updater.exe trojan

[Far]

Has anyone come across this before?

http://www.processlibrary.com/directory/files/updater/25719/

Its in my task bar and has a ying/yang symbol, when i open it its called 'miner' and looks like a very basic app. had it a while, its kept in ..\AppData\Roaming\Updater

I deleted it once, but now its back.

Is it halmful, and what would get rid of it?

 

[Version 1.3]

Updater.exe sometimes runs on my laptop, Never had any problems. but i don't have a yingyang symbol or the miner thing...

 

[urbanfox]

How did you get rid of it and what security software are you running.

 

[Far]

i just went to the folder where its located and renamed the .exe, but it came back like 10 days later.

using security essentials and standard windows firewall. just installed ad-ware, but it didn't detect it.

 

[urbanfox]

More than likely it has other file names as well as possibly being in the registry. Try Avast and see if that detects it.

 

[Far]

this is what has come up in the miner app (updater.exe) when i opened it,

Sending stats via HTTP POST
Start Mining GPU: bitparking.com
Starting process:  -u http://NHmndUPU5v3w6sPYjnp7KUqASJ1idLKTqZ:[email protected]:9098/ -k poclbm DEVICE=0 AGGRESSION=3 -v FASTLOOP VECTORS
[Debug] apppath: C:\Users\Media\AppData\Roaming\Updater\apps\\
process started.
[Debug] Switching Miner Types
Putting miner to sleep.
Killing MinerProc process. -----------------------

just deleted the whole updater folder, will see if it comes back.

 

[Tai]

Anything that contains the word 'cheese', well, lol

 

[urbanfox]

this is what has come up in the miner app (updater.exe) when i opened it,

Sending stats via HTTP POST
Start Mining GPU: bitparking.com
Starting process:  -u http://NHmndUPU5v3w6sPYjnp7KUqASJ1idLKTqZ:[email protected]:9098/ -k poclbm DEVICE=0 AGGRESSION=3 -v FASTLOOP VECTORS
[Debug] apppath: C:\Users\Media\AppData\Roaming\Updater\apps\\
process started.
[Debug] Switching Miner Types
Putting miner to sleep.
Killing MinerProc process. -----------------------

just deleted the whole updater folder, will see if it comes back.

Have you installed anything to do with bitcoining recently?

Looks like that.

Pretty ingenious if you didn't install it, stealing people's computing power.

 

[Far]

never heard of bitcoining before i just visited bitparking.com

yeah i thought it was clever too, but i still want it gone lol.

 

[urbanfox]

Did you run avast or something like AVG

 

[Far]

ran avast, still didn't find anything.

 

[Sanity]

I not had same virus but the one i had kept coming back, you know the fake virus scan thing, i tried everything to clear it but it kept coming back and the only way i managed to remove it was formatting, no scanner will pick it up but i so suggest using that Spyware Doctor.

 

[Far]

yeah i was thinking its time to format anyway. just need to buy an external hard drive to back stuff up first as mines broke.