What the... Winamp uninstaller infected with a worm?

Discussion in 'malware problems & news' started by ChrisBUK, Nov 28, 2007.

Thread Status:
Not open for further replies.
  1. ChrisBUK

    ChrisBUK Registered Member

    Joined:
    Nov 15, 2007
    Posts:
    86
    I downloaded Winamp about a week ago, from the offical website, just to try it out to see if I could use it as my main media player.
    It installed fine, worked great, but wasn't to my taste.
    So about 30 mins ago I was going through my ad/remove programs list, when I saw it there. As I wasn't going to use it again, I decided to uninstall it...
    I clicked Uninstall, and basically all hell broke lose.

    Comodo Defence+ started going crazy, saying "UninstWA.exe" was trying to launch "Au_.exe", so I looked it up on google and this Au_.exe looks like spyware/adware... so I blocked it. Then it came up again, saying that Bu_.exe wasn't to launch, then Cu_.exe and it kept going on and on....

    I then looked on my desktop, to find a two weird looking files which is in the screenshot below.

    I blocked all of them. Then Kaspersky started going crazy, and detected the Winamp uninstaller as a W32 Worm!!!

    "detected: riskware Worm.P2P.generic Running process: C:\Program Files\Winamp\UninstWA.exe".

    I tried to quarantine it, but it failed.

    Here are some screenshots of the event... Any idea's what the hell just happened?

    The second screenshot is the Comodo Defence+ log...

    http://img102.imageshack.us/img102/7646/wormcb7.jpg

    http://img98.imageshack.us/img98/8898/comodolh4.jpg
     
    Last edited: Nov 28, 2007
  2. Carver

    Carver Registered Member

    Joined:
    Feb 5, 2006
    Posts:
    1,909
    Location:
    USA
    I think it triggers a survey, I never pay attention to the surveys.
     
  3. Vettetech

    Vettetech Former Poster

    Joined:
    Nov 24, 2007
    Posts:
    339
    Go with Online Armor......Comodo is way too touchy.
     
  4. dNor

    dNor Registered Member

    Joined:
    Oct 3, 2007
    Posts:
    212
    Location:
    Irvine, CA, USA
Loading...
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.