• 2 weird processes shown after uninstalling Firefox

    Home » Forums » AskWoody support » Questions: Browsers and desktop software » Other browsers » 2 weird processes shown after uninstalling Firefox

    Author
    Topic
    #2020766

    I uninstalled Firefox after taking it for a test-drive and found Un_A.exe and Un_B.exe in my Panda Dome(free) process monitor.

    From a quick google search I don’t think these are firefox related and may in fact be a virus.

    Does anyone have any idea what these processes really are?

     

    Viewing 3 reply threads
    Author
    Replies
    • #2020846

      The file pathways for these processes are:

      C:\Users\PC\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

      C:\Users\PC\AppData\Local\Temp\~nsuA.tmp\Un_B.exe

      I’ve blocked and quarantined both processes thru the Panda Dome Process Monitor and deleted the containing folder in AppData (which was empty, most likely because I blocked the processes).

      Both of these processes were marked as secure by Panda Dome, but they were also listed as unsigned.

      • This reply was modified 5 years, 5 months ago by Moonbear.
    • #2020853

      Upload them both to virustotal please: https://www.virustotal.com/gui/home/upload (you may need to remove them from quarantine to do this).

      When the scanning process is complete, copy/paste both the web page results URLs here for us to take a look at.

      1 user thanked author for this post.
      • #2020860

        I removed the processes from quarantine but the process monitor shows both of them as no longer on the system.

        There is a Lost & Found folder where Panda Dome sends recovered items but I can’t send them back to the Temp folder or upload from the Lost & Found folder.

        When I typed the first name into the text line on the open file window for virustotal and clicked I got this little pop message :

        Un_A.exe

        File not found

        Check the file name and try again

        The message was the same with Un_B.exe

         

        • This reply was modified 5 years, 5 months ago by Moonbear.
        • #2020882

          Let’s see if there’s anything dodgy, AdwCleaner and HitmanPro (trial version, uninstall it when you’re done cleaning up), run them both, AdwCleaner first and reboot if requested, then run HitmanPro – save logs/details and upload them if you have further queries/issues.

          1 user thanked author for this post.
          • #2021079

            Thanks for the links. Scans with both AdwCleaner and HitmanPro came back with zero threats detected.

            I also saved the scanlog for HitmanPro.

            • This reply was modified 5 years, 5 months ago by Moonbear.
            • #2021134

              Probably clean then, run the Malwarebytes trial just in case, post the log if it detects anything.

            • #2021166

              I tried to do just that last night with Malwarebytes 4.0, I gave up after the installer failed 4 times.

              • This reply was modified 5 years, 5 months ago by Moonbear.
    • #2021135

      In Panda, go to Process Monitor and view the detailed report. Sort the report by date in descending order. See if Un_A.exe and Un_B.exe were detected by Panda at the same date and time as when you uninstalled Firefox. If so, then most likely these files were created by the Firefox uninstaller.

      • #2021184

        With Panda Dome showing detected processes in descending order, this is what I see:

        Un_B.exe is listed above  uninstall.exe (C:Program Files(x86)Mozilla Maintenance Service\unistall.exe)

        Un_A.exe is listed above helper.exe (C:\Program Files\Mozilla Firefox\uninstall\helper.exe)

        All 4 processes were detected at 14:47PM (which is 2:47 PM where I am) I really wish Panda Dome had seconds in the time stamps for situations like this.

        None of these processes connected to the internet.

    • #2021153

      The file pathways for these processes are:

      C:\Users\PC\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

      C:\Users\PC\AppData\Local\Temp\~nsuA.tmp\Un_B.exe

      I’ve blocked and quarantined both processes thru the Panda Dome Process Monitor and deleted the containing folder in AppData (which was empty, most likely because I blocked the processes).

      Both of these processes were marked as secure by Panda Dome, but they were also listed as unsigned.

      • This reply was modified 5 years, 5 months ago by Moonbear.

      This is what I got searching for UN_A.exe

      https://answers.microsoft.com/en-us/protect/forum/all/what-is-this-app-in-my-pc-una/0dc3d5fa-c444-4d06-8f9a-435e0e247dea

      1 user thanked author for this post.
      • #2021204

        Do you use DrWeb as your main protection?

        If you don’t, would you consider it?

    Viewing 3 reply threads
    Reply To: Reply #2020882 in 2 weird processes shown after uninstalling Firefox

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.

    Your information:




    Cancel