What the... Winamp uninstaller infected with a worm?

Discussion in 'malware problems & news' started by ChrisBUK, Nov 28, 2007.

Thread Status:
Not open for further replies.
  1. ChrisBUK

    ChrisBUK Registered Member

    I downloaded Winamp about a week ago, from the offical website, just to try it out to see if I could use it as my main media player.
    It installed fine, worked great, but wasn't to my taste.
    So about 30 mins ago I was going through my ad/remove programs list, when I saw it there. As I wasn't going to use it again, I decided to uninstall it...
    I clicked Uninstall, and basically all hell broke lose.

    Comodo Defence+ started going crazy, saying "UninstWA.exe" was trying to launch "Au_.exe", so I looked it up on google and this Au_.exe looks like spyware/adware... so I blocked it. Then it came up again, saying that Bu_.exe wasn't to launch, then Cu_.exe and it kept going on and on....

    I then looked on my desktop, to find a two weird looking files which is in the screenshot below.

    I blocked all of them. Then Kaspersky started going crazy, and detected the Winamp uninstaller as a W32 Worm!!!

    "detected: riskware Worm.P2P.generic Running process: C:\Program Files\Winamp\UninstWA.exe".

    I tried to quarantine it, but it failed.

    Here are some screenshots of the event... Any idea's what the hell just happened?

    The second screenshot is the Comodo Defence+ log...

    http://img102.imageshack.us/img102/7646/wormcb7.jpg

    http://img98.imageshack.us/img98/8898/comodolh4.jpg
     
    Last edited: Nov 28, 2007
  2. Carver

    Carver Registered Member

    I think it triggers a survey, I never pay attention to the surveys.
     
  3. Vettetech

    Vettetech Former Poster

    Go with Online Armor......Comodo is way too touchy.
     
  4. dNor

    dNor Registered Member

Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice