How to report False Positive to us?

[BJHALLGRAV]

false positive in microsoft money 2004

 

false positive report:

IObit Security 360

 

OS:Windows 7

Version:1.4.1.11

Define Version:1514

Time Elapsed:00:10:00

Objects Scanned:64304

Threats Found:2

 

|Name|Type|Description|ID|

Tracking Cookies, Cookies, Cookie:barb@atdmt.com/, 7-1541

Trojan.Agent, File, C:\Program Files (x86)\Microsoft Money\System\dw15.exe, 11-11669

The microsoft money file is a false positive as it's part of the program & is NOT a virus. Also scanned it with other antivirus programs to be doubley sure!

Barb

[hxin]

false positive report:

IObit Security 360

 

OS:Windows 7

Version:1.4.1.11

Define Version:1514

Time Elapsed:00:10:00

Objects Scanned:64304

Threats Found:2

 

|Name|Type|Description|ID|

Tracking Cookies, Cookies, Cookie:barb@atdmt.com/, 7-1541

Trojan.Agent, File, C:\Program Files (x86)\Microsoft Money\System\dw15.exe, 11-11669

The microsoft money file is a false positive as it's part of the program & is NOT a virus. Also scanned it with other antivirus programs to be doubley sure!

Barb

 

Hi BJHALLGRAV

 

Thanks for your feedback.

You can send us your suspicious file(dw15.exe) or upload to www.wikisend.com and give us the link . Then we can further investigate it. At the same time, you can upload your suspicious file to http://www.virustotal.com for analyzing, and post your analysis report.

 

We are looking forward to your reply.

[yuniverse]

Please help ASAP [sOLVED by db 1603]

 

IObit Security 360

 

OS:Windows 7

Version:1.4.1.11

Define Version:1602

Time Elapsed:00:02:54

Objects Scanned:47848

Threats Found:6

 

|Name|Type|Description|ID|

Tracking Cookies, Cookies, Cookie:yuniverse@atdmt.com/, 7-1541

Backdoor.Frauder, File, C:\Windows\system32\svchost.exe, 4-12487

 

This happens on all my computers with 360 installed (Windows 7, XP)

[hxin]

IObit Security 360

 

OS:Windows 7

Version:1.4.1.11

Define Version:1602

Time Elapsed:00:02:54

Objects Scanned:47848

Threats Found:6

 

|Name|Type|Description|ID|

Tracking Cookies, Cookies, Cookie:yuniverse@atdmt.com/, 7-1541

Backdoor.Frauder, File, C:\Windows\system32\svchost.exe, 4-12487

 

This happens on all my computers with 360 installed (Windows 7, XP)

Hi yuniverse

 

This is a FP.We will solve the question in our later update definition 1603.

 

Thanks for your feeedback!

[yuniverse]

Hi yuniverse

 

This is a FP.We will solve the question in our later update definition 1603.

 

Thanks for your feeedback!

 

Thank you for the reply. I'm glad it's a FP, but Enoskype was helping me in another post and I've ran VirusTotal and the svchost.exe came out 1/40

below is the link.

http://www.virustotal.com/analisis/121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2-1276177042

[PAlanis]

Smart PC Solutions. FP? [sOLVED by db 1610]

 

IObit Security 360

 

OS:Windows 7

Version:1.4.1.11

Define Version:1607

Time Elapsed:00:02:01

Objects Scanned:45399

Threats Found:2

 

|Name|Type|Description|ID|

Unwanted.Smart_PC, Registry Key, HKEY_CURRENT_USER\Software\Smart PC Solutions, 4-22226

 

----

Company: http://www.smartpctools.com/en/index.html

----

[hxin]

IObit Security 360

 

OS:Windows 7

Version:1.4.1.11

Define Version:1607

Time Elapsed:00:02:01

Objects Scanned:45399

Threats Found:2

 

|Name|Type|Description|ID|

Unwanted.Smart_PC, Registry Key, HKEY_CURRENT_USER\Software\Smart PC Solutions, 4-22226

 

----

Company: http://www.smartpctools.com/en/index.html

----

 

Hi PAlanis

 

This is a FP. Sorry for the trouble we have caused to you.

 

We will solve this issue in our later update definition 1610.

 

Thanks for your support.

[Don Wheaton]

Mr.

 

Why is it Spyware always states there are 2 Spyware Present . ? No matter wheather I ran 2 Anti Spyware Programs and than Advanced System Care

 

Why does your program Defrag state there are 220 Fragmented files when there are only 3 . How do I Know there are only 3 ? because I ran Smart Defrag 1St and am looking at a screen -displaying ony 3. This takes forever for ASE to clear something that isn't there.

 

How can I recommend your Program when it Lies ?

Best regards ,

Don Wheaton

[enoskype]

Hi Don Wheaton,

 

Please post some screenshots, so we can understand what you are trying to describe.

 

A program does not lie, please elaborate.

 

Cheers.

[johnalan]

Trojan False positive SS32.dll [sOLVED by db 1700]

 

IObit Security 360

 

OS:Windows XP

Version:1.4.5.67

Define Version:1642

Time Elapsed:01:14:24

Objects Scanned:120822

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Win32/BHO, File, C:\Program Files\Common Files\System\SS32.dll, 4-752

 

 

I am going to scan with 2 or 3 other programs I used to see if any of them show this as a trojan. It was installed by a commercial astronomy program that I got on CD, Cellestron's "The Sky". Everytime I let 360 remove it the program ceases to function and I have to reinstall it. I will update this post later tonight with results of other testing.

 

Thanks!!!

[hxin]

IObit Security 360

 

OS:Windows XP

Version:1.4.5.67

Define Version:1642

Time Elapsed:01:14:24

Objects Scanned:120822

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Win32/BHO, File, C:\Program Files\Common Files\System\SS32.dll, 4-752

 

 

I am going to scan with 2 or 3 other programs I used to see if any of them show this as a trojan. It was installed by a commercial astronomy program that I got on CD, Cellestron's "The Sky". Everytime I let 360 remove it the program ceases to function and I have to reinstall it. I will update this post later tonight with results of other testing.

 

Thanks!!!

 

Hi johnalan

 

You can upload to http://www.wikisend.com and give us the link or send us your suspicious file (SS32.dll), and then we can further investigate it. At the same time, you can upload your suspicious file to http://www.virustotal.com for analyzing, and post your analysis report.

 

We are looking forward to your reply.

[johnalan]

wikisend doesn't

 

I tried uploading ss32.dll several times to wikisend and always got 0% progress and then it would error out. I even registered there - no difference.

 

I did scan that file with FIVE other security programs and it passed each one. Those programs were AVG, Glary, ASC, Malwarebytes and Spybot - all the latest versions. I have no reason to believe ss32.dll is a threat. Seems 360 is wrong on this one.

 

If you have another place I can upload it too, I will try. Wikisend didn't work for me...

 

 

OK, I uploaded to virus tool and there is the report:

 

File SS32.dll received on 2010.07.20 04:42:39 (UTC)

Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED

Result: 0/42 (0%)

 

Additional information

File size: 114688 bytes

MD5...: 44c0e0838c0b2bfb9c4fdd588c569b94

SHA1..: 7eaffa07248682cd4263adceb1f1ebcb0850739f

SHA256: ac452ca1569995e056b3774fa61ff62d265b8ebe409951c55ca57e75977aafca

ssdeep: 1536:NAbi9gE5URSRTy4HsOo95rGybk2nhTERTyo9CV7JGe7LqE2n3bo:diRSZb+

K9+HmEG3bo

PEiD..: -

PEInfo: PE Structure information

 

( base data )

entrypointaddress.: 0x945a

timedatestamp.....: 0x38baa0af (Mon Feb 28 16:22:07 2000)

machinetype.......: 0x14c (I386)

 

( 4 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x10492 0x11000 6.61 c4fe15eda30aa6c152d6b896f66ae560

.rdata 0x12000 0x5193 0x6000 5.02 901228882a1f3731745e830f142ace31

.data 0x18000 0x344c 0x2000 2.48 c6c45949b6853f888abb419ac99b5ef9

.reloc 0x1c000 0x1980 0x2000 4.60 7d3bdb929346fdad2a13be0510757841

 

( 1 imports )

> KERNEL32.dll: HeapDestroy, GetCommandLineA, GetVersion, GetProcAddress, GetModuleHandleA, RaiseException, EnterCriticalSection, LeaveCriticalSection, HeapFree, GetLastError, CloseHandle, ReadFile, InitializeCriticalSection, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, SetFilePointer, WriteFile, ExitProcess, TerminateProcess, GetCurrentProcess, GetCurrentThreadId, TlsSetValue, TlsAlloc, TlsFree, SetLastError, TlsGetValue, GetModuleFileNameA, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStrings, GetEnvironmentStringsW, lstrcpyA, HeapCreate, VirtualFree, InterlockedDecrement, InterlockedIncrement, HeapAlloc, VirtualAlloc, HeapReAlloc, SetStdHandle, FlushFileBuffers, CreateFileA, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, GetCPInfo, GetACP, GetOEMCP, LoadLibraryA, LCMapStringA, LCMapStringW, SetEndOfFile, RtlUnwind

 

( 31 exports )

_Aberr2@@YGXPAVCSolarSystem@@PAN1@Z, _AtmRefraction@@YGNN@Z, _CalendarToJD@@YGNPAUtagTDATE@@@Z, _ComputeAsteroid@@YGXPAVCSolarSystem@@PAUtagASTEROID_INPUT@@PAUPeriodicInfo@@@Z, _ComputeComet@@YGXPAVCSolarSystem@@PAUtagCOMET_INPUT@@PAUPeriodicInfo@@@Z, _ComputeLSTandJD@@YGXPAUWhenWhere@@PAN1@Z, _ComputeSolarSystem@@YGHPAVCSolarSystem@@PBD@Z, _CreateMinorPlFile@@YGHPAVCSolarSystem@@HPADN1@Z, _DateOfEaster@@YGXHPAUtagTDATE@@@Z, _DayOfWeek@@YGHN@Z, _DayOfYear@@YGHPAUtagTDATE@@@Z, _EqToHorizDegs@@YGXPAVCSolarSystem@@NNPAN1@Z, _EquinoxSolstice@@YGNHH@Z, _GeneralEclipseData@@YGHNPAN000@Z, _HorizToEqDegs@@YGXPAVCSolarSystem@@NNPAN1@Z, _IsDST@@YGHPAUtagTDATE@@D@Z, _JDToCalendar@@YGXNPAUtagTDATE@@D@Z, _MinorPlInputToPerInfo@@YGXPAVCSolarSystem@@PAUtagASTEROID_INPUT@@PAUPeriodicInfo@@@Z, _MoonPhase@@YGNJH@Z, _NextLunarEclipse@@YGNNHPAN00PAH@Z, _NextSolarEclipse@@YGNNPANPAH@Z, _Nutation2@@YGXNNNPAN0@Z, _Nutation@@YGXNNNPAN0@Z, _Precess@@YGXHNNPAN0@Z, _PrecessFK4@@YGXNNPAN0@Z, _PrecessFK5@@YGXNNPAN0@Z, _RiseSet@@YGXNNNNNNNNNNNPAN00PAH@Z, _SiderealTime0@@YGNN@Z, _SiderealTime@@YGNN@Z, _StaticRiseSet@@YGXPAVCSolarSystem@@NNPAN11PAH@Z, _ssGetDllVersion@@YGHXZ

RDS...: NSRL Reference Data Set

-

sigcheck:

publisher....: n/a

copyright....: n/a

product......: n/a

description..: n/a

original name: n/a

internal name: n/a

file version.: n/a

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

trid..: Win32 Executable MS Visual C++ (generic) (65.2%)

Win32 Executable Generic (14.7%)

Win32 Dynamic Link Library (generic) (13.1%)

Generic Win/DOS Executable (3.4%)

DOS Executable Generic (3.4%)

pdfid.: -

[hxin]

I tried uploading ss32.dll several times to wikisend and always got 0% progress and then it would error out. I even registered there - no difference.

 

I did scan that file with FIVE other security programs and it passed each one. Those programs were AVG, Glary, ASC, Malwarebytes and Spybot - all the latest versions. I have no reason to believe ss32.dll is a threat. Seems 360 is wrong on this one.

 

If you have another place I can upload it too, I will try. Wikisend didn't work for me...

 

 

OK, I uploaded to virus tool and there is the report:

 

File SS32.dll received on 2010.07.20 04:42:39 (UTC)

Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED

Result: 0/42 (0%)

 

Additional information

File size: 114688 bytes

MD5...: 44c0e0838c0b2bfb9c4fdd588c569b94

SHA1..: 7eaffa07248682cd4263adceb1f1ebcb0850739f

SHA256: ac452ca1569995e056b3774fa61ff62d265b8ebe409951c55ca57e75977aafca

ssdeep: 1536:NAbi9gE5URSRTy4HsOo95rGybk2nhTERTyo9CV7JGe7LqE2n3bo:diRSZb+

K9+HmEG3bo

PEiD..: -

PEInfo: PE Structure information

 

( base data )

entrypointaddress.: 0x945a

timedatestamp.....: 0x38baa0af (Mon Feb 28 16:22:07 2000)

machinetype.......: 0x14c (I386)

 

( 4 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x10492 0x11000 6.61 c4fe15eda30aa6c152d6b896f66ae560

.rdata 0x12000 0x5193 0x6000 5.02 901228882a1f3731745e830f142ace31

.data 0x18000 0x344c 0x2000 2.48 c6c45949b6853f888abb419ac99b5ef9

.reloc 0x1c000 0x1980 0x2000 4.60 7d3bdb929346fdad2a13be0510757841

 

( 1 imports )

> KERNEL32.dll: HeapDestroy, GetCommandLineA, GetVersion, GetProcAddress, GetModuleHandleA, RaiseException, EnterCriticalSection, LeaveCriticalSection, HeapFree, GetLastError, CloseHandle, ReadFile, InitializeCriticalSection, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, SetFilePointer, WriteFile, ExitProcess, TerminateProcess, GetCurrentProcess, GetCurrentThreadId, TlsSetValue, TlsAlloc, TlsFree, SetLastError, TlsGetValue, GetModuleFileNameA, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStrings, GetEnvironmentStringsW, lstrcpyA, HeapCreate, VirtualFree, InterlockedDecrement, InterlockedIncrement, HeapAlloc, VirtualAlloc, HeapReAlloc, SetStdHandle, FlushFileBuffers, CreateFileA, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, GetCPInfo, GetACP, GetOEMCP, LoadLibraryA, LCMapStringA, LCMapStringW, SetEndOfFile, RtlUnwind

 

( 31 exports )

_Aberr2@@YGXPAVCSolarSystem@@PAN1@Z, _AtmRefraction@@YGNN@Z, _CalendarToJD@@YGNPAUtagTDATE@@@Z, _ComputeAsteroid@@YGXPAVCSolarSystem@@PAUtagASTEROID_INPUT@@PAUPeriodicInfo@@@Z, _ComputeComet@@YGXPAVCSolarSystem@@PAUtagCOMET_INPUT@@PAUPeriodicInfo@@@Z, _ComputeLSTandJD@@YGXPAUWhenWhere@@PAN1@Z, _ComputeSolarSystem@@YGHPAVCSolarSystem@@PBD@Z, _CreateMinorPlFile@@YGHPAVCSolarSystem@@HPADN1@Z, _DateOfEaster@@YGXHPAUtagTDATE@@@Z, _DayOfWeek@@YGHN@Z, _DayOfYear@@YGHPAUtagTDATE@@@Z, _EqToHorizDegs@@YGXPAVCSolarSystem@@NNPAN1@Z, _EquinoxSolstice@@YGNHH@Z, _GeneralEclipseData@@YGHNPAN000@Z, _HorizToEqDegs@@YGXPAVCSolarSystem@@NNPAN1@Z, _IsDST@@YGHPAUtagTDATE@@D@Z, _JDToCalendar@@YGXNPAUtagTDATE@@D@Z, _MinorPlInputToPerInfo@@YGXPAVCSolarSystem@@PAUtagASTEROID_INPUT@@PAUPeriodicInfo@@@Z, _MoonPhase@@YGNJH@Z, _NextLunarEclipse@@YGNNHPAN00PAH@Z, _NextSolarEclipse@@YGNNPANPAH@Z, _Nutation2@@YGXNNNPAN0@Z, _Nutation@@YGXNNNPAN0@Z, _Precess@@YGXHNNPAN0@Z, _PrecessFK4@@YGXNNPAN0@Z, _PrecessFK5@@YGXNNPAN0@Z, _RiseSet@@YGXNNNNNNNNNNNPAN00PAH@Z, _SiderealTime0@@YGNN@Z, _SiderealTime@@YGNN@Z, _StaticRiseSet@@YGXPAVCSolarSystem@@NNPAN11PAH@Z, _ssGetDllVersion@@YGHXZ

RDS...: NSRL Reference Data Set

-

sigcheck:

publisher....: n/a

copyright....: n/a

product......: n/a

description..: n/a

original name: n/a

internal name: n/a

file version.: n/a

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

trid..: Win32 Executable MS Visual C++ (generic) (65.2%)

Win32 Executable Generic (14.7%)

Win32 Dynamic Link Library (generic) (13.1%)

Generic Win/DOS Executable (3.4%)

DOS Executable Generic (3.4%)

pdfid.: -

 

Hi johnalan

 

OK， it's a false positive.

We will solve this issue in our later update definition 1700.

 

PS: http://www.2shared.com can upload files.

 

cheers!

[mhilbrink]

Trojan embedded in IOBit Toolbar installation?

 

Before reporting a false positive, please save a scan report first and post it here. This will help us know the detailed information about the scan result.

 

Hi, I just installed ASC, based on PC World's recommendation, but got an error during the IOBit toolbar installation process:

 

Ad-Watch (part of Ad-Aware) blocked the installation, saying it detected "Trojan.Win32.Generic!BT"

 

Is this a false positive or a real one?

 

I'm concerned 'cuz I really WANT to use ASC, but not of it's infected...

 

Thanks!

 

Mark H.

[Cicely]

Hi Mark,

 

Thank you for your information.

 

Actually, this toolbar is from our partner. We will contact them to have this issue resolved.

 

This toolbar will provide you access to IObit programs easily from the browser. So you can allow this action and still able to use ASC.

[italianbabii]

IObit Security 360

 

OS:Windows 7

Version:1.4.1.11

Define Version:1611

Time Elapsed:00:03:01

Objects Scanned:47693

Threats Found:1

 

|Name|Type|Description|ID|

Tracking Cookies - Removed, Cookies, Cookie:allison@at.atwola.com/, 7-1653

[enoskype]

Hi italianbabii,

 

First, please update your database, as of now it is 1707.

 

Follow the procedure below:

 

-Go to Internet Options,

-Click the Privacy tab, click the Website button or Edit button in Website group box.

-In the Website box, enter Atwola.com and click Reject button to add this website to block lists.

-Click Ok button to save the changes.

-Open the file "C:\Windows\system32\drivers\etc\hosts" with a text editor program.

-Add the following lines to the end of the text file.

 

127.0.0.1 ar1. atwola .com

127.0.0.1 ar2. atwola .com

127.0.0.1 ar3. atwola .com

127.0.0.1 ar4. atwola .com

127.0.0.1 ar5. atwola .com

127.0.0.1 ar6. atwola .com

127.0.0.1 ar7. atwola .com

127.0.0.1 ar8. atwola .com

127.0.0.1 ar9. atwola .com

 

-Save and close the file.

-Reboot your computer

 

Cheers.

[Christopher Fisher]

False positive - System Mechanic Professional [sOLVED by db 1708]

 

IObit Security 360

 

OS:Windows XP

Version:1.4.5.67

Define Version:1707

Time Elapsed:00:00:04

Objects Scanned:27

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Agent, File, C:\Program Files\iolo\Common\Lib\Antila.dll, 12-186

[hxin]

IObit Security 360

 

OS:Windows XP

Version:1.4.5.67

Define Version:1707

Time Elapsed:00:00:04

Objects Scanned:27

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Agent, File, C:\Program Files\iolo\Common\Lib\Antila.dll, 12-186

 

Hi Christopher Fisher

 

This is a FP.

We will solve this issue in our later update definition 1708.

 

Thank you for your feedback.

[italianbabii]

Hi italianbabii,

 

First, please update your database, as of now it is 1707.

 

Follow the procedure below:

 

-Go to Internet Options,

-Click the Privacy tab, click the Website button or Edit button in Website group box.

-In the Website box, enter Atwola.com and click Reject button to add this website to block lists.

-Click Ok button to save the changes.

-Open the file "C:\Windows\system32\drivers\etc\hosts" with a text editor program.

-Add the following lines to the end of the text file.

 

127.0.0.1 ar1. atwola .com

127.0.0.1 ar2. atwola .com

127.0.0.1 ar3. atwola .com

127.0.0.1 ar4. atwola .com

127.0.0.1 ar5. atwola .com

127.0.0.1 ar6. atwola .com

127.0.0.1 ar7. atwola .com

127.0.0.1 ar8. atwola .com

127.0.0.1 ar9. atwola .com

 

-Save and close the file.

-Reboot your computer

 

Cheers.

IObit Security 360

 

OS:Windows 7

Version:1.4.5.67

Define Version:1707

Time Elapsed:01:27:21

Objects Scanned:123261

Threats Found:1

 

|Name|Type|Description|ID|

Tracking Cookies - Removed, Cookies, Cookie:allison@at.atwola.com/, 7-1653

_________________________________________________________________

 

 

IS THIS HOW I WAS SUPPORT TO DO IT

 

# Copyright © 1993-2009 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

 

# localhost name resolution is handled within DNS itself.

# 127.0.0.1 localhost

# ::1 localhost

 

127.0.0.1 ar1. atwola .com

127.0.0.1 ar2. atwola .com

127.0.0.1 ar3. atwola .com

127.0.0.1 ar4. atwola .com

127.0.0.1 ar5. atwola .com

127.0.0.1 ar6. atwola .com

127.0.0.1 ar7. atwola .com

127.0.0.1 ar8. atwola .com

127.0.0.1 ar9. atwola .com

[enoskype]

Sorry italianbabii my fault, the addresses should not contain spaces, only space is after 127.0.0.1 and ::1

There should not be # sign before 127.0.0.1 local host and ::1 localhost

 

EXAMPLE:

 

# Copyright © 1993-2009 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

 

127.0.0.1 localhost

::1 localhost

127.0.0.1 ar1.atwola.com

127.0.0.1 ar2.atwola.com

127.0.0.1 ar3.atwola.com

127.0.0.1 ar4.atwola.com

127.0.0.1 ar5.atwola.com

127.0.0.1 ar6.atwola.com

127.0.0.1 ar7.atwola.com

127.0.0.1 ar8.atwola.com

127.0.0.1 ar9.atwola.com

 

 

 

 

 

Cheers.

[italianbabii]

Sorry italianbabii my fault, the addresses should not contain spaces, only space is after 127.0.0.1 and ::1

There should not be # sign before 127.0.0.1 local host and ::1 localhost

 

EXAMPLE:

 

# Copyright © 1993-2009 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

 

127.0.0.1 localhost

::1 localhost

127.0.0.1 ar1.atwola.com

127.0.0.1 ar2.atwola.com

127.0.0.1 ar3.atwola.com

127.0.0.1 ar4.atwola.com

127.0.0.1 ar5.atwola.com

127.0.0.1 ar6.atwola.com

127.0.0.1 ar7.atwola.com

127.0.0.1 ar8.atwola.com

127.0.0.1 ar9.atwola.com

 

 

 

 

 

Cheers.

 

it still didn't work

[enoskype]

Hi italianbabii,

 

Try to include at.atwola.com , glb-at.atwola.adtechus.com, Uk.at.atwola.com, tacoda.at.atwola.com, fr.at.atwola.com, cdn.at.atwola.com and de.at.atwola.com.

 

Do you have any toolbar conserning AOL?

If yes, then uninstalling it may end the problem.

 

Please also try the below procedure.

 

To block atwola.com cookie in Internet Explorer

-From the Tools menu of Internet Explorer, select Internet Options

-Select the Privacy tab, and then click Sites. The Per site privacy actions window will be displayed

-In the Per site privacy actions window, enter atwola.com and at.atwola.com in the Address of Web site field

-Click Block

 

To block atwola.com cookie in Mozilla Firefox

-From the Tools menu, select Options

-In the upper section of the Options window, click Privacy

-In the Cookies tab, click Exceptions

-In the new Exceptions - Cookies window, enter atwola.com in the Address of Website field and click Disable

-Repeat for at.atwola.com

 

Cheers.

[Sillus]

Malware Defender.lnk False Positive [will be SOLVED by db 1717]

 

IObit Security 360

 

OS:Windows 7

Version:1.4.5.67

Definir Version:1716

Tiempo Transcurrido:00:02:41

Objetos Analizados:54355

Amenazas Encontradas:1

 

|Nombre|Tipo|Descripción|ID|

Misleading.Application, File, C:\Users\Public\Desktop\Malware Defender.lnk, 4-1297

 

 

I have downloaded Malware Defender from www.360.cn

 

Malware defender scan at Virustotal

 

Thx

[enoskype]

Hi Sillus,

 

Please have a lok at HERE.

You can search it in Google, and in many security web sites this program is said to be rogue and "how to get rid of it" instructions are given.

 

Cheers.