MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 12-06-07, 12:25
DTS DTS is offline
Private E-2
 
Join Date: Feb 2006
Posts: 19
Thanks: 0
Thanked 0 Times in 0 Posts
Default AU_.exe, is it malware?

Has anyone ever heard of a file called "AU_.exe"? If so, what is it's purpose?

The way I've found this file is through uninstalling a media codec called 3ivx. After uninstalling 3ivx a hidden folder is created under C:\Documents and Settings\*User*\Local Settings\Temp\~nsu.tmp which contains the AU_.exe file.

There is also an apparently related file in C:\Windows\Prefetch called "AU_.EXE" which has some random numbers and letters after it's name and ends in the usual prefetch file exetension of ".pf".

I've heard that this file may be part of the SpyFalcon trojan but the version I've found appears to be a simple temp file that is created after uninstalling 3ivx. It is also deteled after restarting the PC and that's when CCleaner identifies it as a missing MUI reference. I've also heard that it may be part of Nullsoft Uninstallers. Please let me know what you guys think it is.

Thanks
Reply With Quote
Sponsored links
  #2  
Old 12-06-07, 15:49
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,442
Thanks: 62
Thanked 7,688 Times in 4,147 Posts
Default Re: AU_.exe, is it malware?

Yes as far as I know it is part of Nullsoft Install System (NSIS). As long as it is cleaning up after itself upon your next reboot, it should not be an issue. Also you are only noticing it after doing the uninstall of 3ivx which again supports the relationship to NSIS.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
  #3  
Old 12-06-07, 16:10
DTS DTS is offline
Private E-2
 
Join Date: Feb 2006
Posts: 19
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: AU_.exe, is it malware?

Quote:
Originally Posted by chaslang View Post
Yes as far as I know it is part of Nullsoft Install System (NSIS). As long as it is cleaning up after itself upon your next reboot, it should not be an issue. Also you are only noticing it after doing the uninstall of 3ivx which again supports the relationship to NSIS.
Thanks for the reply, Chaslang. I'm fairly confident that it's a benign file that's related to NSIS.

When SpyFalcon (or related viruses using AU_.exe as a cover) infects a system doesn't AU_.exe usually show up in Task Manager as an executable that is initiated at startup and runs continuously? Also, do any of the SpyFalcon or other AU_.exe viruses implant files in the Windows Prefetch or Documents and Settings folders?

Last edited by DTS; 12-06-07 at 16:40..
Reply With Quote
  #4  
Old 12-07-07, 00:22
chaslang's Avatar
chaslang chaslang is offline
MajorGeeks Admin - Master Malware Expert
 
Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 80,442
Thanks: 62
Thanked 7,688 Times in 4,147 Posts
Default Re: AU_.exe, is it malware?

This file is not really a SpyFalcon issue. It is from an installer which could be used to install good valid software or any malware program if the creator of the malware used NSIS as their installer. Any processs that executes could be in the Prefetch folder for a period of time. It still does not mean it is malware. So as stated, the AU_.exe file is not really what the the SpyFalcon infection was related to. It may have possibly been an installer they used but I don't remember ever seeing it and it would have been a non-issue anyway.
__________________
"There are 10 types of people in this world. Those who understand binary and those who don't."


Support Majorgeeks on Facebook:

Majorgeeks Newsletter
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
ran all the steps in "Read & Run Me First malware removal guide," still have malware aarond95 Malware Removal 10 10-24-07 23:40
Malware, please help techgirl24 Malware Removal 1 08-02-07 10:52
Need help with malware palehades Malware Removal 17 04-28-07 19:40
malware help mjydrafter Malware Removal 7 03-06-07 10:15
Vx2 malware help bhulk Malware Removal 21 07-09-05 23:33


All times are GMT -5. The time now is 03:29.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger