What the... Winamp uninstaller infected with a worm?

Discussion in 'malware problems & news' started by ChrisBUK, Nov 28, 2007.

Thread Status:
Not open for further replies.
  1. ChrisBUK

    ChrisBUK Registered Member

    Joined:
    Nov 15, 2007
    Posts:
    86
    I downloaded Winamp about a week ago, from the offical website, just to try it out to see if I could use it as my main media player.
    It installed fine, worked great, but wasn't to my taste.
    So about 30 mins ago I was going through my ad/remove programs list, when I saw it there. As I wasn't going to use it again, I decided to uninstall it...
    I clicked Uninstall, and basically all hell broke lose.

    Comodo Defence+ started going crazy, saying "UninstWA.exe" was trying to launch "Au_.exe", so I looked it up on google and this Au_.exe looks like spyware/adware... so I blocked it. Then it came up again, saying that Bu_.exe wasn't to launch, then Cu_.exe and it kept going on and on....

    I then looked on my desktop, to find a two weird looking files which is in the screenshot below.

    I blocked all of them. Then Kaspersky started going crazy, and detected the Winamp uninstaller as a W32 Worm!!!

    "detected: riskware Worm.P2P.generic Running process: C:\Program Files\Winamp\UninstWA.exe".

    I tried to quarantine it, but it failed.

    Here are some screenshots of the event... Any idea's what the hell just happened?

    The second screenshot is the Comodo Defence+ log...

    http://img102.imageshack.us/img102/7646/wormcb7.jpg

    http://img98.imageshack.us/img98/8898/comodolh4.jpg
     
    Last edited: Nov 28, 2007
  2. Carver

    Carver Registered Member

    Joined:
    Feb 5, 2006
    Posts:
    1,827
    Location:
    USA
    I think it triggers a survey, I never pay attention to the surveys.
     
  3. Vettetech

    Vettetech Former Poster

    Joined:
    Nov 24, 2007
    Posts:
    339
    Go with Online Armor......Comodo is way too touchy.
     
  4. dNor

    dNor Registered Member

    Joined:
    Oct 3, 2007
    Posts:
    212
    Location:
    Irvine, CA, USA
Loading...
Thread Status:
Not open for further replies.