2 replies to this topic

[recruiting]

I keep getting this as a TROJAN.AGENT ever since I removed ANTIVIRUS XP 2008 a week ago (that AXP2008 thing is a bad one)

I also got the messed up security Keys See below for the last scan I ran.


Malwarebytes' Anti-Malware 1.27
Database version: 1130
Windows 5.1.2600 Service Pack 2

9/8/2008 9:39:17 AM
mbam-log-2008-09-08 (09-39-17).txt

Scan type: Quick Scan
Objects scanned: 52777
Time elapsed: 1 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Broken.SecurityProviders) -> Bad: (msapsspc.dll schannel.dll digest.dll msnsspc.dll) Good: (msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\scrfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("%1" %*) Good: ("%1" /S) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\A (Trojan.Agent) -> Delete on reboot.

[recruiting]

Ok I fixed this issue. I had a directory named C:\A and for some strange reason your product detected it as as A.EXE?

Can't the scanner tell the difference between a folder and a file, does it look for the bad code?

After changing the name of the folder from C:\A to C:\ A1A it no longer detected it as an infection.... very odd

[Tigger93]

Shows it detected C:\A, not A.exe.

This has been brought up before:

Quote

Yup , if anyone names something the same as well known malware it will be detected .

In these cases the only three options is to unprotect everyone to allow one persone to keep an special case install name for only their system .
Ask the user to whitelist those detections .
Ask the user to use a different install directory .

MBAM has a whitelist for the cases where a user wants to be different enough to make their normal installs look like malware .