How to report False Positive to us?

[hxin]

Hi Enoskype,

 

Actually, This is just our speculation.:wink:

 

Jim North scanned right when we updated our defenitions version so the data was still definitions version 1421. However, before he finish the scan, his program updated to 1423. So the report read 1423. This happened once before.

http://forums.iobit.com/showthread.php?t=2884&page=24

 

We updated defintions version twice: 1422 and 1423 yesteday because there was an another false positive in definitions version 1422.

[JayTeske]

IObit Security 360

 

OS:Windows Vista

Version:1.4.1.11

Define Version:1425

Time Elapsed:00:22:01

Objects Scanned:71708

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Generic, File, C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\InquisitorCoreDll.dll, 12-3467

[hxin]

IObit Security 360

 

OS:Windows Vista

Version:1.4.1.11

Define Version:1425

Time Elapsed:00:22:01

Objects Scanned:71708

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Generic, File, C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\InquisitorCoreDll.dll, 12-3467

Hi JayTeske

Can you send the file (InquisitorCoreDll.dll ) to here or upload to http://www.wikisend.com and give me the link . Then we can investigate it. At the same time, you can upload your suspicious file to http://www.virustotal.com for analyzing, and post your analysis report.

 

We are looking forward to your reply.

[Buleste]

IObit Security 360

 

OS:Windows 7

Version:1.4.1.11

Define Version:1427

Time Elapsed:03:50:35

Objects Scanned:295310

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Agent, File, D:\Program Files\WinUAE\AmigaSYS4.exe, 12-2919

[Kane1]

Hello to everybody this my 1rst post here in the forum.

 

After updating today IObit S360 I scanned my PC. It found like always a cookie, but something else that get my attention. Some files marked like "Trojan.Agent". It was strange when I read "kernel32".

 

 

IObit Security 360

 

OS:Windows XP

Version:1.4.1.11

Define Version:1500

Time Elapsed:00:20:28

Objects Scanned:60303

Threats Found:9

 

|Name|Type|Description|ID|

Tracking Cookies, Cookies, Cookie:owner@www.onlineregister.com/seagate/, 7-2084

Trojan.Generic, File, C:\WINDOWS\$NtServicePackUninstall$\kernel32.dll, 12-16

Trojan.Agent, File, C:\WINDOWS\system32\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\Program Files\McAfee\SiteAdvisor\SASet.dll, 12-856

Trojan.Agent, File, C:\Program Files\Samsung\Samsung New PC Studio\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\WINDOWS\ServicePackFiles\i386\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\WINDOWS\system32\dllcache\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll, 12-1163

Trojan.Generic, File, C:\WINDOWS\SoftwareDistribution\Download\fa06e29c141c84f43a95ba02f93d3774\backup\kernel32.dll, 12-16

[Pete]

False Positive - D:\WINDOWS\system32\msvcrt.dll, 12-1163 [sOLVED by db1501]

 

Hello to everybody this my 1rst post here in the forum.

 

After updating today IObit S360 I scanned my PC. It found like always a cookie, but something else that get my attention. Some files marked like "Trojan.Agent". It was strange when I read "kernel32".

 

 

IObit Security 360

 

OS:Windows XP

Version:1.4.1.11

Define Version:1500

Time Elapsed:00:20:28

Objects Scanned:60303

Threats Found:9

 

|Name|Type|Description|ID|

Tracking Cookies, Cookies, Cookie:owner@www.onlineregister.com/seagate/, 7-2084

Trojan.Generic, File, C:\WINDOWS\$NtServicePackUninstall$\kernel32.dll, 12-16

Trojan.Agent, File, C:\WINDOWS\system32\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\Program Files\McAfee\SiteAdvisor\SASet.dll, 12-856

Trojan.Agent, File, C:\Program Files\Samsung\Samsung New PC Studio\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\WINDOWS\ServicePackFiles\i386\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\WINDOWS\system32\dllcache\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll, 12-1163

Trojan.Generic, File, C:\WINDOWS\SoftwareDistribution\Download\fa06e29c141c84f43a95ba02f93d3774\backup\kernel32.dll, 12-16

 

 

Hello Kane1,

 

I too experienced one FP you already reported, namely:

 

IObit Security 360

 

OS:Windows XP

Version:1.4.1.11

Define Version:1500

Time Elapsed:00:11:06

Objects Scanned:49242

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Agent, File, D:\WINDOWS\system32\msvcrt.dll, 12-1163

 

iObit team, please kindly fix. Thanks in advance.

[Luthiensdad]

msvcrt.dll FP [sOLVED by db1501]

 

IObit Security 360

 

OS:Windows XP

Version:1.4.1.11

Define Version:1500

Time Elapsed:00:00:02

Objects Scanned:1

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Agent, File, C:\WINDOWS\system32\msvcrt.dll, 12-1163

 

this item recurs after deletion. None of my other malware scans show anything amiss with this file

[Snoopy]

msvcrt.dll, 12-1163 [sOLVED by db1501]

 

IObit Security 360

 

OS:Windows XP

Version:1.4.1.11

Define Version:1500

Time Elapsed:00:04:14

Objects Scanned:47144

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Agent, File, C:\WINDOWS\system32\msvcrt.dll, 12-1163

I have the same problem

[lexxjones]

Is this a true malware trojan.agent or false positive [sOLVED by db1501]

 

Before reporting a false positive, please save a scan report first and post it here. This will help us know the detailed information about the scan result.

 

IObit Security 360

 

OS:Windows XP

Version:1.4.1.11

Define Version:1500

Time Elapsed:00:03:54

Objects Scanned:45862

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Agent, File, C:\WINDOWS\system32\msvcrt.dll, 12-1163

[hxin]

Hello friends

 

The msvcrt.dll is a FP, We will solve the issue in our later update definition 1501.

 

Thanks for your feedback.

 

cheers.

[n30d1v4]

msvcrt.dll [false positive] [sOLVED by db1501]

 

IObit Security 360

 

OS:Windows XP

Version:1.4.1.11

Define Version:1500

Time Elapsed:00:02:38

Objects Scanned:47959

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Agent, File, C:\WINDOWS\system32\msvcrt.dll, 12-1163

[samtso]

mydocs.dll (12-856) and cookies (7-59)

 

The msvcrt.dll is a FP, We will solve the issue in our later update definition 1501.

 

Thanks for your feedback.

 

cheers.

 

Hi hxin,

 

I think the 12-856 is also a FP, see my scan report attached, and the VirusTotal link below.

--------------------------------------

IObit Security 360

 

OS:Windows XP

Version:1.4.1.11

Define Version:1500

Time Elapsed:00:07:53

Objects Scanned:61259

Threats Found:10

 

|Name|Type|Description|ID|

Tracking Cookies, Cookies, Cookie:samtso@netpass.netvigator.com/, 7-59

Tracking Cookies, Cookies, Cookie:samtso@imspmbc05.netvigator.com/, 7-59

Tracking Cookies, Cookies, Cookie:samtso@netvigator.com/, 7-59

Trojan.Agent, File, C:\WINDOWS\$NtServicePackUninstall$\mydocs.dll, 12-856

Trojan.Agent, File, C:\WINDOWS\system32\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\WINDOWS\system32\mydocs.dll, 12-856

Trojan.Agent, File, C:\WINDOWS\ServicePackFiles\i386\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\WINDOWS\ServicePackFiles\i386\mydocs.dll, 12-856

Trojan.Agent, File, C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\Canon MP780\msvcrt.dll, 12-1163

----------------------------------------------------------------------

http://www.virustotal.com/analisis/f8c0fb10a3736a8dcf3d31a114181237f2aae89827c227fc824e0326c359270f-1274413606

http://www.virustotal.com/analisis/e3c47584bac6839bb667a1f0a8a951b5a0aff7b372966fbce478f32576e4f09b-1274413541

 

By the way, those cookies in the scan report are service that I use, will you remove them from the threat list? or I have to move them to ignore list?

 

Thank you for your kindly help.

samtso

[Harrysmiith]

Wincatalog

 

IObit Security 360

 

OS:Windows XP

Version:1.4.1.11

Define Version:1501

Time Elapsed:00:00:00

Objects Scanned:1

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Generic, File, C:\Program Files\WinCatalog Standard\arc\iso.dll, 11-4675

 

 

deleted the iso.dll and then updated the program. iso.dll still shown as a Trojan

[Kane1]

Hello Pete. I updated and scanned again the system. The false positive msvcrt.dll has been resolve with the last update.

[enoskype]

Hi samtso,

 

If those cookies are flagged as tracking cookies and you want to use them, then please put them in the Ignore List.

 

I don't think IObit is going to choose to unflag a tracking cookie as a non-tracking cookie.

 

Cheers.

[belladonna406]

First time I've seen this TROJAN.AGENT scan result

 

The msvcrt.dll is a FP, We will solve the issue in our later update definition 1501.

 

Thanks for your feedback.

 

cheers.

 

---------------------------------------

 

This post made in January indicated a fix would occur. But today is the first time the TROJAN.AGENT to C:\WINDOWS\system32\msvcrt.dll had been identified during a scan. Naturally, I was freaked!! Apparently, a FIX has not yet occurred, right??

 

Also, where can I send a copy of "Hijack Report" for Advanced System Care, Pro??

 

Thanks....Cristie

[samtso]

Hi samtso,

 

If those cookies are flagged as tracking cookies and you want to use them, then please put them in the Ignore List.

 

I don't think IObit is going to choose to unflag a tracking cookie as a non-tracking cookie.

 

Cheers.

 

Hi enoskype,

 

Well noted with thanks!

 

Best regards.

[enoskype]

Hi Cristie,

 

msvcrt.dll issue has been solved by db 1501 which is already updated in IS360.

 

There seems nothing to be wrong in your report. Are you sure that is the whole of the report?

 

Since IObit Toolbar is no longer available, and if you are not still using it, you can uninstall it if you wish.

 

Cheers.

[belladonna406]

thanks enoskype and samtso for your replies.

 

I have deleted several items from the results of the Hijack Reports and without adverse effects. Since a Restore Point was created before I deleted, I proceeded and without adverse effects, thankfully. Thus, my Hijack Report reflects very little, and mostly, IOBit entries.

 

CNET, Majorgeeks, and other malware, spyware, Adware, virus referral sites don't reference Advance System Care and Iobit. Why is that?

 

And, I see that the Support Forum is flooded w/ repeated same concerns that could be addressed easily in a little "Read Me" or tutorial that could be more productive than trying to read through thousands of Q/A's and Forums, which are frustrating when you're just trying to get things in order.... I would be most happy to help with this........Cristie

[enoskype]

Hi again Cristie,

 

I hope you have not deleted the files by checking the checkboxes, as this would cause a disaster.

 

Please DO NOT DO That.

 

I understand that you have deleted the rest of the report from the text file.

 

I strongly advise you to read the whole thread of USAGE of IOBIT PRODUCTS .

 

CNET, MajorGeeks, and other security sites do not mention ASC because ASC is not a security software.

CNET and MajorGeeks and many others refers Advanced SystemCare and other softwares of IObit highly in their All-in-One-Tools and relevant sections such as Smart Defrag, Game Booster, IObit Uninstaller, Random Password Generator, etc..

 

The security software of IObit is IObit Security 360.

 

I don't think they will refer to IS360 in the security sites as there was a dispute and accusation from another security software company.

 

IObit is going to release a new security software replacing IS360 called Malware Fighter soon when it is ready.

 

The repeated same concerns are because of not reading the relevant section of the forum where the problems are clearly shown as [sOLVED] specificly in the False Positives section.

 

Please feel free to post your points in sticky About the use of Iobits products thread in General Forums section.

 

 

I am copying your above post to Advanced SystemCare section with the title Hijack Analysis Report , you can continue the discussion from there if you wish.

 

 

Thank you and cheers.

[KOR]

In the last several weeks there seems to be a number of FP reported. I never had any FP until recently.

KOR-

[belladonna406]

Thanks enoskype

 

Hi Cristie,

 

msvcrt.dll issue has been solved by db 1501 which is already updated in IS360.

 

There seems nothing to be wrong in your report. Are you sure that is the whole of the report?

 

Since IObit Toolbar is no longer available, and if you are not still using it, you can uninstall it if you wish.

 

Cheers.

 

I used the IOBit toolbar and liked that the two scans were options, and the email alerts, as well as the search field.......it was perfect for my needs....sorry it is no longer an option.

 

I have deleted nothing within the Hijack report that relates to ASC or IOB. But since they were clearly identified, they stayed while everything else went and without resulting issues! Because a Restore Point is created before anything is deleted, how could you possibly go wrong? Blessings, Cristie

 

Thanks for your replies, and for taking the time to review my list, and post it where it needed to be.

 

ASC and IOBit are extremely awesome, and almost too good to be true!! I do download them both on the home computers that I service.

[hxin]

Hi hxin,

 

I think the 12-856 is also a FP, see my scan report attached, and the VirusTotal link below.

--------------------------------------

IObit Security 360

 

OS:Windows XP

Version:1.4.1.11

Define Version:1500

Time Elapsed:00:07:53

Objects Scanned:61259

Threats Found:10

 

|Name|Type|Description|ID|

Tracking Cookies, Cookies, Cookie:samtso@netpass.netvigator.com/, 7-59

Tracking Cookies, Cookies, Cookie:samtso@imspmbc05.netvigator.com/, 7-59

Tracking Cookies, Cookies, Cookie:samtso@netvigator.com/, 7-59

Trojan.Agent, File, C:\WINDOWS\$NtServicePackUninstall$\mydocs.dll, 12-856

Trojan.Agent, File, C:\WINDOWS\system32\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\WINDOWS\system32\mydocs.dll, 12-856

Trojan.Agent, File, C:\WINDOWS\ServicePackFiles\i386\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\WINDOWS\ServicePackFiles\i386\mydocs.dll, 12-856

Trojan.Agent, File, C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll, 12-1163

Trojan.Agent, File, C:\Program Files\IObit\Advanced SystemCare 3\Backup\Drivers\Canon MP780\msvcrt.dll, 12-1163

----------------------------------------------------------------------

http://www.virustotal.com/analisis/f8c0fb10a3736a8dcf3d31a114181237f2aae89827c227fc824e0326c359270f-1274413606

http://www.virustotal.com/analisis/e3c47584bac6839bb667a1f0a8a951b5a0aff7b372966fbce478f32576e4f09b-1274413541

 

By the way, those cookies in the scan report are service that I use, will you remove them from the threat list? or I have to move them to ignore list?

 

Thank you for your kindly help.

samtso

Hi samtso

The files(msvcrt.dll, mydocs.dll ) is a FP and we have solved this issue in our definition 1501.

 

Some cookies and entry problems will be generated as soon as be cleaned, The ASC could clean them but should not prevent them from re-generating. So the ASC will not automatically block them.

[samtso]

Hi hxin,

 

Many thanks for your update, they're all fixed, but when I scan using the latest ver. 1502, I find following:

------------------------------------------

IObit Security 360

 

OS:Windows XP

Version:1.4.1.11

Define Version:1502

Time Elapsed:00:11:49

Objects Scanned:61226

Threats Found:11

 

|Name|Type|Description|ID|

Trojan.Backdoor, File, C:\WINDOWS\$NtServicePackUninstall$\dmusic.dll, 12-1082

Trojan.Backdoor, File, C:\WINDOWS\system32\dmusic.dll, 12-1082

Trojan.Spyware, File, C:\WINDOWS\system32\fxscfgwz.dll, 12-1086

Trojan.Spyware, File, C:\Program Files\Common Files\LightScribe\LSSProxy.dll, 12-1086

Trojan.Backdoor, File, C:\WINDOWS\ServicePackFiles\i386\dmusic.dll, 12-1082

Trojan.Spyware, File, C:\WINDOWS\system32\dllcache\fxscfgwz.dll, 12-1086

Trojan.Backdoor, File, C:\WINDOWS\system32\dllcache\guitrn_a.dll, 12-1082

Trojan.Backdoor, File, C:\WINDOWS\system32\usmt\guitrn_a.dll, 12-1082

Trojan.Dropper, File, C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOWS404.DLL, 12-1087

Trojan.Agent, File, C:\Program Files\Common Files\System\Mapi\1028\EMSUI32.DLL, 12-1114

Trojan.Backdoor, File, C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1045.dll, 12-1082

------------------------------------------------------

 

I just test 2 suspect files on VirusTotal (links below) and found nothing, may be these are FP as well, please kindly check.

http://www.virustotal.com/analisis/1e9e60e168d98bf0b87c2aab7ac1282864e1d65103599968c0c27eab87200e9b-1274763134

http://www.virustotal.com/analisis/c9348cb67b42306feaf68c0144bff696d0f43a867a70eac39255d02cab035763-1274763678

 

Thanks a lot!

[samtso]

thanks enoskype and samtso for your replies.

 

I have deleted ................with this........Cristie

 

Hi Cristie,

 

Don't thanks me, I did nothing, I'm just an ordinary user:oops:

 

Cheers!