Kudos0

Is ASUSFourceUpdater (32 bit) a virus?

Posted: 14-Jun-2018 | 10:59AM · 8 Replies ·

Something popped up that looks suspicious. I checked with ASUS and they say it's not one of their programs. In TaskManager, it's listed as ASUSFourceUpdater (32 bit) and it's not a program I have installed anywhere on my computer. According to support at ASUS it's definitely not one of their programs, but there was a clear attempt by someone to make it LOOK like ASUS has a "critical update" for me. Virus scans by Norton didn't pick up anything on my computer and as I mentioned, it's not installed and I could "end task" without issue. I haven't really downloaded anything to my knowledge of late except for updates to games that already exist on my computer and those updates came from the game developers through their software, not a new download from a site. I'm pretty careful even with security updates, which is how I caught this, but I haven't seen anything on the internet about it at all really and in addition, Norton Security hasn't indicated any problems, even with a full scan. I'm trying not to panic about this, but I'm wondering how a program could attempt to run and install on my computer without triggering something with my up to date Norton product. If I caught it and did not allow it to run, am I safe or what should I be doing now?

Labels: Windows 10, Threat Detection

Replies

Kudos0

Re: Is ASUSFourceUpdater (32 bit) a virus?

Posted: 14-Jun-2018 | 11:10AM · Edited: 14-Jun-2018 | 11:16AM · Permalink

FWIW ~ google: "ASUSFourceUpdater + virus" = Freefixer.com » What is ASUSUpdateChecker.exe?

ASUSUpdateChecker.exe's description is "ASUSFourceUpdater"

ASUSUpdateChecker.exe is digitally signed by ASUSTeK Computer Inc..

ASUSUpdateChecker.exe is usually located in the 'C:\Program Files (x86)\ASUS\ASUS Manager\Application Update\' folder.

Kudos0

Re: Is ASUSFourceUpdater (32 bit) a virus?

Posted: 14-Jun-2018 | 8:42PM · Permalink

I understand that, but I contacted ASUS via phone and relayed the exact information and "Anya" put me on hold, came back 5-10 minutes later and informed me that they're not aware of any such program, to check my apps and programs list to see if it was listed, delete it, then perform a complete factory reset. I informed her that there was no such program listed as installed. She said it was then my discretion whether to perform a factory reset or not.

Since it didn't come up as a virus and at least this "tech" I spoke to on the ASUS tech helpline says that it's not an ASUS program, I thought I'd try and see if any other ASUS users could report this problem or if it showed up on their virus scans.

Hence this post. I did perform a google search as well.

File Attachment: 
PDF icon ASUSorVirus.pdf
Kudos0

Re: Is ASUSFourceUpdater (32 bit) a virus?

Posted: 14-Jun-2018 | 8:52PM · Edited: 14-Jun-2018 | 9:51PM · Permalink

Okay.  Regardless of what ASUS via phone says.  Looks like you have something Asus / ASUS running.  

http://www.shouldiblockit.com/updatechecker.exe-28895.aspx

http://www.shouldiremoveit.com/ASUS-WebStorage-10541-program.aspx

http://www.shouldiremoveit.com/ASUS-Manager-Ai-Charger-II-109458-program.aspx

I'll follow with interest.  

Regards w Respect

Maybe, security checkup > https://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-assistance/ 

Kudos0

Re: Is ASUSFourceUpdater (32 bit) a virus?

Posted: 14-Jun-2018 | 9:54PM · Edited: 14-Jun-2018 | 10:10PM · Permalink

https://www.reddit.com/r/ASUS/comments/8qznaj/asusfourceupdaterexe_is_trying_to_do_some_mystery/

https://www.virustotal.com/#/file/5692f84338604f82f1222be248789a0211223fe0f51d0a8908fb1b7c70e01df0/detection

FWIW ~ YMMV

Kudos0

Re: Is ASUSFourceUpdater (32 bit) a virus?

Posted: 17-Jun-2018 | 11:04PM · Permalink

AI Charger is not the problem. I have an ASUS Command Update center that allows me to connect to ASUS and search for updates to several things, such as BIOS, drivers, etc. and nothing is scheduled through ASUS.

AI Charger is a legitimate program and not the cause of the popup. I've got Norton protection and have run it several times and it's actively protecting me against intrusions, but this is something unexpected and recently popped up. ASUS Device Activation is the latest thing I'm seeing while reading elsewhere and it looks like since my original post, others are posting elsewhere, like on reddit with the same kinds of questions. I was wondering why Norton hadn't picked it up. It looks like people are supposing that it's not triggering anything because there doesn't appear (at this point) to be any malicious code.

ASUS told me there is no update and I should be concerned. No virus scans are telling me I should be concerned. I'm just wondering why there is a discrepancy and hoping Norton folks had an idea, since it appears it's not just an isolated incident after all.

Kudos0

Re: Is ASUSFourceUpdater (32 bit) a virus?

Posted: 17-Jun-2018 | 11:08PM · Permalink

Thanks for checking into it.

That reddit post is extremely helpful and seems to have been created after my original post, so I feel a little better about asking here for help first to determine whether this should have been caught by my virus protection. At this point, there doesn't seem to be a correlation between what ASUS told me via the phone (and with a short and limited research time while I was on hold) and what people have been finding by...datamining (?) the .exe file or whatever.

I'd rather not install something or accept an update, but it appears that the reason Norton isn't catching it is because it is not (yet) found to have any code that triggers a malicious program warning. I'm going to hold off on it as long as I can until ASUS reverses it's course or someone discovers it is indeed some kind of code that's asleep. I don't know why ASUS wouldn't be aware of an ASUS Device Activation update that suddenly comes out, but I'm not entirely sure the tech I spoke with did enough digging. I'm playing it safe rather than sorry, but it doesn't look like Norton should have had any idea that it would be dangerous at this point.

bjm_:

https://www.reddit.com/r/ASUS/comments/8qznaj/asusfourceupdaterexe_is_trying_to_do_some_mystery/

https://www.virustotal.com/#/file/5692f84338604f82f1222be248789a0211223fe0f51d0a8908fb1b7c70e01df0/detection

FWIW ~ YMMV

Kudos0

Re: Is ASUSFourceUpdater (32 bit) a virus?

Posted: 18-Jun-2018 | 3:50AM · Edited: 18-Jun-2018 | 3:59AM · Permalink

...and you cannot locate on your machine what's showing in your task manager?

...IDK whether an internal update to an already running process would be felt by Norton. 

Perhaps, a security checkup > https://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-assistance/(link is external) or, ask for help at Bleeping. 

...and as you know the name of a file (ASUSFourceUpdater) is less important than it's hash signature (SHA-256).

Kudos2 Stats

Re: Is ASUSFourceUpdater (32 bit) a virus?

Posted: 20-Jun-2018 | 1:55PM · Edited: 20-Jun-2018 | 1:57PM · Permalink

AsusFourceUpdater is increasingly cropping up online as frustrating/irritating many, following a Win10 update, which I suspect reset a very specific item.  I finally sleuthed out that: (1) contrary to ASUS, it is indeed an Asus application usually found in the \Program Files (x86)\ASUS\ASUS Manager\Application Update folder; (2) it is triggered by a setting in Windows Task Scheduler. 

Here's how I eliminated the pesky thing irritating me every time I restarted...

Open Windows Task Scheduler (in Win10, search for "Scheduler" and the first option is Task Scheduler).  Run this.  In the left panel is the Task Scheduler Library, select the drop-down ASUS item.  Choose "ASUS Updater" from the list, then click "Disable" from the Actions panel on the right of the screen.  Check the Status column lists it as Disabled.  Close Task Scheduler and optionally, reboot to test it worked.  Tada, end of useless irritation … at least for me.  I'll never get back two hours wasted figuring this out.  Thank you ASUS.

[You can then confirm the .exe folder/path by selecting the Action tab which lists the executable's location.  For safety I later went to this folder and renamed the file "AsusFourceUpdater.exe.old".] 

Happy clicking.

This thread is closed from further comment. Please visit the forum to start a new thread.