Giveaway of the Day Forums

1. 

   mikiem2
   Moderator

   bleepingcomputer[.]com/news/security/asus-driverhub-flaw-let-malicious-sites-run-commands-with-admin-rights/

   Asus is a popular brand making motherboards, laptops, monitors etc. They're also a sneaky PITA when it comes to software, since they like to sneak things into Windows without giving you any indication that they're doing so. In this case Asus DriverHub is an app that apparently runs as an auto-starting service to check for new drivers. If it finds newer drivers on an Asus site it will download and install them. Problem is, it's not picky enough about specifying *only* that particular site, so it can be tricked into downloading and installing something particularly nasty. Asus says they have a new version that's been fixed, but that requires checking for updates using the GUI, and the app itself doesn't appear to have one!

   Now, DriverHub itself is carried in the BIOS -- in the BIOS settings you set it to install in Windows automatically or not. Once it's installed there are no shortcuts anywhere, no GUI, no way for you to run the app, and no way for you to uninstall it. Windows Services will list an Asus Update service, which you can double click & in the drop down box select disable. That *may* be enough. If you want to actually remove the service use Regedit to delete the registry key: [HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ AsusUpdateCheck]

   The file AsusUpdateCheck.exe is located in Windows\ System32\, along with AsusDownloadAgent.exe & AsusDownLoadLicense.exe . I have not seen anything saying what either of those other two apps are for, but since I don't want to be running ANY Asus software I deleted those as well, *so far* without anything noticeable happening. There's another file: Program Files\ ASUS\ AsusDriverHubInstaller\ ASUS-DriverHub-Installer.exe . Universal Extractor shows that it contains: ADU.exe, ASUS DriverHub.exe, and scripts to add them to Task Scheduler. For me, with this Asus motherboard, turning the DriverHub on in the BIOS adds all those files, but does not seem to run the installer. My *guess* is that if/when the update check finds an update then it will likely install. Back in November when this board was new, the 1st time I fired up Windows there was a GUI of some sort for DriverHub, but I don't recall any specifics, and as I've written above, today there's no way to get it to show any window or anything. Needless to say there's no reason to keep that Asus folder either.

   Posted 1 month ago #
2. 

   gergn
   Member

   If you have Pro Lasso, there is a safer way to deleting a suspicious exe. You can instruct Pro Lasso to prevent the exe from running. Every time the exe starts, Pro Lasso will stop it.
   Using Pro Lasso this way, I found I could prevent Edge to run as browser, but I had to allow the Edge Updater.

   Posted 1 month ago #
3. 

   mikiem2
   Moderator

   Lasso is also probably the better solution since Asus tends to bury their DriverHub in the BIOS settings. Depending on the device's BIOS, those setting menus can be very complicated, so people might not be able to find the setting to stop the BIOS from auto-installing DriverHub. If you don't turn that off you can remove it as many times as you want and it will just reinstall. And with plenty of opportunities to break things, it's probably best if most people don't go into those BIOS settings to start with.

   Posted 1 month ago #

RSS feed for this topic

Reply

You must log in to post.