msnupdate.exe

Discussion:

msnupdate.exe

(too old to reply)

JJ RD

2010-04-13 00:12:01 UTC

What is this? Every time I log off, a screen pops up asking permission to
install this. Since the publisher is listed as "unknown publisher" I am very
leary of continuing. I've seen on another discussion board that this is a
trojan virus. Any input would be appreciated. If this is bad...how do I get
rid of it?

PA Bear [MS MVP]

2010-04-13 07:11:42 UTC

Permalink

Always state your full Windows version (e.g., WinXP SP3; WinXP 64-bit SP2;
Vista SP1; Vista 64-bit SP2; Win7; Win7 64-bit) when posting in a forum or
newsgroup. Please do so in your next reply.

What anti-virus application or security suite is installed and is your
subscription current? What anti-spyware applications (other than Defender)?
What third-party firewall (if any)?

Has a(another) Norton or McAfee application ever been installed on the
computer (e.g., a free-trial version that came preinstalled when you bought
it)?

There is a very good chance that you are seeing the effects of a hijackware
infection (i.e., Trojan W32/Rbot-AAM WORM/IRC)!

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

Microsoft PCSafety provides home users (only) with no-charge support in
dealing with malware infections such as viruses, spyware (including unwanted
software), and adware.
https://support.microsoft.com/oas/default.aspx?&prid=7552&st=1

Also available via the Consumer Security Support home page:
https://consumersecuritysupport.microsoft.com/

Otherwise...

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2a. WinXP => Run the Windows Live Safety Center's 'Protection' scan (only!)
in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

2b. Vista or Win7=> Run this scan instead:
http://onecare.live.com/site/en-us/center/whatsnew.htm

3. Now run a thorough check for hijackware, including posting requested logs
in an appropriate forum, not here. DO NOT SKIP THIS STEP!!

Checking for/Help with Hijackware:
• http://mvps.org/winhelp2002/unwanted.htm
• http://inetexplorer.mvps.org/tshoot.html
• http://www.mvps.org/sramesh2k/Malware_Defence.htm
• http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002

Post by JJ RD
What is this? Every time I log off, a screen pops up asking permission to
install this. Since the publisher is listed as "unknown publisher" I am
very leary of continuing. I've seen on another discussion board that this
is a trojan virus. Any input would be appreciated. If this is bad...how
do I get rid of it?

Earle Horton

2010-04-13 16:23:52 UTC

Permalink

PA's message is an excellent source of information, worth keeping. For what
it's worth, I have the latest Qwest-branded version of MSN Explorer
installed, and there is no "msnupdate.exe" anywhere to be found. I only
have "update.exe" and "updater.exe". That doesn't mean that your copy isn't
legit though.

Earle

Post by PA Bear [MS MVP]
Always state your full Windows version (e.g., WinXP SP3; WinXP 64-bit SP2;
Vista SP1; Vista 64-bit SP2; Win7; Win7 64-bit) when posting in a forum or
newsgroup. Please do so in your next reply.
What anti-virus application or security suite is installed and is your
subscription current? What anti-spyware applications (other than
Defender)? What third-party firewall (if any)?
Has a(another) Norton or McAfee application ever been installed on the
computer (e.g., a free-trial version that came preinstalled when you
bought it)?
There is a very good chance that you are seeing the effects of a
hijackware infection (i.e., Trojan W32/Rbot-AAM WORM/IRC)!
NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!
Microsoft PCSafety provides home users (only) with no-charge support in
dealing with malware infections such as viruses, spyware (including
unwanted software), and adware.
https://support.microsoft.com/oas/default.aspx?&prid=7552&st=1
https://consumersecuritysupport.microsoft.com/
Otherwise...
http://www.microsoft.com/security/malwareremove/default.mspx
NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.
2a. WinXP => Run the Windows Live Safety Center's 'Protection' scan
http://onecare.live.com/site/en-us/center/howsafe.htm
http://onecare.live.com/site/en-us/center/whatsnew.htm
3. Now run a thorough check for hijackware, including posting requested
logs in an appropriate forum, not here. DO NOT SKIP THIS STEP!!
• http://mvps.org/winhelp2002/unwanted.htm
• http://inetexplorer.mvps.org/tshoot.html
• http://www.mvps.org/sramesh2k/Malware_Defence.htm
• http://www.elephantboycomputers.com/page2.html#Removing_Malware
**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums.**
If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002

JJ RD

2010-04-13 22:56:01 UTC

Permalink

Thank you all for your helpful input.

Please pardon my obvious ignorance and/or vagueness, but based on the
thoroughness of your replies, you have most likely provided information not
only helpful in my situation, but also perhaps for others.

JJ RD

Post by Earle Horton
PA's message is an excellent source of information, worth keeping. For what
it's worth, I have the latest Qwest-branded version of MSN Explorer
installed, and there is no "msnupdate.exe" anywhere to be found. I only
have "update.exe" and "updater.exe". That doesn't mean that your copy isn't
legit though.
Earle

PA Bear [MS MVP]

2010-04-13 23:19:35 UTC

Permalink

<Henry Higgins> By George, I think he's got it! He's really got it! <wink>

Post by JJ RD
Thank you all for your helpful input.
Please pardon my obvious ignorance and/or vagueness, but based on the
thoroughness of your replies, you have most likely provided information not
only helpful in my situation, but also perhaps for others.
JJ RD

Post by Earle Horton
PA's message is an excellent source of information, worth keeping. For
what it's worth, I have the latest Qwest-branded version of MSN Explorer
installed, and there is no "msnupdate.exe" anywhere to be found. I only
have "update.exe" and "updater.exe". That doesn't mean that your copy
isn't legit though.
Earle

PA Bear [MS MVP]

2010-04-13 17:07:07 UTC

Permalink

cf.
http://www.sophos.com/security/analyses/viruses-and-spyware/w32rbotaam.html

Post by PA Bear [MS MVP]
Always state your full Windows version (e.g., WinXP SP3; WinXP 64-bit SP2;
Vista SP1; Vista 64-bit SP2; Win7; Win7 64-bit) when posting in a forum or
newsgroup. Please do so in your next reply.
What anti-virus application or security suite is installed and is your
subscription current? What anti-spyware applications (other than Defender)?
What third-party firewall (if any)?
Has a(another) Norton or McAfee application ever been installed on the
computer (e.g., a free-trial version that came preinstalled when you bought
it)?
There is a very good chance that you are seeing the effects of a hijackware
infection (i.e., Trojan W32/Rbot-AAM WORM/IRC)!
NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!
Microsoft PCSafety provides home users (only) with no-charge support in
dealing with malware infections such as viruses, spyware (including unwanted
software), and adware.
https://support.microsoft.com/oas/default.aspx?&prid=7552&st=1
https://consumersecuritysupport.microsoft.com/
Otherwise...
http://www.microsoft.com/security/malwareremove/default.mspx
NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.
2a. WinXP => Run the Windows Live Safety Center's 'Protection' scan (only!)
http://onecare.live.com/site/en-us/center/howsafe.htm
http://onecare.live.com/site/en-us/center/whatsnew.htm
3. Now run a thorough check for hijackware, including posting requested logs
in an appropriate forum, not here. DO NOT SKIP THIS STEP!!
• http://mvps.org/winhelp2002/unwanted.htm
• http://inetexplorer.mvps.org/tshoot.html
• http://www.mvps.org/sramesh2k/Malware_Defence.htm
• http://www.elephantboycomputers.com/page2.html#Removing_Malware
**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums.**
If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.

StephenB

2010-04-13 08:39:31 UTC

Permalink

PA Bear asked a whole bunch of good questions because you are not telling us
enough information.
What version of MSN Explorer are you using?
Are you a MSN subscriber via a partner like Qwest or Verizon or direct with
Microsoft?
Log off where? Log out of MSN or Log out of Windows? If the former, which I
suspect, say, "yes" and MSN Explorer will update.
-steve

Post by JJ RD
What is this? Every time I log off, a screen pops up asking permission to
install this. Since the publisher is listed as "unknown publisher" I am very
leary of continuing. I've seen on another discussion board that this is a
trojan virus. Any input would be appreciated. If this is bad...how do I get
rid of it?

--
Stephen Boots
MVP Windows Live
Windows Live OneCare/Live Mesh/MSE Forums Moderator
***@mvps.org