Re: strange software > winsupdater.exe

[Harlan Carvey <keydet89 () yahoo com>]

Esteban,

New here?  Welcome.

First of, what research have you done, besides using
anti-spyware and -virus?  Google searches?
 
Does the process have port open?  If so, which one(s)?

Do you see the process running in Task Manager?  If
so, have you run pmdump.exe, handle.exe, listdlls.exe,
or anything else against the process?

Have you run strings.exe against the file?

Have you done any sort of investigation at all?

If so, please post any information you may have, as it
might help others help you...




> We are looking at an abnormal program named
> "winsupdater.exe" and we are
> having trouble installing antispyware software on
> the infected computers,
> and the antivirus is not detecting the malware.
> We were able to disable it manual trough regedit,
> were it leaves a key entry
> in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> named
> "Microsoft Window Updater", but anyone knows if this
> is a new virus or
> spyware?
>
> Esteban Lara
> Director de IT
> Soluciones Digitales de Almacenamiento S.A.

------------------------------------------
Harlan Carvey, CISSP
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://windowsir.blogspot.com
------------------------------------------