SoftwareUpdater.Ui.exe not detected by Avast! or Windows Defender

[ladeedah]

I don't understand why it's not being detected so it can be fixed before it does damage.  All the info I've found on forums and blogs say it's  very bad but that it's dangerous to just delete it or the whole folder it's in (SoftwareUpdater in Program Files (x86)).  It's running in my task manager taking up 25% of my resources but I'm afraid to end task on it, that it might do more harm if I do.  There are all kinds of complicated "fixes" for removal on forums and blogs but I only trust Avast.  I have submitted this file name to Avast as an undetected infected file and hope I get an email soon from them or that we get an Avast update to fix it....because it's said to be able to block virus programs and task manager. Does anyone know more about this? 

It seems to have installed in my computer 12/24 according to the properties or updated the existing one that was there then, which may or may not have been a safe one. It causes a popup called Freemium Paper Update or something to pop up from time to time on my screen and I have never installed any Freemium.  But that's not the problem....if you google it you'll see that it can compromise privacy, send other popups and disrupt browser activity.  I just want Avast to get rid of it.  I don't trust anyone else.  It causes the game I play to lock up because it's using more resources than the game itself.

I'm just trying to find out more until I get an email reply from Avast or they do an update to get rid of this thing.  I'd like to find out from Avast if it's ok to end task on it in task manager until they do an update to get rid of it.

[ladeedah]

Still hoping Avast can remove this with a scan.

[Pondus]

have you tested the file at www.virustotal.com / www.metascan-online.com / www.jotti.org
post link to scan result here

[ladeedah]

https://www.virustotal.com/en/file/91dc5b7b720182d50ab67b82c2e7a49430d6421fe8f89ddc2dc1c237bac3b62f/analysis/1389341620/

https://www.metascan-online.com/en/scanresult/file/ce48c29d823849388e0b762169416494

http://virusscan.jotti.org/en/scanresult/79e54ab628235046cf91088fdbb42855fa7399d2/11e23f2c5dd3d1bfaef74ba89103a7c4896e51b9


Thanks that's encouraging.  Only a couple found it to be a threat.  So I guess it should be safe for me to end task on it in Task Manager.  It's using almost as much memory right now as the game Second Life that I'm on and I'm just idle there now. 

Thanks for your help.  I might end task on it but still not going to try the complicated manual removals I saw on the web.

[Pondus]

seems very new.    First submission 2013-12-19 14:15:46 UTC ( 3 weeks ago )

if you need help removing malware, follow guide.   http://forum.avast.com/index.php?topic=53253.0
attach logs from Malwarebytes / OTL / aswMBR

when done, malware specialists will be notified and assist you...

[ladeedah]

Well I need sleep badly now so it's gonna have to wait.  I found this and it makes it sound REALLY bad.  But I don't know this company and I don't want to download anything.   Just putting this link in case you want to read up on what they say this trojan is:   http://www.yac.mx/en/guides/virus/20131212-how-to-remove-SoftwareUpdater.Ui.exe-through-yac-virus-removal-tool.html .

I just wish Avast could get rid of it with one click.  So if this is truly a trojan, we should be seeing an update for it soon.  Right? 

*Update*  Well, leaving the computer on for now but ended task on SoftwareUpdater.Ui.exe and I haven't crashed....so far so good, at least so I can go sleep!  Will check back later today. 

A friend of mine just told me she had something similar last week but didn't know the name of it.   It kept sending popups and resetting her home page.  Her nephew did some things and a boot scan with Avast and that got rid of it.  I'm not sure if it's the same thing though....I know it got to the point she started to lock up when trying to get on any program like AOL, Second Life and any web page.  That's when she called for help from her nephew.  I'll be back.

[Pondus]

 
A friend of mine just told me she had something similar last week but didn't know the name of it.   It kept sending popups and resetting her home page.  Her nephew did some things and a boot scan with Avast and that got rid of it. 

A browser hijacker...usually crap that is bundled with freeware download
This is usually classed as PUP = not virus / Possible Unwanted Program
Avast Pup detection is default of all places exept in bootscan

[ladeedah]

I just finished running a bootscan and there were detections of  [PUP] in 9 locations.  Some were the same [PUP].  Win32:Dropper-gen [Drp] is the one associated with SoftwareUpdater.Ui.exe and is in the chest now. Hope that fixed it for good. SoftwareUpdater folder is still in my Program Files (x86) containing config, Maintenance.exe, SoftwareUpdater.Bootstrapper.exe, SoftwareUpdater.dll and SystemStore.exe but the file SoftwareUpdater.Ui.exe is GONE. Yay! 

I see now I didn't have the Scan All Files box checked in the Scan Parameters for Full System Scan and Quick Scan, so I hope by checking that now that the [PUP] files will be detected from now on.

Thanks for your replies and help.

[Pondus]

I see now I didn't have the Scan All Files box checked in the Scan Parameters for Full System Scan and Quick Scan, so I hope by checking that now that the [PUP] files will be detected from now on. 

Eh....no, you need to check PUP detection

[ladeedah]

In the previous version, I'm sure I had that on, but it wasn't on here....I don't know why.  Thought it was already....anyway, it's on now and thank you again.

Ugh...PUP wasn't checked in my laptop either or my friend's PC...had her look.  I thought it would have been on by default.