Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Ssupdate.exe?


  • Please log in to reply
11 replies to this topic

#1 zemoman

zemoman

  • Members
  • 150 posts
  • OFFLINE
  •  
  • Location:United States, Everett, MA
  • Local time:03:03 AM

Posted 17 August 2006 - 06:41 PM

Hi today i turned on my computer and something came up from my nis 2006 saying a program called SSUPDATE.exe was tryin to access the internet (outbound). I currently blocked it from accessing the internet. Is this program a virus?? should i allow it next time it comes up again???

THANKS IN ADVANCE!

Edited by zemoman, 17 August 2006 - 06:41 PM.

ROOTKITS BAD!

BC AdBot (Login to Remove)

 


#2 FifeFlyer

FifeFlyer

  • Members
  • 101 posts
  • OFFLINE
  •  
  • Location:North of Hadrians Wall.
  • Local time:09:03 AM

Posted 17 August 2006 - 07:27 PM

I would block it for now until you're 100 % sure you know what it is. A quick google suggests it's possibly this , although i do believe the programme SUPERantiSpyware may also come under this name.

I would direct you to the hijackthis forum but as a newbie i'm not sure of the rules and regulations on this , so in the meantime i would deny it access and wait until one of the more experienced forum members comes along to give advice.

#3 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,958 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:03 AM

Posted 17 August 2006 - 07:43 PM

Can you find the file in your computer? If so, upload it to JottiScan which uses several different AV, Anti-spyware, and anti-malware scanners to check it. Post back with the results. Here is the link for JottiScan. Meantime, I'm going to see if I can find out more about what that file is.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#4 zemoman

zemoman
  • Topic Starter

  • Members
  • 150 posts
  • OFFLINE
  •  
  • Location:United States, Everett, MA
  • Local time:03:03 AM

Posted 17 August 2006 - 08:09 PM

i have superantispyware could ssupdate.exe be from that???
ROOTKITS BAD!

#5 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,614 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:03 AM

Posted 17 August 2006 - 08:51 PM

What folder it is in would give a hint too. If your firewall doesn't list the file path, do a search for it and if you're on XP make sure to enable search for hidden files and folders.

OB's suggestion is a good one too, but you would have to know where the file is to browse to it to have it scanned. It doesn't take long either.

The thing about people

is they change

when they walk away.--Mipso


#6 zemoman

zemoman
  • Topic Starter

  • Members
  • 150 posts
  • OFFLINE
  •  
  • Location:United States, Everett, MA
  • Local time:03:03 AM

Posted 17 August 2006 - 09:02 PM

you know it did list the path but i forgot it next time ill write it down. it hasnt messed up anything on my pc and i did a nis 2006 virus scan, a adaware spyware scan, a superantispyware scan, and stopzilla didnt detect a thing... the firewall thing also hasnt come up any more. but could you do me a favor and check to see if its not something to do with stopzilla because recently i allowed stopzilla to downlloa updates automatically, and could you check and make sure its not something that belongs to superantispyware???

I WOULD REALLY APPRECIATE IT THANX :thumbsup:

Edited by zemoman, 17 August 2006 - 09:03 PM.

ROOTKITS BAD!

#7 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,614 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:03 AM

Posted 17 August 2006 - 09:13 PM

I can't check it without being physically present at your machine or unless you post which folder it is in. DyFuCa is known to use that file name, but something legitimate could use it as well. If you don't want to search your own system for it and post back here what folder it is in, just post a HJT log--I know you know how to do that as you've done it before.

The thing about people

is they change

when they walk away.--Mipso


#8 FifeFlyer

FifeFlyer

  • Members
  • 101 posts
  • OFFLINE
  •  
  • Location:North of Hadrians Wall.
  • Local time:09:03 AM

Posted 17 August 2006 - 09:16 PM

It MAY be , and i stress may be , superantispyware trying to update. Is it set for automatic updates ?

You may get a clue by trying to manually update the programme and see if NIS asks for permission.

#9 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,958 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:03 AM

Posted 17 August 2006 - 09:46 PM

Knowing the filepath is crucial. Doing a search for that file in BC's in startup database shows 4 bad news dudes, so if this thing is in your startup list, I strongly suspect you have an infection. But if it's not there, it could be something else.

Orange Blossom :thumbsup:

Edited by Orange Blossom, 18 August 2006 - 02:48 PM.

Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,467 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:03 AM

Posted 18 August 2006 - 08:06 AM

The normal installation path for SUPERAntispyware is Program Files.

Open Windows Explorer, go to C:\Program Files\ and then open the folder for SUPERAntispyware.
SSUpdate can be found there. The file is 140 KB, dated 2/17/06, v1.0.0.1030.

However, since there is a malware file with the same name, you should still double check by doing a search and make sure you don't have that one as well. The DyFuCA file with that name is usually found in C:\Windows\system32\.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#11 zemoman

zemoman
  • Topic Starter

  • Members
  • 150 posts
  • OFFLINE
  •  
  • Location:United States, Everett, MA
  • Local time:03:03 AM

Posted 18 August 2006 - 02:05 PM

ok thank you ill check windows explorer and post back what i find later! THNAX FOR YOUR HELP!!
ROOTKITS BAD!

#12 zemoman

zemoman
  • Topic Starter

  • Members
  • 150 posts
  • OFFLINE
  •  
  • Location:United States, Everett, MA
  • Local time:03:03 AM

Posted 18 August 2006 - 06:14 PM

ok good news everyone i went to my programs files then superantispyware folder and SSupdate was there. So SSUpdate belongs to superantispyware.

THANX FOR ALL YOUR HELP EVERYONE! :thumbsup:

Edited by zemoman, 18 August 2006 - 06:14 PM.

ROOTKITS BAD!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users