What is "Oruwua.exe"?

stanley · 14 Jul 2011

Oruwua
SrMicroWO setup K
Sun Microsystems,Inc.

Hello
Does anyone know wtf is this?I Googled it and nothing came up.
I used the search in Oracle and in Sun Wiki and same.
It all started yesterday when i downloaded and installed
"Streaming Audio Recorder"from giveawayoftheday.
First it never worked right and second Internet Explorer started
to open up into some weird sites telling me to register and win an
Iphone.Then some other sites with similar stuff.
I uninstalled the programm and cleared I.E.cookies history....
I used Ccleaner too.It still flashed on.I must say i use Firefox,
and thats what i used to download the S.A.R.
So i open Process Explorer and left it open.Next time IE came up
i saw that this "Oruwua.exe"was on.Its location was in C:\Windows.
I Send it in the Recycle Bin and from that moment it didnt happen
again.I scaned it with MSE and Malwarebytes and it came clean.
Everything seems to be working ok so far.
Is it safe to delete it?its just Adware?
Any help will be apreciated.I attached a copy.

Thanks a lot.
Stathis.

I forgot to mension that i found a new entry at Starting Programms for this exe at Ccleaner,which i deleted and then i
found out that it was entered again,so i deleted it again and finally i moved the exe into the recycle bin

Geia.

niemiro · 14 Jul 2011

Hello!

Well, that uploaded sample was definitely malware: VirusTotal - Free Online Virus, Malware and URL Scanner

I will now ask for it to be removed, to prevent other users becoming infected, and ensure that a security expert comes your way :)

Richard

theog · 14 Jul 2011

I would Run this tool:
https://www.sevenforums.com/tutorials...per.html?ltr=M

stanley · 14 Jul 2011

Thank you Niemiro and Theog for your replies.I will run the tool.
As for the stupidity to upload a malisious file,I can only apologise
to the Forum admin as well as all of you.I hope i didnt couse an
infection to anybody.
Stathis.

niemiro · 14 Jul 2011

stanley said:

Thank you Niemiro and Theog for your replies.I will run the tool.
As for the stupidity to upload a malisious file,I can only apologise
to the Forum admin as well as all of you.I hope i didnt couse an
infection to anybody.
Stathis.

Don't worry about it! We all make mistakes, and it did tell us exactly what the infection was, which is why I downloaded a copy of the file (and still have a copy!) before it was deleted. I personally am not too fussed :)

theog · 14 Jul 2011

You are welcome.
We are here 24/7 to help.

stanley · 14 Jul 2011

MSE just warned me about this file in the recycle bin allthough i didnot update the definitions.I let it delet it and i still will run the tool.Virus Total bookmarked!
Thanks again.

Corrine · 15 Jul 2011

Hi, stanley.

Let us know how you make out after running the Standalone System Sweeper. Since TrojanDownloader:Win32/Renos.PT has also been downloaded as a result of rogues, it would be advisable to follow-up with a scan by Malwarebytes Anti-Malware or SUPER AntiSpyware.

After cleaning, make sure to install any missing Microsoft Security updates and update third-party software such as Adobe Reader, Adobe Flash Player and Java.

stanley · 17 Jul 2011

Hi Corrine.
I didn't run the test because it was suggested if there is a possible
infection,i should create the CD or USB flash or iso to another clean PC and then run it.Instead i recoverd from a small (19 gb)backup i had from the time i moved to FF4 and i did a clean install from an upgrade W7.So its recent with not a lot of updates and i prefered this instead of doing full scans.I keep my data to an external hard disk so I'm all fresh and clean now.
Thanks anyway for the interrest and your time.Your forum is great and i know that
whatever i need i'll find it there.
Geia soy.
Stathis.

Corrine · 17 Jul 2011

Thank you for getting back to us, Stanley. I'm glad you mentioned the updates so it wasn't necessary to remind you, just don't forget those third-party applications I mentioned previously.

Take care!