How to Fix: Remove Update_Windows.exe / Update.exe Virus (100% CPU Usage)

Infopackets Reader Mike B. writes:

" Dear Dennis,

I run a Windows Server 2003 box that has been fine until two days ago. Now, my CPU usage is 100% with multiple 'Update_Windows.exe' processes running. I've deleted the Update_Windows.exe tasks in Task Manager, but it keeps propagating. I did a virus scan, but it did not find anything; Malwarebytes antimalware also is not reporting anything. Prior to the infection, I installed the emergency May 2017 update to avoid the Windows SMB exploit / WannaCry ransomware infection. I understand Windows Server 2003 is no longer supported by Microsoft and I won't be receiving any security updates - however, I run legacy software and have been very reluctant to upgrade to a new box due to not knowing whether or not it will work with newer SQL server software. Can you please help? "

My response:

I asked Mike if he would like me to connect to his server using my remote desktop support service in order to have a closer look, and he agreed.

During the connection, it took almost 10 minutes to get to the desktop - the system was so incredibly slow. When I ran Task Manager, there were four "Update_Windows.exe" processes running, consuming 100% of his CPU. The processes were literally eating the life out of the server, making it impossible to do anything - which is why it also took 10 minutes to login. I ended all the Update_Windows.exe tasks, only to have it come back again just as Mike stated.

From experience, I know that "Update_Windows.exe" is not part of the Windows operating system, so I knew for certain that this was likely a virus of some sort. Since Mike was running Windows Server and not a standard Windows desktop system, there are very few (if any) antivirus / antimalware programs that will work for free without having to fork over money for an expensive subscription. As such, I knew my options were limited and would require command line Kung Fu to get the job done.

How to Fix: Remove Update_Windows.exe / Update.exe Virus (100% CPU Usage)

When a computer is infected with a self-propagating virus, the first thing you'll want to do is locate where the executable(s) are stored on the system. If you can do that, then renaming the .exe and/or clearing out the directory where the .exe(s) are located usually fixes the problem - but you have to act very quickly, otherwise the process will simply spawn itself again. In this case, the only way to achieve this is to write a command line batch script in Notepad, then paste the commands into a command prompt so they are rapidly executed.

On most modern Windows desktops, you can right click a task in Task Manager and select "Open file location", and this will tell you where the task / virus is located. Unfortunately, Windows Server 2003 does not have this as part of its Task Manager options. As such, I had to manually locate the file.

To do so, I opened up a command prompt and attempted to recursively locate the "Update_Windows.exe" file from the root directory of the C drive, but it came back with no results. At this point I knew the file was likely hidden. I did another search with the 'hidden files' attribute, and finally found the process located in C:\Windows\Debug.

From there I attempted to end the Update_Windows.exe tasks using "taskkill" via the command line, then rename the main Update_Windows.exe file immediately. To my surprise, the system reported that it could not find the file when attempting to rename it. I looked at the file attributes for "Update_Windows.exe" and noted it had Hidden and Archive file attributes - so I disabled them, and was able to finally rename the file using the batch script I wrote.

The virus managed to propagate itself once more during the renaming process (yes, it propagated that fast!); I ended the "Update_Windows.exe" task once again and it never came back because the Update_Windows.exe had been renamed to Update_Windows.virus, making it no longer executable (only .exe files can be executed).

Problem solved!

Update 20170627: You also will need to patch the system against SMB exploits or the infection will return. This is exactly what happened only one day after publishing this article (also noted in the comments below - thanks to 'skyhater_9456'). We wrote about the SMB exploit issue two weeks ago - read about it here - includes instructions and link to how to fix it.

Here is the batch script I wrote to mitigate the attack:

#C:
#cd c:\windows\debug
#attrib -a -r -h -s Update_Windows.exe

taskkill /f /im "Update_Windows.exe"
rename Update_Windows.exe update_windows.virus

I hope that helps, in case any one else reading this has the same issue. If my instructions helped you, please feel free to leave a comment below! If not, let's hope this was a learning experience.

PS: for the record, this particular virus was actually a Bitcoin mining hack tool (I uploaded the .exe file to virustotal.com to see what it was). In this case, the virus uses 100% of the host CPU's system as it mines for Bitcoins. The malware writer then gets paid for every Bitcoin mined (computed). On a large scale, having hundreds, thousands, or even hundreds of thousands of infected machines could make this scheme potentially profitable. I suspect the name "Update_Windows.exe" may refer to multiple virus variants, and not just this particular strain. If you are infected with a virus and are unable to get rid of it, you are welcome to contact me for additional support - described next.

Additional 1-on-1 Support: From Dennis

If your system is infected with the "Update_Windows.exe" virus or "Update.exe" virus (or something similar) and you are not able to remove it, I can help using my remote desktop support service. Simply contact me, briefly describing the issue, and I will get back to you as soon as possible.

Got a Computer Question or Problem? Ask Dennis!

I need more computer questions. If you have a computer question - or even a computer problem that needs  fixing - please email me with your question so that I can write more articles like this one. I can't promise I'll respond to all the messages I receive (depending on the volume), but I'll do my best.

About the author: Dennis Faas is the owner and operator of Infopackets.com. With over 30 years of computing experience, Dennis' areas of expertise are a broad range and include PC hardware, Microsoft Windows, Linux, network administration, and virtualization. Dennis holds a Bachelors degree in Computer Science (1999) and has authored 6 books on the topics of MS Windows and PC Security. If you like the advice you received on this page, please up-vote / Like this page and share it with friends. For technical support inquiries, Dennis can be reached via Live chat online this site using the Zopim Chat service (currently located at the bottom left of the screen); optionally, you can contact Dennis through the website contact form.