False Firmware Update Tool

[Tuasemper]

Hi. I have an ASUS GL753VD laptop that runs Win 10, 64 bit, 4 core. I've only had it maybe 3 months. I'm sort of PC savvy, so forgive my lack of info if it's needed.

This morning a suspicious looking popup started right at login. It has a lot of broken English, & has no distinctive logos. I can click Cancel 3 times, & it won't pop back up until 10-45 min later. Then it's "rinse & repeat". Malwarebytes came up with nothing, so did BitDefender. I checked around for info, but didn't find much, unless my lack of understanding is showing. When you right click the icon in the task tray, it says AFUWINGUI MFC Application.

https/www.reddit.com/r/techsupport/comments/6il4nz/shady_firmware_update_tool_popped_out_of_nowhere/ <-- This site shows a screenshot of this exact thing, & it looks like several people started having this popup this morning.

https/www.wimsbios.com/amiflasher.jsp <-- The above site led me to this one.

http/www.isthisfilesafe.com/sha1/50FEAC08B8308D7E1E1655572A665EF57C31A12B_details.aspx <-- I also found this.

Does anyone know what to do to get rid of this popup? I'm including a screenshot of the popup, & what the icon looks like in the task tray. It may be too early to know what it is, but any info would help. Thank you, Christie

Image 1 --> http/2dazed.deviantart.com/art/Firmware-update-tool-687851578?ga_submit_new=10%3A1498075553

Image 2 --> http/2dazed.deviantart.com/art/Afu-icon-687851940?ga_submit_new=10%3A1498075650

 

[kaptainkuftic]

Do you see that popup in safe mode?

 

[Tuasemper]

I haven't tried Safe Mode yet. I was trying a few other things first. I got rid of my temp files, & rebooted to see if that helped any. I noticed the ASUS Live Update was trying to do it's thing. After downloading the critical update, it gets stuck at 50% installing, & that's when this Firmware thing pops up. It seems odd that this would be legit with it's wording being a little off.

Is this just related to an update, or should I go ahead & try Safe Mode first?

This is what it looks like with the ASUS Update --> http/

 

[Mihailo_3]

I went ahead and clicked on it, got a message that BIOS doesn't need updating - the reddit thread you linked had some people confirm it was a legit firmware update tool. It's just terribly basic-looking, I suppose.

 

[Fiftykent]

I got this as well just now on my new laptop. Litteraly bought the computer a couple of hours ago. My guess is that it's a firmware update pushed by Asus from a Japanese publisher (hence the poor spelling). If anything shady comes up we at least have a bunch of people on that reddit thread that will keep us posted

 

[Victoria79]

I got this as well just now on my new laptop. Litteraly bought the computer a couple of hours ago. My guess is that it's a firmware update pushed by Asus from a Japanese publisher (hence the poor spelling). If anything shady comes up we at least have a bunch of people on that reddit thread that will keep us posted

No I just got it too looked it up on my phone while reading my laptop blue screened and rebooted. Now it's not popping up anymore so weird

 

[BrosephF]

A few people from the reddit thread have called asus tech support and they said it could be malware.

 

[rgd1101]

and they all have asus laptop?

 

[BrosephF]

and they all have asus laptop?

Yeah

 

[Victoria79]

A few people from the reddit thread have called asus tech support and they said it could be malware.

I scanned and said nothing only just got this laptop have only got a game viewer which is trusted and Firefox. So not sure how it could be malware.

 

[Travileec]

Interesting. I just had the same thing popping up on my Asus computer as well.

 

[Jacob33]

I have Asus as well, haven't downloaded anything in quite some time. went to work (firefighter) came back 3 days later and have the same pop up constantly.

 

[techrolls]

I've been getting the same pop-ups on my laptop today as well.

Here's the file origin, in case it's helpful: https/www.flickr.com/gp/151942195@N06/8qVxH1
(It's the top file)

I called Asus support and they simply had me delete the file and restart my computer. No pop-ups so far, I'll update if there are any new developments.

 

[Tuasemper]

Well at least we're all in the same boat then. Whew! I had gone back & read that link about the ASUS update too. I thought it was odd that the ASUS was a common factor. I'll try deleting the file & see what happens. I was hoping if it was something big & bad, it would iron itself out. Thanks for the info ya'll. I appreciate it. If anything goes wrong, I'll post back & let you know.

 

[Sharease]

Hi, I also have an asus laptop and I just got this laptop on June 3rd. I'm angry because I've been getting these same pop ups that won't disappear. Is there a strong enough virus remover to detect this malware threat?

 

[techrolls]

Just an update, deleting that one file got rid of other files as well: https/flic.kr/p/VPNdDa

I'm going to trust that according to tech support the file wasn't important, but I think I'll give them a call to double check about the other files tomorrow.

 

[techrolls]

Bad news guys: All deleted files are back and so is the pop-up. I'm not sure if it has something to do with that zipped file in the screenshots I posted above. Before deleting it's about 9 000 kb and after deleting its about 18 000 kb. Now that these files are back it's down to the previous size. I'm going to call tech support again right now and see what I can do.

Update: I have been advised to backup all of my important documents and information and then perform a factory reset on my computer. I will be in further contact with tech support and will continue posting updates here. Wish me luck, and I wish the same to all of you.

I might recommend waiting on doing any resets of your own, because I'm not yet sure it will actually solve the problem. It doesn't appear that the pop-up will do anything so long as you don't allow it to update, so it may be wise to sit tight until a permanent solution is figured out.

 

[techrolls]

New development: The entire folder "3" has disappeared.

I had the folder open in the background as I was backing up my data. I got annoyed at the pop-up and pressed "cancel" 3 times to get rid of it for a bit. Then this popped up: https/flic.kr/p/VXQR7o

The folder is completely gone, or has changed locations: https/flic.kr/p/UK1rxJ

I'm still fairly new to pc and I'm not sure whether this means anything. I will update this answer if the pop-up or folder reappears.

 

[Nick_217]

I think this may be legit. I read through here and risked hitting update just now and got the same message saying BIOS was up to date and closing the tool. I went and looked at ASUS Live Update and had it check for updates... it said none were needed.

HOWEVER, when I checked the ASUS Live Update log... it shows the the time stamp of when I cancelled the FW Update tool 3 times.. then it shows the same time stamp for when I gave in and had it run its course.

Link to screen shot
http/i.imgur.com/Z310PBG.png

 

[techrolls]

Ok it seems the files have a cycle. Here are the screenshots.

While the pop-up is present:
https/www.flickr.com/gp/151942195@N06/250KTr

After cancelling 3 times:
https/flic.kr/p/VXQR7o
https/flic.kr/p/UK1rxJ

Prepping for pop-up (shortly before it shows up again):
https/flic.kr/p/W2qdEt
https/flic.kr/p/VPUkW4

According to other's experiences with ASUS support, they don't seem to know whats going on. Some were at first told it was legit but when talking with the agent were later told it was a virus. As far as I know I was the first to be told to try a factory reset. But if this is somehow built into their own update software I'm not sure it will be fixed.