What is UpdateStar Drivers?
The Malwarebytes research team has determined that UpdateStar Drivers is a "driver updater". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.
This one also offered to install several other programs during the install process.
How do I know if I am infected with UpdateStar Drivers?
This is how the main screen of the system optimizer looks:
You will find these icons in your taskbar, your startmenu, and on your desktop:
and see these warnings during install:
and this screens when you decide to fix the "problems":
You may see this entry in your list of installed programs:
and this task in your list of Scheduled Tasks:
How did UpdateStar Drivers get on my computer?
These so-called system optimizers use different methods of getting installed. This particular one was installed by a bundler:
How do I remove UpdateStar Drivers?
Our program Malwarebytes can detect and remove this potentially unwanted application.
- Please download Malwarebytes to your desktop.
- Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
- Then click Finish.
- Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
- If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
- When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
- Restart your computer when prompted to do so.
- No, Malwarebytes removes UpdateStar Drivers completely.
- The shortcut called UpdateStar Drivers on the desktop can be deleted if it belonged to the rogue.
We hope our application and this guide have helped you eradicate this system optimizer.
As you can see below the full version of Malwarebytes would have protected you against the UpdateStar Drivers installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.
and we block access to their domain:
Technical details for experts
You may see these entries in FRST logs:
() C:\Program Files (x86)\UpdateStar Drivers\drivers.exe C:\Users\Public\Desktop\UpdateStar Drivers.lnk C:\Users\{username}\AppData\Roaming\UpdateStar Drivers C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateStar Drivers C:\Program Files (x86)\UpdateStar Drivers C:\Program Files\updatestardrivers.exe UpdateStar Drivers (HKLM-x32\...\UpdateStar Drivers) (Version: 10.0.0 - UpdateStar) Task: {634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2} - System32\Tasks\drivers => C:\Program Files (x86)\UpdateStar Drivers\drivers.exe [2018-02-22] () () C:\Program Files (x86)\UpdateStar Drivers\Resource.dllAlterations made by the installer:
File system details [View: All details] (Selection) --------------------------------------------------- In the existing folder C:\Program Files Adds the file updatestardrivers.exe"="3/13/2018 1:01 PM, 140136 bytes, A Adds the folder C:\Program Files (x86)\UpdateStar Drivers Adds the file drivers.chm"="3/13/2018 1:02 PM, 327389 bytes, A Adds the file drivers.exe"="2/22/2018 1:16 PM, 9447104 bytes, A Adds the file Resource.dll"="3/13/2018 1:02 PM, 4020416 bytes, A Adds the file uninstall.exe"="3/13/2018 1:02 PM, 196816 bytes, A Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateStar Drivers Adds the file Uninstall.lnk"="3/13/2018 1:02 PM, 1100 bytes, A Adds the file UpdateStar Drivers.lnk"="3/13/2018 1:02 PM, 1088 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\UpdateStar Drivers Adds the file config.bin"="3/13/2018 1:03 PM, 11303 bytes, A Adds the file config.ini"="3/13/2018 1:03 PM, 386 bytes, A Adds the file license.ini"="11/30/2011 9:00 PM, 3120 bytes, A Adds the folder C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\Backup Adds the folder C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\Download In the existing folder C:\Users\Public\Desktop Adds the file UpdateStar Drivers.lnk"="3/13/2018 1:02 PM, 1070 bytes, A In the existing folder C:\Windows\System32\Tasks Adds the file drivers"="3/13/2018 1:02 PM, 3324 bytes, A Registry details [View: All details] (Selection) ------------------------------------------------ [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\UpdateStar Drivers] "DisplayIcon"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers\drivers.exe,0" "DisplayName"="REG_SZ", "UpdateStar Drivers" "DisplayVersion"="REG_SZ", "10.0.0" "EstimatedSize"="REG_DWORD", 13663 "InstallLocation"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers" "NoModify"="REG_DWORD", 1 "NoRepair"="REG_DWORD", 1 "Publisher"="REG_SZ", "UpdateStar" "UninstallString"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers\uninstall.exe" "VersionMajor"="REG_DWORD", 10 "VersionMinor"="REG_DWORD", 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\UpdateStar Drivers] "(Default)"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers" [HKEY_CURRENT_USER\Software\undefined] "updatestardrivers.exe"="REG_SZ", "1520942465761,http://static.updatestar.net/dl/updatestar/drivers/updatestardrivers.exe" [HKEY_CURRENT_USER\Software\UpdateStar Drivers] "(Default)"="REG_SZ", "C:\Program Files (x86)\UpdateStar Drivers" "InstallerLanguage"="REG_SZ", "1033" [HKEY_CURRENT_USER\Software\UpdateStar Drivers\Settings\UpdateStar Drivers\Recent File List] [HKEY_CURRENT_USER\Software\UpdateStar Drivers\Settings\UpdateStar Drivers\Settings\ControlBars-Summary]Malwarebytes log:
Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 3/13/18 Scan Time: 1:13 PM Log File: f2b5621f-26b7-11e8-80c4-080027235d76.json Administrator: Yes -Software Information- Version: 3.3.1.2183 Components Version: 1.0.262 Update Package Version: 1.0.4328 License: Premium -System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username} -Scan Summary- Scan Type: Threat Scan Result: Completed Objects Scanned: 243673 Threats Detected: 32 Threats Quarantined: 32 Time Elapsed: 3 min, 9 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 1 PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAM FILES (X86)\UPDATESTAR DRIVERS\DRIVERS.EXE, Quarantined, [14743], [500052],1.0.4328 Module: 2 PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAM FILES (X86)\UPDATESTAR DRIVERS\DRIVERS.EXE, Quarantined, [14743], [500052],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\Program Files (x86)\UpdateStar Drivers\Resource.dll, Quarantined, [14743], [500053],1.0.4328 Registry Key: 10 PUP.Optional.UpdateStarDrivers.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\drivers, Quarantined, [14743], [500052],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2}, Quarantined, [14743], [500052],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2}, Quarantined, [14743], [500052],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\drivers, Quarantined, [14743], [-1],0.0.0 PUP.Optional.UpdateStarDrivers.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2}, Quarantined, [14743], [-1],0.0.0 PUP.Optional.UpdateStarDrivers.TskLnk, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{634C94FD-E3F4-4CF0-AF42-36B0CE45EAA2}, Quarantined, [14743], [-1],0.0.0 PUP.Optional.UpdateStarDrivers, HKCU\SOFTWARE\UpdateStar Drivers, Quarantined, [15028], [500058],1.0.4328 PUP.Optional.UpdateStarDrivers, HKLM\SOFTWARE\WOW6432NODE\UpdateStar Drivers, Quarantined, [15028], [500057],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\UpdateStar Drivers, Quarantined, [14743], [500053],1.0.4328 Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 5 PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAM FILES (X86)\UPDATESTAR DRIVERS, Quarantined, [14743], [500053],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\UPDATESTAR DRIVERS, Quarantined, [14743], [500054],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\Download, Quarantined, [14743], [500055],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\Backup, Quarantined, [14743], [500055],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\USERS\{username}\APPDATA\ROAMING\UPDATESTAR DRIVERS, Quarantined, [14743], [500055],1.0.4328 File: 14 PUP.Optional.UpdateStarDrivers.TskLnk, C:\WINDOWS\SYSTEM32\TASKS\drivers, Quarantined, [14743], [500052],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\PROGRAM FILES (X86)\UPDATESTAR DRIVERS\DRIVERS.EXE, Quarantined, [14743], [500052],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\WINDOWS\SYSTEM32\TASKS\drivers, Quarantined, [14743], [-1],0.0.0 PUP.Optional.UpdateStarDrivers.TskLnk, C:\Program Files (x86)\UpdateStar Drivers\drivers.chm, Quarantined, [14743], [500053],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\Program Files (x86)\UpdateStar Drivers\Resource.dll, Quarantined, [14743], [500053],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\Program Files (x86)\UpdateStar Drivers\uninstall.exe, Quarantined, [14743], [500053],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateStar Drivers\Uninstall.lnk, Quarantined, [14743], [500054],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UpdateStar Drivers\UpdateStar Drivers.lnk, Quarantined, [14743], [500054],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\config.bin, Quarantined, [14743], [500055],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\config.ini, Quarantined, [14743], [500055],1.0.4328 PUP.Optional.UpdateStarDrivers.TskLnk, C:\Users\{username}\AppData\Roaming\UpdateStar Drivers\license.ini, Quarantined, [14743], [500055],1.0.4328 PUP.Optional.InstallCore, C:\USERS\{username}\DESKTOP\UPDATESTAR-DRIVERS_VLYCOY.EXE, Quarantined, [2], [495199],1.0.4328 PUP.Optional.UpdateStarDrivers, C:\PROGRAM FILES\UPDATESTARDRIVERS.EXE, Quarantined, [15028], [500059],1.0.4328 PUP.Optional.InstallCore, C:\USERS\{username}\DOWNLOADS\UPDATESTAR-DRIVERS_VLYCOY.EXE, Quarantined, [2], [495199],1.0.4328 Physical Sector: 0 (No malicious items detected) (end)As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention