r/ASUS•
Fourbits

ASUS Live Update downloading a virus?

Support

I just noticed that, starting 10 hours ago, my Zephyrus G14 has repeatedly attempted to download a zip file that Windows Security detects as containing "Trojan:Script/Wacatac.b!ml" -- and it appears to have been downloaded by ASUS Live Update, given that it was saved to "C:\Program Files (x86)\ASUS\Update\Download\..." It has already tried to download the file at least 16 times.

Is it similar to this attack on ASUS Live Update from three years ago? What should I do at this point? Has anyone else been affected?

|EDIT| I forgot to upload a screenshot of my Windows Security protection history. All of the reports pertain to the same virus:

​

https://preview.redd.it/shtvjrznssj81.png?width=1236&format=png&auto=webp&s=e52ecebdaeb8610dbeb412e23a93641ff9f34ad6

Posted Feb 24, 2022, 3:15 PM UTC

12
Disdaine82•

Getting similar notifications from Armoury Crate and its DenoiseAI app update. Different Trojan detected though.

1
Weaponguyver0•

Got one as well. Tho a different name

“Detected: Trojan:Win32/AgentTesla!ml Status: Removed A threat or app was removed from this device. Date: 2/24/2022 7:58 PM Details: This program is dangerous and executes commands from an attacker. Affected items: file: C: \Program Files (x86)VASUS \Update\Download MAB5F014E-883D-470D BC2D-127EF91E56111\5.0.0.9\10839- 0Q1F9U- fff39f77595442733cc8f12e70c5348e.zi” Was what my WD found and removed

1