Jump to content

Recommended Posts

Posted (edited)

What is UpdateStar Drivers?

The Malwarebytes research team has determined that UpdateStar Drivers is a "driver updater". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.
This one also offered to install several other programs during the install process.

How do I know if I am infected with UpdateStar Drivers?

This is how the main screen of the system optimizer looks:

main.png

You will find these icons in your taskbar, your startmenu, and on your desktop:

icons.png

and see these warnings during install:

warning1.png

warning5.png

and this screens when you decide to fix the "problems":

warning7.png

You may see this entry in your list of installed programs:

warning4.png

and this task in your list of Scheduled Tasks:

warning3.png

How did UpdateStar Drivers get on my computer?

These so-called system optimizers use different methods of getting installed. This particular one was installed by a bundler:

website.png

How do I remove UpdateStar Drivers?

Our program Malwarebytes can detect and remove this potentially unwanted application.

  • Please download Malwarebytes to your desktop.
  • Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.

Is there anything else I need to do to get rid of UpdateStar Drivers?

  • No, Malwarebytes removes UpdateStar Drivers completely.
  • The shortcut called UpdateStar Drivers on the desktop can be deleted if it belonged to the rogue.

How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this system optimizer.

As you can see below the full version of Malwarebytes would have protected you against the UpdateStar Drivers installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.


 

protection1.png


and we block access to their domain:
 

protection2.png


Technical details for experts

You may see these entries in FRST logs:


 

 () C:\Program Files (x86)\UpdateStar Drivers\drivers.exe
 C:\Users\Public\Desktop\UpdateStar Drivers.lnk
 C:\Users\{username}\AppData\Roaming\UpdateStar Drivers
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateStar Drivers
 C:\Program Files (x86)\UpdateStar Drivers
 C:\Program Files\updatestardrivers.exe

UpdateStar Drivers (HKLM-x32\...\UpdateStar Drivers) (Version: 10.0.0 - UpdateStar)
Task: {634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2} - System32\Tasks\drivers => C:\Program Files (x86)\UpdateStar Drivers\drivers.exe [2018-02-22] ()
() C:\Program Files (x86)\UpdateStar Drivers\Resource.dll

Alterations made by the installer:
 

File system details [View: All details] (Selection)
---------------------------------------------------
    In the existing folder C:\Program Files
       Adds the file updatestardrivers.exe"="3/13/2018 1:01 PM, 140136 bytes, A
    Adds the folder C:\Program Files (x86)\UpdateStar Drivers
       Adds the file drivers.chm"="3/13/2018 1:02 PM, 327389 bytes, A
       Adds the file drivers.exe"="2/22/2018 1:16 PM, 9447104 bytes, A
       Adds the file Resource.dll"="3/13/2018 1:02 PM, 4020416 bytes, A
       Adds the file uninstall.exe"="3/13/2018 1:02 PM, 196816 bytes, A
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateStar Drivers
       Adds the file Uninstall.lnk"="3/13/2018 1:02 PM, 1100 bytes, A
       Adds the file UpdateStar Drivers.lnk"="3/13/2018 1:02 PM, 1088 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\UpdateStar Drivers
       Adds the file config.bin"="3/13/2018 1:03 PM, 11303 bytes, A
       Adds the file config.ini"="3/13/2018 1:03 PM, 386 bytes, A
       Adds the file license.ini"="11/30/2011 9:00 PM, 3120 bytes, A
    Adds the folder C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\Backup
    Adds the folder C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\Download
    In the existing folder C:\Users\Public\Desktop
       Adds the file UpdateStar Drivers.lnk"="3/13/2018 1:02 PM, 1070 bytes, A
    In the existing folder C:\Windows\System32\Tasks
       Adds the file drivers"="3/13/2018 1:02 PM, 3324 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UpdateStar Drivers]
       "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers\drivers.exe,0"
       "DisplayName"="REG_SZ", "UpdateStar Drivers"
       "DisplayVersion"="REG_SZ", "10.0.0"
       "EstimatedSize"="REG_DWORD", 13663
       "InstallLocation"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers"
       "NoModify"="REG_DWORD", 1
       "NoRepair"="REG_DWORD", 1
       "Publisher"="REG_SZ", "UpdateStar"
       "UninstallString"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers\uninstall.exe"
       "VersionMajor"="REG_DWORD", 10
       "VersionMinor"="REG_DWORD", 0
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\UpdateStar Drivers]
       "(Default)"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers"
    [HKEY_CURRENT_USER\Software\undefined]
       "updatestardrivers.exe"="REG_SZ", "1520942465761,http://static.updatestar.net/dl/updatestar/drivers/updatestardrivers.exe"
    [HKEY_CURRENT_USER\Software\UpdateStar Drivers]
       "(Default)"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers"
       "InstallerLanguage"="REG_SZ", "1033"
    [HKEY_CURRENT_USER\Software\UpdateStar Drivers\Settings\UpdateStar Drivers\Recent File List]
    [HKEY_CURRENT_USER\Software\UpdateStar Drivers\Settings\UpdateStar Drivers\Settings\ControlBars-Summary]

Malwarebytes log:
 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 3/13/18
Scan Time: 1:13 PM
Log File: f2b5621f-26b7-11e8-80c4-080027235d76.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.4328
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 243673
Threats Detected: 32
Threats Quarantined: 32
Time Elapsed: 3 min, 9 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 1
PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAM FILES (X86)\UPDATESTAR DRIVERS\DRIVERS.EXE, Quarantined, [14743], [500052],1.0.4328

Module: 2
PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAM FILES (X86)\UPDATESTAR DRIVERS\DRIVERS.EXE, Quarantined, [14743], [500052],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Program Files (x86)\UpdateStar Drivers\Resource.dll, Quarantined, [14743], [500053],1.0.4328

Registry Key: 10
PUP.Optional.UpdateStarDrivers.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\drivers, Quarantined, [14743], [500052],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2}, Quarantined, [14743], [500052],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2}, Quarantined, [14743], [500052],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\drivers, Quarantined, [14743], [-1],0.0.0
PUP.Optional.UpdateStarDrivers.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2}, Quarantined, [14743], [-1],0.0.0
PUP.Optional.UpdateStarDrivers.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2}, Quarantined, [14743], [-1],0.0.0
PUP.Optional.UpdateStarDrivers, HKCU\SOFTWARE\UpdateStar Drivers, Quarantined, [15028], [500058],1.0.4328
PUP.Optional.UpdateStarDrivers, HKLM\SOFTWARE\WOW6432NODE\UpdateStar Drivers, Quarantined, [15028], [500057],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\UpdateStar Drivers, Quarantined, [14743], [500053],1.0.4328

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 5
PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAM FILES (X86)\UPDATESTAR DRIVERS, Quarantined, [14743], [500053],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\UPDATESTAR DRIVERS, Quarantined, [14743], [500054],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\Download, Quarantined, [14743], [500055],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\Backup, Quarantined, [14743], [500055],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\USERS\{username}\APPDATA\ROAMING\UPDATESTAR DRIVERS, Quarantined, [14743], [500055],1.0.4328

File: 14
PUP.Optional.UpdateStarDrivers.TskLnk, C:\WINDOWS\SYSTEM32\TASKS\drivers, Quarantined, [14743], [500052],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAM FILES (X86)\UPDATESTAR DRIVERS\DRIVERS.EXE, Quarantined, [14743], [500052],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\WINDOWS\SYSTEM32\TASKS\drivers, Quarantined, [14743], [-1],0.0.0
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Program Files (x86)\UpdateStar Drivers\drivers.chm, Quarantined, [14743], [500053],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Program Files (x86)\UpdateStar Drivers\Resource.dll, Quarantined, [14743], [500053],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Program Files (x86)\UpdateStar Drivers\uninstall.exe, Quarantined, [14743], [500053],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateStar Drivers\Uninstall.lnk, Quarantined, [14743], [500054],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateStar Drivers\UpdateStar Drivers.lnk, Quarantined, [14743], [500054],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\config.bin, Quarantined, [14743], [500055],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\config.ini, Quarantined, [14743], [500055],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\license.ini, Quarantined, [14743], [500055],1.0.4328
PUP.Optional.InstallCore, C:\USERS\{username}\DESKTOP\UPDATESTAR-DRIVERS_VLYCOY.EXE, Quarantined, [2], [495199],1.0.4328
PUP.Optional.UpdateStarDrivers, C:\PROGRAM FILES\UPDATESTARDRIVERS.EXE, Quarantined, [15028], [500059],1.0.4328
PUP.Optional.InstallCore, C:\USERS\{username}\DOWNLOADS\UPDATESTAR-DRIVERS_VLYCOY.EXE, Quarantined, [2], [495199],1.0.4328

Physical Sector: 0
(No malicious items detected)


(end)

As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):

  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention

Save yourself the hassle and get protected.

Edited by Metallica

Share this post


Link to post
Share on other sites
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.