What is UpdateStar Drivers?
The Malwarebytes research team has determined that UpdateStar Drivers is a "driver updater". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.
This one also offered to install several other programs during the install process.
How do I know if I am infected with UpdateStar Drivers?
This is how the main screen of the system optimizer looks:
You will find these icons in your taskbar, your startmenu, and on your desktop:
and see these warnings during install:
and this screens when you decide to fix the "problems":
You may see this entry in your list of installed programs:
and this task in your list of Scheduled Tasks:
How did UpdateStar Drivers get on my computer?
These so-called system optimizers use different methods of getting installed. This particular one was installed by a bundler:
How do I remove UpdateStar Drivers?
Our program Malwarebytes can detect and remove this potentially unwanted application.
- Please download Malwarebytes to your desktop.
- Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
- Then click Finish.
- Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
- If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
- When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
- Restart your computer when prompted to do so.
- No, Malwarebytes removes UpdateStar Drivers completely.
- The shortcut called UpdateStar Drivers on the desktop can be deleted if it belonged to the rogue.
We hope our application and this guide have helped you eradicate this system optimizer.
As you can see below the full version of Malwarebytes would have protected you against the UpdateStar Drivers installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.
and we block access to their domain:
Technical details for experts
You may see these entries in FRST logs:
() C:\Program Files (x86)\UpdateStar Drivers\drivers.exe
C:\Users\Public\Desktop\UpdateStar Drivers.lnk
C:\Users\{username}\AppData\Roaming\UpdateStar Drivers
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateStar Drivers
C:\Program Files (x86)\UpdateStar Drivers
C:\Program Files\updatestardrivers.exe
UpdateStar Drivers (HKLM-x32\...\UpdateStar Drivers) (Version: 10.0.0 - UpdateStar)
Task: {634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2} - System32\Tasks\drivers => C:\Program Files (x86)\UpdateStar Drivers\drivers.exe [2018-02-22] ()
() C:\Program Files (x86)\UpdateStar Drivers\Resource.dll
Alterations made by the installer:File system details [View: All details] (Selection)
---------------------------------------------------
In the existing folder C:\Program Files
Adds the file updatestardrivers.exe"="3/13/2018 1:01 PM, 140136 bytes, A
Adds the folder C:\Program Files (x86)\UpdateStar Drivers
Adds the file drivers.chm"="3/13/2018 1:02 PM, 327389 bytes, A
Adds the file drivers.exe"="2/22/2018 1:16 PM, 9447104 bytes, A
Adds the file Resource.dll"="3/13/2018 1:02 PM, 4020416 bytes, A
Adds the file uninstall.exe"="3/13/2018 1:02 PM, 196816 bytes, A
Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateStar Drivers
Adds the file Uninstall.lnk"="3/13/2018 1:02 PM, 1100 bytes, A
Adds the file UpdateStar Drivers.lnk"="3/13/2018 1:02 PM, 1088 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\UpdateStar Drivers
Adds the file config.bin"="3/13/2018 1:03 PM, 11303 bytes, A
Adds the file config.ini"="3/13/2018 1:03 PM, 386 bytes, A
Adds the file license.ini"="11/30/2011 9:00 PM, 3120 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\Backup
Adds the folder C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\Download
In the existing folder C:\Users\Public\Desktop
Adds the file UpdateStar Drivers.lnk"="3/13/2018 1:02 PM, 1070 bytes, A
In the existing folder C:\Windows\System32\Tasks
Adds the file drivers"="3/13/2018 1:02 PM, 3324 bytes, A
Registry details [View: All details] (Selection)
------------------------------------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UpdateStar Drivers]
"DisplayIcon"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers\drivers.exe,0"
"DisplayName"="REG_SZ", "UpdateStar Drivers"
"DisplayVersion"="REG_SZ", "10.0.0"
"EstimatedSize"="REG_DWORD", 13663
"InstallLocation"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers"
"NoModify"="REG_DWORD", 1
"NoRepair"="REG_DWORD", 1
"Publisher"="REG_SZ", "UpdateStar"
"UninstallString"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers\uninstall.exe"
"VersionMajor"="REG_DWORD", 10
"VersionMinor"="REG_DWORD", 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\UpdateStar Drivers]
"(Default)"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers"
[HKEY_CURRENT_USER\Software\undefined]
"updatestardrivers.exe"="REG_SZ", "1520942465761,http://static.updatestar.net/dl/updatestar/drivers/updatestardrivers.exe"
[HKEY_CURRENT_USER\Software\UpdateStar Drivers]
"(Default)"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers"
"InstallerLanguage"="REG_SZ", "1033"
[HKEY_CURRENT_USER\Software\UpdateStar Drivers\Settings\UpdateStar Drivers\Recent File List]
[HKEY_CURRENT_USER\Software\UpdateStar Drivers\Settings\UpdateStar Drivers\Settings\ControlBars-Summary]
Malwarebytes log:Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 3/13/18
Scan Time: 1:13 PM
Log File: f2b5621f-26b7-11e8-80c4-080027235d76.json
Administrator: Yes
-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.4328
License: Premium
-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 243673
Threats Detected: 32
Threats Quarantined: 32
Time Elapsed: 3 min, 9 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
-Scan Details-
Process: 1
PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAM FILES (X86)\UPDATESTAR DRIVERS\DRIVERS.EXE, Quarantined, [14743], [500052],1.0.4328
Module: 2
PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAM FILES (X86)\UPDATESTAR DRIVERS\DRIVERS.EXE, Quarantined, [14743], [500052],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Program Files (x86)\UpdateStar Drivers\Resource.dll, Quarantined, [14743], [500053],1.0.4328
Registry Key: 10
PUP.Optional.UpdateStarDrivers.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\drivers, Quarantined, [14743], [500052],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2}, Quarantined, [14743], [500052],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2}, Quarantined, [14743], [500052],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\drivers, Quarantined, [14743], [-1],0.0.0
PUP.Optional.UpdateStarDrivers.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2}, Quarantined, [14743], [-1],0.0.0
PUP.Optional.UpdateStarDrivers.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2}, Quarantined, [14743], [-1],0.0.0
PUP.Optional.UpdateStarDrivers, HKCU\SOFTWARE\UpdateStar Drivers, Quarantined, [15028], [500058],1.0.4328
PUP.Optional.UpdateStarDrivers, HKLM\SOFTWARE\WOW6432NODE\UpdateStar Drivers, Quarantined, [15028], [500057],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\UpdateStar Drivers, Quarantined, [14743], [500053],1.0.4328
Registry Value: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 5
PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAM FILES (X86)\UPDATESTAR DRIVERS, Quarantined, [14743], [500053],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\UPDATESTAR DRIVERS, Quarantined, [14743], [500054],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\Download, Quarantined, [14743], [500055],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\Backup, Quarantined, [14743], [500055],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\USERS\{username}\APPDATA\ROAMING\UPDATESTAR DRIVERS, Quarantined, [14743], [500055],1.0.4328
File: 14
PUP.Optional.UpdateStarDrivers.TskLnk, C:\WINDOWS\SYSTEM32\TASKS\drivers, Quarantined, [14743], [500052],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAM FILES (X86)\UPDATESTAR DRIVERS\DRIVERS.EXE, Quarantined, [14743], [500052],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\WINDOWS\SYSTEM32\TASKS\drivers, Quarantined, [14743], [-1],0.0.0
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Program Files (x86)\UpdateStar Drivers\drivers.chm, Quarantined, [14743], [500053],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Program Files (x86)\UpdateStar Drivers\Resource.dll, Quarantined, [14743], [500053],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Program Files (x86)\UpdateStar Drivers\uninstall.exe, Quarantined, [14743], [500053],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateStar Drivers\Uninstall.lnk, Quarantined, [14743], [500054],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateStar Drivers\UpdateStar Drivers.lnk, Quarantined, [14743], [500054],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\config.bin, Quarantined, [14743], [500055],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\config.ini, Quarantined, [14743], [500055],1.0.4328
PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\license.ini, Quarantined, [14743], [500055],1.0.4328
PUP.Optional.InstallCore, C:\USERS\{username}\DESKTOP\UPDATESTAR-DRIVERS_VLYCOY.EXE, Quarantined, [2], [495199],1.0.4328
PUP.Optional.UpdateStarDrivers, C:\PROGRAM FILES\UPDATESTARDRIVERS.EXE, Quarantined, [15028], [500059],1.0.4328
PUP.Optional.InstallCore, C:\USERS\{username}\DOWNLOADS\UPDATESTAR-DRIVERS_VLYCOY.EXE, Quarantined, [2], [495199],1.0.4328
Physical Sector: 0
(No malicious items detected)
(end)As mentioned before the full version of Malwarebytes could have protected your computer against this threat.We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention
Back to top
Sign In
Create Account
