officeupdate.exe - Dangerous
%windir%\web\officeupdate.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
%WinDir%\Web\OfficeUpdate.exe is W32.Linkfars.
W32.Linkfars is a worm that spreads by copying itself to removable drives, file-sharing application folders, and shared folders by replacing existing .exe files. It may also create .html files that display a message in Persian.
Related files:
%Temp%\svchost.exe
%ProgramFiles%\Common Files\Microsoft Shared\MSshare.exe
%ProgramFiles%\Sound Utility\Soundmax.exe
%Windir%\Web\OfficeUpdate.exe
%ProgramFiles%\XPCode\SexGame.exe
%ProgramFiles%\XPCode\SexScreenSaver.scr
%ProgramFiles%\XPCode\SexGameList.pif
Kill the process %WinDir%\Web\OfficeUpdate.exe and remove %WinDir%\Web\OfficeUpdate.exe from Windows startup.