C:\Windows\System32\wuauservx\wuauservx.exe - False Positve or not?

Ghot · Jun 17, 2024

Almighty1 said:
Just did that, this is what it says:

Looks like false positives to me. Only no name AV's flagged it.

If it worries you... make a fresh backup, then delete it (file and folder), and reboot. See if Windows gets upset.

man00 · Jun 17, 2024

I don't have the file, or least the search didn't find it

Almighty1 · Jun 17, 2024

Ghot said:
Looks like false positives to me. Only no name AV's flagged it.

If it worries you... make a fresh backup, then delete it (file and folder), and reboot. See if Windows gets upset.

Probably easier to just rename the file. It is running though. Question, did they actually analyze my file in real time or is the stats from others who submitted it earlier? Too bad there is no way to confirm with Microsoft.

Rollback_Jockey · Jun 17, 2024

Almighty1 said:
Yesterday, Windows Defender shows this:
View attachment 99388

Does anyone else have this file?

Have you run any tweaks to try and stop Windows Update?

Almighty1 · Jun 17, 2024

Rollback_Jockey said:
Have you run any tweaks to try and stop Windows Update?

No, was busy trying to update Intel various drivers yesterday. Too bad it's hard to figure out where the file came from.

pseymour · Jun 17, 2024

Almighty1 said:
You are right it could be something new as both the folder and file appears to be created 23 hours ago. How do I find the signing cert?

The executable file isn't signed. If it was, there would be a Digital Signatures tab on the Properties page. That tab is missing in your screenshot.

It's also odd to me that that executable tries to create a Windows service to run itself persistently, according to VirusTotal.

Code:

C:\Windows\SysWOW64\sc.exe sc create TOiLP binpath= "C:\Users\user\Desktop\wuauservx.exe"
C:\Windows\SysWOW64\sc.exe sc start TOiLP

Almighty1 · Jun 17, 2024

pseymour said:
The executable file isn't signed. If it was, there would be a Digital Signatures tab on the Properties page. That tab is missing in your screenshot.

It's also odd to me that that executable tries to create a Windows service to run itself persistently, according to VirusTotal.

Code:

C:\Windows\SysWOW64\sc.exe sc create TOiLP binpath= "C:\Users\user\Desktop\wuauservx.exe" C:\Windows\SysWOW64\sc.exe sc start TOiLP

Thanks to you and everyone, what's even more odd is when the services is highlighted, there is no Stop the service or Restart the service showing on the left above Description like a real service does.... So I stopped it manually in System Informer (formerly Process Hacker):

Changed the startup type to Disabled from Autostart and renamed the file to wuauservx.exe.orig.

Ghot · Jun 17, 2024

Almighty1 said:
Question, did they actually analyze my file in real time or is the stats from others who submitted it earlier?

If they didn't analyze in real time... just rename the file. Like remove the X at the end.
Or ZIP the file.

When they scan in real time... you can tell. You'll see the results come up... slowly, one by one.

Ghot · Jun 17, 2024

Almighty1 said:
Probably easier to just rename the file.

Renaming a file stops Windows using it, if it's a "legit" file.

I would think that a decent hacker would assume that someone would rename a file, and takes steps to prevent that from making a difference?

By the same token... renaming a file does make Virustotal scan it in real time.
Like I said above... you'll notice when VT scans in real time.

On a side note... I've been wondering why some people have the folder/file, and some don't.

Maybe try changing this Setting...

Windows Update > Advanced Options > Delivery Optimization...

I've had mine set to OFF for a long, long time, and I don't have that folder/file? Just a guess.

I also have this turned OFF...

I just don't like the "idea" of either of these settings.

Almighty1 · Jun 18, 2024

Ghot said:
If they didn't analyze in real time... just rename the file. Like remove the X at the end.
Or ZIP the file.

When they scan in real time... you can tell. You'll see the results come up... slowly, one by one.

I renamed the file to wuauservx.exe.orig and it was still real time and took only 2 seconds.

Ghot · Jun 18, 2024

Almighty1 said:
I renamed the file to wuauservx.exe.orig and it was still real time and took only 2 seconds.

Try putting it in a ZIP file (or 7zip) and maybe put a text file in there with it.
Anything that will change the HASH.

Or maybe rename it to... wuauservx.ex

Almighty1 · Jun 18, 2024

Ghot said:
Renaming a file stops Windows using it, if it's a "legit" file.

I would think that a decent hacker would assume that someone would rename a file, and takes steps to prevent that from making a difference?

By the same token... renaming a file does make Virustotal scan it in real time.
Like I said above... you'll notice when VT scans in real time.

On a side note... I've been wondering why some people have the folder/file, and some don't.

Maybe try changing this Setting...

Windows Update > Advanced Options > Delivery Optimization...

View attachment 99419

I've had mine set to OFF for a long, long time, and I don't have that folder/file? Just a guess.

I also have this turned OFF...

View attachment 99423

I just don't like the "idea" of either of these settings.

The top one is already off since Windows 10 and the bottom one is on... but I think the real clue is no digital signed certificate wouldn't make sense if it's really from Microsoft.

Almighty1 · Jun 18, 2024

Ghot said:
Try putting it in a ZIP file (or 7zip) and maybe put a text file in there with it.
Anything that will change the HASH.

Or maybe rename it to... wuauservx.ex

I think it's based on the MD5 of the file as you can tell from the history part since the First Submission and Last Submission are different dates if I renamed the file as wuau4serv.exe.orig but when I upload it as a zip file, it has a completely different history and this one is scanned in real-time.

Ghot · Jun 18, 2024

Then just look at the one that flagged the file.
If it's only some hole-in-the-wall AV... then it's probably a false positive.

Almighty1 · Jun 18, 2024

Ghot said:
View attachment 99431

Then just look at the one that flagged the file.
If it's only some hole-in-the-wall AV... then it's probably a false positive.

LOL, how do people submit things to Windows Defender to whitelist as I don't even see Microsoft on that list.

Ghot · Jun 18, 2024

Almighty1 said:
LOL, how do people submit things to Windows Defender to whitelist as I don't even see Microsoft on that list.

I dunno why MS isn't on the list. Economic reasons maybe? LOL

Almighty1 · Jun 18, 2024

Ghot said:
I dunno why MS isn't on the list. Economic reasons maybe? LOL

Maybe they only are friends with people who are competitors of Microsoft? LOL

Ghot · Jun 18, 2024

Almighty1 said:
Maybe they only are friends with people who are competitors of Microsoft? LOL

Or visa versa. ^^

Maybe MS doesn't want to be on a list with all those competitors.

I think I'm going to bed. It's 2:30 am.

andrew129260 · Jun 18, 2024

Almighty1 said:
Probably easier to just rename the file. It is running though. Question, did they actually analyze my file in real time or is the stats from others who submitted it earlier? Too bad there is no way to confirm with Microsoft.

View attachment 99399

this is random, but how did you get that cool properties box?

I also agree with @pseymour.

I think this file is very suspicious and is most likely malicious. You can have someone at malwarebytes or bleeping computer take a look at it as well.

Also, people can submit files manually to windows defender to analyze here:

Submit a file for malware analysis - Microsoft Security Intelligence

Submit suspected malware or incorrectly detected files for analysis. Submitted files will be added to or removed from antimalware definitions based on the analysis results.

www.microsoft.com

Almighty1 · Jun 18, 2024

andrew129260 said:
this is random, but how did you get that cool properties box?

I also agree with @pseymour.

I think this file is very suspicious and is most likely malicious. You can have someone at malwarebytes or bleeping computer take a look at it as well.

Also, people can submit files manually to windows defender to analyze here:

Submit a file for malware analysis - Microsoft Security Intelligence

Submit suspected malware or incorrectly detected files for analysis. Submitted files will be added to or removed from antimalware definitions based on the analysis results.

www.microsoft.com

System Informer formerly known as Process Hacker.

System Informer

System Informer, A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.

systeminformer.sourceforge.io

Downloadable here:

Releases · winsiderss/si-builds

Contribute to winsiderss/si-builds development by creating an account on GitHub.

github.com

Thanks for the links....

C:\Windows\System32\wuauservx\wuauservx.exe - False Positve or not?

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Windows developer and admіn

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Similar threads