FACEBOOKUPDATE.EXE – not a virus

August 3, 2011 by NightWatcher
Filed under: Not-a-Virus 
: Solved!

Fix it immediately:

Analysis of FACEBOOKUPDATE.EXE
Full path on a computer: %Local Appdata%\Facebook\Update\FacebookUpdate.exe

FACEBOOKUPDATE.EXE is known as:

Facebook Skype Plugin

FACEBOOKUPDATE.EXE hash:

  • MD5: 3cbc69a4fa0e2432fafaa559b83dc077
  • SHA1: 9e550c32bda4ef515336729f4f52e43f1439f9d8
How to quickly detect FACEBOOKUPDATE.EXE presence?
Registry:
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Facebook Update: “”%Local Appdata%\Facebook\Update\FacebookUpdate.exe” /c /nocrashserver”
Folders:
  • %Local Appdata%\Facebook
  • %Local Appdata%\Facebook\CrashReports
  • %Local Appdata%\Facebook\Update
  • %Local Appdata%\Facebook\Update\1.2.199.0
  • %Local Appdata%\Facebook\Update\Download
  • %Local Appdata%\Facebook\Update\Manifest
  • %Local Appdata%\Facebook\Update\Manifest\Initial
  • %Local Appdata%\Facebook\Video
  • %Local Appdata%\Facebook\Video\Skype
  • %Local Appdata%\Temp
  • %Common Appdata%\Microsoft\Network\Downloader
Files:
  • %Local Appdata%\Facebook\Update\1.2.199.0\FacebookCrashHandler.exe
  • %Local Appdata%\Facebook\Update\1.2.199.0\FacebookUpdate.exe
  • %Local Appdata%\Facebook\Update\1.2.199.0\FacebookUpdateHelper.msi
  • %Local Appdata%\Facebook\Update\1.2.199.0\goopdate.dll
  • %Local Appdata%\Facebook\Update\FacebookUpdate.exe
  • %Local Appdata%\Facebook\Video\Skype\FacebookVideoCalling.exe
  • %Local Appdata%\Facebook\Video\Skype\npFacebookVideoCalling.dll
  • %Temp%\FacebookVideoCallSetup_v1.2.199.0.exe
  • %Temp%\server.exe
  • %Common Appdata%\Microsoft\Network\Downloader\qmgr0.dat
  • %Common Appdata%\Microsoft\Network\Downloader\qmgr1.dat
  • %WinDir%\Installer\31ac1.msi
  • %WinDir%\Tasks\FacebookUpdateTaskUserS-1-5-21-1659004503-1708537768-1801674531-500Core.job
  • %WinDir%\Tasks\FacebookUpdateTaskUserS-1-5-21-1659004503-1708537768-1801674531-500UA.job


Recommended: UnHackMe anti-rootkit and anti-malware

Premium software: RegRun Security Suite (Good choice for removal and protection)

Written by

Malware Hunter.

Tags: Backdoor, FACEBOOKUPDATE.EXE, Rbot

Comments

9 Comments on FACEBOOKUPDATE.EXE – not a virus

  1. gundamn on Thu, 8th Sep 2011 6:50 pm

    2. That is wrong. It is the Facebook Skype Plugin and not dangerous in any point. This here is misleading information.

  2. NightWatcher on Thu, 8th Sep 2011 9:24 pm

    3. Thank you!

  3. Asfandiyar on Sun, 25th Sep 2011 3:20 pm

    4. FacebookUpdate.exe belongs to all those software which now has the connectivity to Facebook. Like New Yahoo messenger which itself has a portion for connecting your yahoo with facebook account, the same is in the skype, but I don't know if the skype facebook process is called FacebookUpdate.exe or not, but for sure on yahoo it's called FacebookUpdate.exe …

    I believe it's safe, but the problem with it is, that it tries to access internet after each 10's of mints, I've blocked this process because I don't really need it, nor I want my cpu be busy with this stupid process….

    anyways thanks and enjoy it free, it's free of risk.

  4. johnk on Fri, 14th Oct 2011 9:58 am

    5. It is just the plugin for calling people with skype on facebook!!NOT A VIRUS!!!!

  5. Felipe Drumond on Wed, 21st Dec 2011 5:21 pm

    6. It´s the Skype plug-in. It's safe.

  6. Ummm on Fri, 30th Mar 2012 3:04 pm

    7. C:UsersRohanAppDataLocalFacebookUpdateFacebookUpdate.exe" /c /nocrashserver

    …is this what you mean though..? I don't think anything that runs from 'appdatalocal" is meant to be on your startup list O.o
    …I just have it disabled with ccleaner…it sounds too much like a virus .-.

  7. Bozo on Thu, 5th Apr 2012 2:34 am

    8. I believe it's a vector. I've had multiple attacks since this loaded onto my rig without asking, including a complete takeover of my Facebook account by someone advertising shoes. Disable, or better yet, remove with CCleaner. When did Facebook ask for permission to install ANY programs on my computer? They are a website. Nothing more. And for those "hey, it's free" people, no, it's not. Facebook sells your life story for a buck – billions of them, actually, and needs to be more respectful of the souls they are exploiting.

    Did I say respectful? I am a dreamer…

    So far, after removing all background Facebook crapware, my connection has stopped logging on and off at random,and my Facebook account has not been spammed.

  8. Sahimone on Tue, 10th Apr 2012 5:56 pm

    9. Bozo, what do I have to delete to get ride of all those crapware ?

    I'lm really concern by the fact that FB is selling all our info. By the way the privacy terms in FB are getting crazy !

    Hope you will help me.

    Cheers; Sahimone

  9. Rob on Thu, 26th Apr 2012 5:00 am

    10. It might not be a virus, but it sure as hell wasn’t something I chose to install. I don’t even have skype on this machine. Bye Bye…

Tell me what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!

You must be logged in to post a comment.