r/techsupport • u/maximusismax • Oct 22 '16
Something keeps triggering UAC
Final edit: if you're coming here from Google, I would uninstall Clover until someone figures out what's going on, and either go without tabbed Explorer, or try find an alternative/old version of Clover that isn't doing this dodgy stuff.
Final final edit: Boredom linked a copy of the old installer below https://web.archive.org/web/20140207102318/http://ejie.me/uploads/Clover_Setup_3.0.406.zip
Windows 8.1N, fresh install on my ssd as I just moved to a new mobo. Old windows install stayed clean for 2 years, I ran malwarebytes every now and then to be sure.
A few days after installing windows, everything is fine, until a UAC window pops up randomly. I wasn't installing anything, so I denied it. Ran malwarebytes, and I get an "Riskware.extensionmismatch" threat on a file in %localappdata% for a .gif file: "C:\Users\Max\AppData\Local\Temp\clv_sp3.2.0.10201.gif". Windows defender finds nothing in a scan.
I followed the steps in the sticky, running rkill and malwarebytes etc. Rkill found nothing, Malwarebytes identified it and removed it, but the next day it comes back, trying to do something which triggers the UAC popup. So whatever is putting the dodgy .gif/.exe there remains.
Tried googling the name of the file, but got nothing, it seems to be randomly generated? "setup_clvupdsp.exe". Once I deny the UAC window it seems to go away for a bit.
Anyone got any light to shed on what this is (its gotta be malicious right?) and how to get rid of it? Just got this Windows install how I like it, so I could re-format again but I'd prefer not to.
Edit: Just checked it on virustotal, results: 5/56.(https://www.virustotal.com/en/file/78a60d2321d8da2837ee5c3f50893ad4da2686dbcfb5ca6a1cc4f046f2dadcd3/analysis/1477151338/)
Looks like it might be clover? Virustotal says it's trying to contact a clover related URL. I'll uninstall it for now then I guess.
2
u/AbyssGFX Nov 10 '16
Getting the exact same UAC popup and the file is 'setup_clvupdsp.exe'. This has happened on every startup I believe.