hpwuSchd2.exe

hp digital imaging - hp all-in-one series

Hewlett-Packard Co.

The executable hpwuSchd2.exe, “Hewlett-Packard Product Assistant” has been detected as malware by 14 anti-virus scanners. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘HP Software Update’. Accoriding to the detections, it is a variant of Zbot (Zeus), a trojan that attempts to steal confidential information (online credentials, and banking details) from a compromised computer and send it to online criminals via a command-and-control server.
Publisher:
Hewlett-Packard Co.

Product:
hp digital imaging - hp all-in-one series

Description:
Hewlett-Packard Product Assistant

Version:
53.0.13.000

MD5:
2f0f92f4b32da348a292bdd1993a45d6

SHA-1:
8dae7a4d15b1c0b227ff3d1c5554f9c33b663329

SHA-256:
ee045abee593d1cce00435d6e5a03c0a2e32f7d757b9490d9734b76632368780

Scanner detections:
14 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
5/7/2024 3:38:07 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:RmnDrp
160118-1

AVG
Win32/Zbot.G
2015.0.4489

Boost by Reason
Optional.HewlettPackardCo.Startup
188838

Dr.Web
Win32.Rmnet.8
9.0.1.05190

Emsisoft Anti-Malware
Win32.Ramnit.N
10.0.0.5366

ESET NOD32
Win32/Ramnit.H virus
7.0.302.0

F-Prot
W32/Ramnit.E
4.6.5.141

F-Secure
Win32.Ramnit.N
5.15.21

Kaspersky
Virus.Win32.Nimnul
15.0.0.562

McAfee
Virus.W32/Ramnit.a
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.213.5329.0

Norman
Win32.Ramnit.N
03.12.2014 13:20:04

Sophos
Virus 'W32/Ramnit-A'
5.23

VIPRE Antivirus
Threat.4732184
46962

File size:
148.5 KB (152,069 bytes)

Product version:
053.000.013.000

Copyright:
Copyright (C) Hewlett-Packard Co. 1995-2004

Original file name:
hpwuSchd2.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\hp\hp software update\hpwuschd2.exe

File PE Metadata
Compilation timestamp:
5/12/2005 8:12:54 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:8R4//YHRSdoTO36mIUV0mQSoTWGZwJm3oO5zA07GZexKNfDxBcB5qNSXJvXaVSGG:8yYxSdoTOfvsVOy+exK9d1NSZINpCj

Entry address:
0xC000

Entry point:
60, E8, 00, 00, 00, 00, 5D, 8B, C5, 81, ED, CE, B2, 01, 20, 2B, 85, 35, BA, 01, 20, 89, 85, 31, BA, 01, 20, B0, 00, 86, 85, 66, BC, 01, 20, 3C, 01, 0F, 85, BC, 01, 00, 00, 83, BD, 61, BB, 01, 20, 00, 74, 33, 83, BD, 65, BB, 01, 20, 00, 74, 2A, 8B, 85, 31, BA, 01, 20, 2B, 85, 61, BB, 01, 20, 8B, 00, 89, 85, 9E, BB, 01, 20, 8B, 85, 31, BA, 01, 20, 2B, 85, 65, BB, 01, 20, 8B, 00, 89, 85, A2, BB, 01, 20, EB, 61, 83, BD, 69, BB, 01, 20, 00, 74, 58, 8B, 85, 31, BA, 01, 20, 2B, 85, 69, BB, 01, 20, FF, 30, 8D, 85...
 
[+]

Packer / compiler:
ASPack v1.08.04

Code size:
24 KB (24,576 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
HP Software Update

Command:
C:\Program Files\hp\hp software update\hpwuschd2.exe


Remove hpwuSchd2.exe - Powered by Reason Core Security