Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

SearchSettings, ApplicationUpdater, and suspicious process during shutdown


  • Please log in to reply
No replies to this topic

#1 Ricepigeon

Ricepigeon

  • Members
  • 67 posts
  • OFFLINE
  •  
  • Local time:11:55 PM

Posted 01 December 2010 - 02:56 PM

As I was shutting down my laptop, I noticed that any open applications I had would close normally (displaying a window showing a progress bar until the program shuts down). I noticed that one of these windows contained a program name in some east asian language (possibly chinese or japanese). this has happened each shutdown. After the next time I boot the laptop, I went to inspect any running processes and found ApplicationUpdater.exe and SearchSettings.exe listed in the running processes. After doing some research about these processes and learning they may be potential spyware, I immediately went and stopped these processes and deleted the folders containing them (which were located in the folder C:\Program Files\Common\Spigot). Just for safe measure I also deleted the Spigot folder. I also deleted any registry entries pertaining to these two programs just for safe measure.

Afterwards I decided to run gmer.exe and dds.scr to obtain log files that I was going to post in another topic, but hit a brick wall. Gmer causes the laptop to bluescreen, and dds will eventually freeze about 75% of the way during a scan (this also occured in safe mode), and when I attempt to close it, I have no choice but to reboot. I even left it running for about 4 hours and the same scenario occurs. What should I do from here and how will I know if I'm completely clean or not? I'm running Windows XP SP 2, btw.

EDIT: In addition to the above, I've also been getting google searches redirected to random sites. I've read a similar scenario to this on a separate topic in these forums, which suggested to download TDSSKiller. I ran it and it detected and removed Rootkit.Win32.TDSS.tdl4. The search redirects seem to have ceased, but I still want to know if the issue is resolved. If necessary, I'll provide the log file upon request.

EDIT2: Upon another shutdown of the computer, the same process which I described before (with the east asian language) showed up again. Neither ApplicationUpdater nor SearchSettings were in the list of active processes before shutting down, which leads me to believe that this is another process I'm not aware of.

Edited by Ricepigeon, 02 December 2010 - 10:37 AM.


BC AdBot (Login to Remove)

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users