updater keeps downloading....something.

Is it still there?

unfortunately, yes. :sad: lol

Hey flapjacksdan,

Time for a test.

Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com).

• There are 3 different versions. If one of them won't run then download and try to run the other one.
  
• Vista and Win7 users need to right click and choose Run as Admin.
  
• You only need to get one of them to run, not all of them.

rkill.exe
rkill.com
rkill.scr

It is possible that the infection you are trying to remove will not allow you to download files on the infected computer. If this is the case, then you will need to download the files requested on another computer and then transfer them to the Desktop of the infected computer. You can transfer the files via a CD/DVD, external drive, or USB flash drive.

Before proceeding any further the processes that belong to Windows Recovery need to be terminated so that it does not interfere with the cleaning procedure.

Double-click on the RKill.exe icon in order to automatically attempt to stop any processes associated with Windows Recovery and other Rogue programs.
===

Please do not reboot your computer.

After running Rkill, do you still see it running?

Hi Rodel Ituralde

ran rkill and updater still going. Did you need to see the log? pretty much reports no issues found.

Hello flapjacksdan,

No need for the log.

Does it appear in Safe Mode?

yes it appears in safe mode. In safe mode with networking it shows that its downloading/updating.

Howdy flapjacksdan.

We are going to have to go a little expansive here.

Please try Process Explorer:

http://technet.microsoft.com/en-au/sysinternals/bb896653.aspx

I want you to please run this program and scroll down the list. Please make a list of anything you don't recognise and post back here.

Hello there Rodel Ituralde I was really hoping that this was going to be something easy, something I was just overlooking. I really appreciate you taking the time to help me out.

Now on to the processes. I'm going to include all the ones that I might be even a little suspicious about. I'm going to try to give you as much information as I can.

Under System:
smss.exe -included because when I hover on it, where it should show the path it says path:error opening process. also shows nothing under the description or company name.

csrss.exe - this appears twice and the same description as above.

Under wininit.exe:
wininit.exe - no file path error opening process. no description. no company

services.exe - same as above

Under atiesxx.exe
atieclxx.exe - shows under the AMD ati folder but does not have filepath, description or company.


Under one of the svchost.exe 10 total
WUDFHost.exe same as above error opening process, no path, description company.


Under ccsvchst.exe which is symantec
ccsvchst.exe error opening process no path description or company

WLIDSVC.EXE this one seems a little more strange to me. It might be although it might be normal. when I hover on the top folder WLIDSVC.EXE it says path it says path:can not find the file specified. for services it says services:Windows live ID Sign-In Assistant [wlidsvc.exe]. Again nothing listed under description or company name. under this is listed again WLIDSVC.EXE Error opening process. no file path, company or description.


lsm.exe-no file path. error opening process no description/company.

winlogon.exe same as above



a couple of times something popped up in red really fast then went away. could not read what it was in time and not sure if it was the same things. everything else seems normal to me, at least associated with programs/software I have.

ok a couple things just happened. I was watching the explorer and at the same time I clicked the updater to see if it was still doing its thing. like I said it downloads, updates then minimizes right away to start all over again. Anyway at the exact time I clicked on it under wininit.exe (which I mentioned above) then under services.exe(mentioned) and then under svchost.exe appeared this
WmiPrvSE.exe with the same common issue. no path, description, company. and as I was typing this it flashed in red and disappeared. I clicked on the updater again and it came back.
This keeps repeating now with the WmiPrvSE.exe / clicking on the updater. I'm going to keep an eye on it and see if it continues. but we may be on to something here. also the WmiPrvSE.exe process does not go away at the end of the download/update process but seems to comeback if I try to open it. one "cycle" through the download update only takes about 2-3 seconds but the process stays for while before disappearing.

also though. Something popped up in red that said facebook update maybe. it happened really fast and disappeared. My wife uses facebook on here but not running at the moment.

I will keep you posted with anything different.

Hey flapjacksdan,

All of the files you listed are legitimate. They are all important system files.

I am not sure about the weird phenomenon you witness with WmiPrvSE since that should be safe too.

But the Facebook Updater is a potential suspect. Please check your programs and see if it is installed. Also, check your browsers and see if it is an Add-on. Let me know how you get on.

found a facebook updater in msconfig and unchecked it from startup. Also found this:
_uninst_49846627
unknown manufacturer
located appdata/Roaming/Microsoft/Windows/Start menu/Programs/Startup

any idea what that is? I stopped it as well and rebooted just to see what would happen. Neither one helped.

That Startup folder is important as that is where programs that startup can be found sometimes.

Is there a Facebook Updater in your Control Panel under Programs?

Hi Rodel

I know about the startup folder. was wondering about the program that was set to load during start up. _uninst_49846627.

no facebook updater in programs. There is a facebook video calling program from skype. should be legit. I only saw that facebook update thing once for a split second. I'll keep watching for it to see if I can grab exactly what it was.

found it
https://2img.net/h/i1336.photobucket.com/albums/o655/flapjacksdan/updater_zpsa0acde08.jpg

pops up for split second when I click on updater like the other file. did no do that the other day. Looks like its from wild tangent.

Hey flapjacksdan,

Please uninstall WildTangent and see if the updater disappears.

Updater is officially gone!!!!!!!!

Hooray!

Please download Security Check by screen317 from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Here you are my friend:

Results of screen317's Security Check version 0.99.57
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Norton Security Suite
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 11
Adobe Flash Player 10 Flash Player out of Date!
Adobe Reader XI
Google Chrome 24.0.1312.52
Google Chrome 24.0.1312.56
Google Chrome CommonDotNET.dll..
Google Chrome IdVaultCore.dll..
Google Chrome IdVaultCore.XmlSerializers.dll.
Google Chrome Microsoft.mshtml.dll.
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
Symantec Norton Online Backup NOBuAgent.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````

Hello flapjacksdan,

Your version of Adobe Flash Player is out of date. Please follow these instructions to update to the latest version:

Go to the Adobe Global Notifications Update website here:

http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager05.html#118377

A small box to the right within the window should load. Please select how often you would like Adobe to check for a new update for its Flash Player.
[indent]Note: This has to be done separately for Firefox and IE.[/indent]

If a new version is found:

• Please tick the License Agreement.
  
• Click Install.
  Note: If you are running Mozilla Firefox all of its windows will need to be closed.
• Click Done.

Note: In future if an update is available Adobe will notify you on your Desktop via the Adobe Download Manager.

Are you still with me?