Trojan agent-Gen fake alert

ravencajun Zone 8b TX

17 years ago

there are variations of the Trojan Agent some are nasty some not too bad, I would go ahead and run malwarebytes and see if it finds any thing.

Malwarebytes' Anti-Malware

please download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be found here: C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt

owbist

17 years ago

Run the scan in Safe mode, you will do much better.

Related Discussions

Got a problem

Q

Comments (18)

Did I get a virus?

Q

Comments (42)

just be sure if you decide to use zonealarm you get the free version not the trial version and do not get any of that added stuff. ZoneAlarm ® Firewall that should be the direct download for the free za as was stated as you go along with a firewall and it asks you to allow it to access the internet the ones you know for sure like your antivirus and your browsers you can put a check mark in the remember this box and it will no longer ask you for that one unless you do an update to the program then it will ask again and you tell it to remember again. You do not want to give server rights to anything so if the box pops up asking for server rights say no then it will pop up asking for just permission to access that one you can allow if it is something you are familiar with. If you do not recogonize the name of what is asking for permission you say no, then if you see that something you were trying to use would not open you know that was the thing that was asking for permission, so you can know to allow it next time. That generic 32 one that had you worried you MUST allow that or you can not do anything, that is a process you need to set to always allow. First time you use any program the firewall will have to ask you for permission, say your music player for example, tell it yes to permission and check the box for remember and you are done with that it will not ask you again. At first it seems daunting but once you get thorugh that initial flood of setting up what can and can not access then you rarely ever get bothered by it. What you are trying to prevent is allowing something that you are not familiar with which may be malware that got on your computer and is trying to phone home to whoever wrote the malware and it will then be sending info from your pc to that person. that is why it is very important not to just always click to allow, know what you are allowing. If you do not recognize a name copy and paste it in google and see what you find out usually you can tell right away what program it is. also with most firewalls you can click for details and it will give you info that can help tell what is asking for access. I am totally self taught and also one of the older crowd, we were all newbies at one time! but please if you do not put in a firewall DO go turn on the one you have with xp it is better than nothing, however if you put one in you must turn that xp one off you can not have 2 firewalls.

lsass.exe trying to contact my computer

Q

Comments (10)

Here are my results scanning the same file you did on my xp, File lsass.exe received on 03.17.2009 07:25:22 (CET) Current status: finished Result: 0/39 (0.00%) Compact Compact Print results Print results Antivirus Version Last Update Result a-squared 4.0.0.101 2009.03.17 - AhnLab-V3 5.0.0.2 2009.03.16 - AntiVir 7.9.0.116 2009.03.16 - Authentium 5.1.0.4 2009.03.17 - Avast 4.8.1335.0 2009.03.16 - AVG 8.0.0.237 2009.03.16 - BitDefender 7.2 2009.03.17 - CAT-QuickHeal 10.00 2009.03.17 - ClamAV 0.94.1 2009.03.17 - Comodo 1060 2009.03.16 - DrWeb 4.44.0.09170 2009.03.17 - eSafe 7.0.17.0 2009.03.15 - eTrust-Vet 31.6.6388 2009.03.09 - F-Prot 4.4.4.56 2009.03.16 - F-Secure 8.0.14470.0 2009.03.17 - Fortinet 3.117.0.0 2009.03.17 - GData 19 2009.03.17 - Ikarus T3.1.1.45.0 2009.03.17 - K7AntiVirus 7.10.673 2009.03.16 - Kaspersky 7.0.0.125 2009.03.17 - McAfee 5555 2009.03.16 - McAfee+Artemis 5555 2009.03.16 - McAfee-GW-Edition 6.7.6 2009.03.16 - Microsoft 1.4405 2009.03.17 - NOD32 3941 2009.03.17 - Norman 6.00.06 2009.03.16 - nProtect 2009.1.8.0 2009.03.17 - Panda 10.0.0.10 2009.03.16 - PCTools 4.4.2.0 2009.03.16 - Prevx1 V2 2009.03.17 - Rising 21.21.10.00 2009.03.17 - Sophos 4.39.0 2009.03.17 - Sunbelt 3.2.1858.2 2009.03.17 - Symantec 1.4.4.12 2009.03.17 - TheHacker 6.3.3.0.283 2009.03.16 - TrendMicro 8.700.0.1004 2009.03.17 - VBA32 3.12.10.1 2009.03.16 - ViRobot 2009.3.17.1651 2009.03.17 - VirusBuster 4.6.5.0 2009.03.16 - Additional information File size: 13312 bytes MD5...: bf2466b3e18e970d8a976fb95fc1ca85 SHA1..: de5a73cbb5f51f64c53fb4277ef2c23e70db123f SHA256: f7794b5d12dc5d820a162850f4388e2aa80426ad07cb221799cf941c682ab501 SHA512: c1f09ab3ad3b892f009270eb5325d801435ff2ffbf1354e66e333025634b707a 4cedf58a6b306efdddfcb1c010767983000d72dc5935240455f98f4490f551d4 ssdeep: 384:ggHUJZXmtGDWkzLWT4a8WfMptsN0BhgO49:338z4zRfMpy0BF4 PEiD..: - TrID..: File type identification Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x14bd timedatestamp.....: 0x48025186 (Sun Apr 13 18:31:34 2008) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x10d0 0x1200 6.00 7d33d24893e1db0fa0ecbd7a8fa637bd .data 0x3000 0x6c 0x200 0.20 86a789a893c60d5e207d053188cdc250 .rsrc 0x4000 0x1b30 0x1c00 7.15 54488850c25258396b2c9492c36b0bd5 ( 5 imports ) > ADVAPI32.dll: FreeSid, CheckTokenMembership, AllocateAndInitializeSid, OpenThreadToken, ImpersonateSelf, RevertToSelf > KERNEL32.dll: CloseHandle, GetCurrentThread, ExitThread, SetUnhandledExceptionFilter, SetErrorMode, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, RtlUnwind, InterlockedExchange, VirtualQuery > ntdll.dll: NtSetInformationProcess, RtlInitUnicodeString, NtCreateEvent, NtOpenEvent, NtSetEvent, NtClose, NtRaiseHardError, RtlAdjustPrivilege, NtShutdownSystem, RtlUnhandledExceptionFilter > LSASRV.dll: LsaISetupWasRun, LsapDsDebugInitialize, LsapAuOpenSam, LsapCheckBootMode, ServiceInit, LsapInitLsa, LsapDsInitializePromoteInterface, LsapDsInitializeDsStateInfo > SAMSRV.dll: SamIInitialize, SampUsingDsData

spyware/ Trojan help

Q

Comments (8)

Hello, I found this Infomation on the SuperAntiSpware forum: False positve "There was an issue affecting some users which has been corrected with the latest release, please update your definitions now. Any items removed can be restored by opening SUPERAntiSpyware, clicking Manage Quarantine, selecting the detection and clicking Restore." "Michael G. Customer Service Representative SUPERAntiSpyware www.superantispyware.com " http://forums.superantispyware.com/index.php?/topic/7052-trojanagentgen-kryptik/ Joe

Lyban zone 4
Original Author

17 years ago

OK. I ran Malwarebytes. Full scan, while it was running with so far no infections my avast popped up saying I had an infection called win32Trojan gen(other). Advised that I put it in the chest. I did this. then in another minuite it popped up again and I put it in chest and then a third time. Then malware was continuing and at the end said I had no infections.
Now I still get the window everytime I close off any web page in my Internet explorer. I took a shot of the window.
{{gwi:1466299}}

I have been just clicking don't send. Should I be doing this or what?

zep516

17 years ago

Send the error report, then where it says "To see what data this error report contains," click here. That may give some indication of whats going on.

And you can google " Internet Explorer has encountered a problem an needs to close"

zep

Lyban zone 4
Original Author

17 years ago

Here is what I get when I click more info .

{{gwi:1466300}}
If I want to view tech. info. you can see that they seem to be able to see all my data. Do I want to do this???

zep516

17 years ago

What version of IE would be the next question?

Lyban zone 4
Original Author

17 years ago

IE 6.0
The pop up is no big deal, maybe I should live with it for a week and see if it will miraculously go away like some things seem to do.

ravencajun Zone 8b TX

17 years ago

if IE is your only browser you should consider getting firefox also, it is a good idea to always have at least 2 browsers in case one should go bad. That way you still can get online and access the web. You could also see if what ever is causing that issue is strictly an IE issue if it does not happen with firefox.

zep516

17 years ago

Right get firefox, an up date IE6 TO 7.

zep516

17 years ago

Get firefox here

Here is a link that might be useful: Firefox

Lyban zone 4
Original Author

17 years ago

What is Firefox compared to Mozilla.
The guy who sold me my computer here mentioned that I should get Mozilla.
If I downlloaded one of these. Do they work the same as IE for getting on the web.

zep516

17 years ago

Yes works the same as IE it's just another web browser Mozilla is the company that produces firefox.

Lyban zone 4
Original Author

17 years ago

One more question before I try this. Would I have room on my computer to downlad another browser but keep IE.
I have two places on my computer that show capacity:
C: total 39.0 GB (used 17.8)
E: toatal 35.4 GB (used none)

Lyban zone 4
Original Author

17 years ago

Another question. Can I download Firefox and start new bookmarks with it rather than bring my IE ones over. And my other stuff, do I bring it all over or leave them seperate.

ravencajun Zone 8b TX

17 years ago

yes you are fine, and yes you can have several browsers with no problem, you can even have more than one type open at the same time if you need to.
When you get firefox it will ask if you want to make it your default you can say no and leave your Ie default if you prefer, it will also ask if you want it to import your favorites list from Ie say yes to that and any other things it ask to import and it will then set up your firefox with all the same faves as you have on Ie, will not touch the Ie settings at all will just copy it all over for you.
To use firefox once installed all you do is click on the firefox icon on your desktop and it will open up a browser window just like you do with IE. Here are some helpful links
Ultimate List of Firefox 3 Tips and Tricks

Here is a link that might be useful: firefox guide

Lyban zone 4
Original Author

17 years ago

Thanks again everyone.
I now have Firefox on my computer.
I kept IE for now.
Does my avast protect this Firefox as well as IE or do I need another program for protection.

zep516

17 years ago

No your ok there..

Trojan agent-Gen fake alert

Comments (17)

ravencajun Zone 8b TX

owbist

Related Discussions

Lyban zone 4
Original Author

zep516

Lyban zone 4
Original Author

zep516

Lyban zone 4
Original Author

ravencajun Zone 8b TX

zep516

zep516

Lyban zone 4
Original Author

zep516

Lyban zone 4
Original Author

Lyban zone 4
Original Author

ravencajun Zone 8b TX

Lyban zone 4
Original Author

zep516

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Trojan agent-Gen fake alert

Comments (17)

Related Discussions

Lyban zone 4Original Author

Lyban zone 4Original Author

Lyban zone 4Original Author

Lyban zone 4Original Author

Lyban zone 4Original Author

Lyban zone 4Original Author

Lyban zone 4Original Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Lyban zone 4
Original Author

Lyban zone 4
Original Author

Lyban zone 4
Original Author

Lyban zone 4
Original Author

Lyban zone 4
Original Author

Lyban zone 4
Original Author

Lyban zone 4
Original Author