New
#1
Windows 7 wierd Micosoft update valid
I have Windows 7 32bit. I have Windows Update set to notify only. I have great AV real protection software running but something wierd just happened.
I was on Ebay using Firefox and suddenly the browser froze and message that a script was trying to run click yes or no. I click no as I have NoScript installed along with host of other protective browser software. Then my computer started cranking away and in process explorer Trusted Installer was active. It was installing something to my hard drive.
I found out that what ever it was wrote to Licenses C:\program data; state data C:\ProgramData\Microsoft\RAC; and to RacMetaData.dat. RacWmiDatabase, RacWmiDataBookmarks.dat
2013/08/03 12:48:50 -0700 MESSAGE Starting database refresh
2013/08/03 12:48:50 -0700 MESSAGE Stopping IP protection
2013/08/03 12:48:51 -0700 MESSAGE IP Protection stopped successfully
2013/08/03 12:49:08 -0700 MESSAGE Database refreshed successfully
2013/08/03 12:49:08 -0700 MESSAGE Starting IP protection
2013/08/03 12:49:11 -0700 MESSAGE IP Protection started successfully
What was so annoying is that my desktop is on ethernet. It then went out to my router via wireless and installed software on there as well and shutdown my laptop.
It pisses me off as it didn't give me a choice and UAC is set at the highest level ALWAYS notify when installing software. I assume that would key off of TrustedInstaller
The same thing happened when Microsoft installed 9 api-ms-win-downlevel-*dll's without my permission. Even WinPatol didn't alert.
Now with all this stuff about MS and the NSA, I am spooked what is in this database and are they collecting information? What made them look at other devices networked to my router and pushed it out to other devices as well?
I thought I activated some malicious script in my browser because this sequence occurred at the same time as the non-responsive script error message. Running Malwarebytes and Avira came up with no detections.
Any ideas or suggestions?