware reference file targets this infection.
_________________
Install IE-SPYAD and SpywareBlaster updated regularly available in the following links .
How did I get infected? http://boards.cexx.org/viewtopic.php?t=957
Calendar Of Updates http://www.dozleng.com/updates/index.php?&act=calendar

member