Skip to main content
Participant
June 5, 2012
Question

Flash Player Update Virus?

  • June 5, 2012
  • 1 reply
  • 57753 views

My apologies if this has been discussed before, but I could not find an exact match.

Not exactly sure how it happened, but my "FlashPlayerUpdateService"  was installed in  Windows/System32/Macomed/Flash folder and harbored a nasty virus that put files in prefetch and executables (Oie7ij01.exe) in the scheduled tasks list that kept respawning, also put entries in the Registy "Run" key and effectively shut down my computer. Took me a day to find the root cause and have not seen this mentioned on any virus sites.

I figured out it was respawning every hour, so I took a look at the scheduled tasks. Once I paused them, the spawning stopped. I disabled the Flash Player Update and restarted the other scheduled tasks and all seemed OK all day. Still thought there were other remenants around, so I decided it was time for my "once very 2 years" rebuild.

Below is a picture of the Flash directory before I wiped the machine. The files with an ".eee" extension were originally .exe executables. The 3 files with a similar name look suspicious. I still have this directory saved to an off-line drive if someone wants to take a close look.

Thanks!

This topic has been closed for replies.

1 reply

pwillener
Legend
June 6, 2012

This topic explains the automated background update mechanism http://forums.adobe.com/thread/981567

However, I have no idea what "Oie7ij01.exe" is; that is not part of Flash Player or the updater.

alanintxAuthor
Participant
June 6, 2012

I understand the automated mechanism when it works properly. I have been using Adobe products for years and they are generally designed superbly.

However, something affected its operation so that whenever it ran, it created an entry in the Windows prefetch folder titled "OEI7IJ01.EXE-02DFE2EF.pf" and also created multiple entries in the scheduled task list to run an 82KB process named "Oei7ij01.exe. Everytime I cleared out the processes they would show up an hour later. When I paused (and eventually disabled) the Flash Player Updater the creation and execution of this process stopped.

pwillener
Legend
June 6, 2012

Thank you for the additional information.  Hopefully someone from the Adobe Flash Player team will have a look at this during US daytime.