Trojans

[Ted]

My spyware cleaners never find anything, but this morning IOBit Security 360 popped up these 10 threats after its routine scan. Where did they come from? Needless to say I let IOBit Security 360 zap them.

[333halfevil]

Those detections could be from a recent update, but you are lucky as those are only traces from an infection (which means you are quite safe).

[Ted]

Phew! Thanks for that, 333halfevil.

[atailor1]

Why Do I Get the Identical Scan

 

IObit Security 360

 

OS:Windows XP

Version:1.0.1.30

Define Version:1211

Time Elapsed:00:08:42

Objects Scanned:69724

Threats Found:11

 

|Name|Type|Description|ID|

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{3831331e-0d11-4716-871d-68f3b11d23c9}, 5-12133

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{3dcd2bc5-8489-48ae-891f-90c8b2f19f56}, 5-12134

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{52c01a76-19e2-4a50-ae8a-38ffbccf9182}, 5-12135

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{762ec429-1a5d-4ab8-844a-9a552e1241da}, 5-12136

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{a506ef88-9efc-4522-bfe1-a8e886a64d80}, 5-12137

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{b87799af-2ce9-4daa-93cf-65f002035369}, 5-12138

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{bbc73c94-337c-43cc-b52c-31eb9fa34013}, 5-12139

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{c406f816-318d-4f7d-81cb-ba93ca7b70d5}, 5-12140

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{d502d4a3-03e6-4eae-a14e-69606ca63430}, 5-12141

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{ec22770d-3343-4c56-8a8d-3e560475f655}, 5-12142

Spy.Matles.A, File, C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe, 12-2077

ONLY EXCEPTION IS LAST ENTRY, CANON SOFTWARE WITH CAMERA PURCHASE

[blackcat77]

Same here -- two different computers, same scan results on each and identical to the ones posted above.

[Ted]

Hi atailor1 and blackcat7,

 

Another strange thing, I have "Quarantine Threats" ticked, but those listed threats haven't been quarantined. How about yours?

[wozofoz]

Me too, this is my report from about one hour ago.

I have only ever had one Trojan reported in the past.

 

 

IObit Security 360

 

OS:Windows XP

Version:1.0.1.30

Define Version:1211

Time Elapsed:00:13:41

Objects Scanned:65552

Threats Found:10

 

|Name|Type|Description|ID|

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{3831331e-0d11-4716-871d-68f3b11d23c9}, 5-12133

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{3dcd2bc5-8489-48ae-891f-90c8b2f19f56}, 5-12134

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{52c01a76-19e2-4a50-ae8a-38ffbccf9182}, 5-12135

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{762ec429-1a5d-4ab8-844a-9a552e1241da}, 5-12136

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{a506ef88-9efc-4522-bfe1-a8e886a64d80}, 5-12137

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{b87799af-2ce9-4daa-93cf-65f002035369}, 5-12138

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{bbc73c94-337c-43cc-b52c-31eb9fa34013}, 5-12139

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{c406f816-318d-4f7d-81cb-ba93ca7b70d5}, 5-12140

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{d502d4a3-03e6-4eae-a14e-69606ca63430}, 5-12141

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{ec22770d-3343-4c56-8a8d-3e560475f655}, 5-12142

 

 

All the best, woz of oz

[wozofoz]

Hi atailor1 and blackcat7,

 

Another strange thing, I have "Quarantine Threats" ticked, but those listed threats haven't been quarantined. How about yours?

 

Mine have not been quarantined they were deleted but from my experience Registry items have never been quarantined (saved) only deleted.

I just assumed it was standard procedure

 

All the best, woz of oz

[pascalg]

Trojan Agent

 

iOBit 360 found 10 "Trojan Agent" Register entries. I have Comodo and Windows Defender, and no one shows this. It is a false positive?

 

Thanks

:?:

 

See the attached image and files.

 

IObit Security 360

 

OS:Windows Vista

Version:1.0.1.30

Define Version:1211

Time Elapsed:00:05:55

Objects Scanned:61248

Threats Found:10

 

|Name|Type|Description|ID|

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{3831331e-0d11-4716-871d-68f3b11d23c9}, 5-12133

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{3dcd2bc5-8489-48ae-891f-90c8b2f19f56}, 5-12134

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{52c01a76-19e2-4a50-ae8a-38ffbccf9182}, 5-12135

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{762ec429-1a5d-4ab8-844a-9a552e1241da}, 5-12136

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{a506ef88-9efc-4522-bfe1-a8e886a64d80}, 5-12137

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{b87799af-2ce9-4daa-93cf-65f002035369}, 5-12138

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{bbc73c94-337c-43cc-b52c-31eb9fa34013}, 5-12139

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{c406f816-318d-4f7d-81cb-ba93ca7b70d5}, 5-12140

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{d502d4a3-03e6-4eae-a14e-69606ca63430}, 5-12141

Trojan.Agent, Registry Key, HKEY_CLASSES_ROOT\CLSID\{ec22770d-3343-4c56-8a8d-3e560475f655}, 5-12142

[robkay]

I had been having strange problems with my computer for a month or so, primarily programs in my system tray failing to respond after a period of time and a slight system slow down. I ran a number of different deep scanning applications to look for malware and nothing significant turned up. Someone on another forum suggested iobit and Malwarebytes.

 

Iobit turned up trojan.agent and quarantined a file named reset.cmd. What is this file? Is it OK to let iobit delete it? Is it a critical file that I should restore form somewhere?

 

I then ran Malwarebytes which reported on a couple registry items and file Install.exe infected with trojan.agent. I let Malwarebytes "Fix" them.

 

After a reboot I find that my system appears to be back to normal. Performance is excellent and the programs in the system tray that would stop responding after a while behave normally now.

 

I think the trojan.agent was the problem.

 

BTW, I'm really impressed with Iobit. I just leave the real-time protection running along with Bitdefender and all is good. I don't notice any impact on performance at all--and my machine is only a 2.5 GHz Celeron with 512 ram.

 

Thanks.

[Leeman]

Same errors??

 

Hi Pascalg and all,

 

When I ran a scan this morning I received the same 10 Trojan.agent entries in my registry too. I only noticed, since the last 5 numbers on each line were near identlcal to those on mine. I am not at my computer right now,(I'm at work computer) but since I run a smart scan almost every day, until today my scans came up clean. Coincidence? Anyone else get these errors?

 

Lee

[wozofoz]

Reported in another thread

 

Same results reported in this thread

 

EDIT: Removed link as threads are now merged.

Good work mods :wink:

 

All the best, woz of oz

[atailor1]

Trojans

 

No quarantine here either, I didn't delete, as I thought it a little strange that Ted and I would have an identical scan. At this point am waiting for more information. Now I see that Woz and Blackcat also have the same scan. Hope somebody will come up with a good explanation, before I start deleting registry keys.

 

A.T.

[blackcat77]

Correct Ted.

 

And I forgot to add early this morning that on my laptop, the trojans appeared and I cleaned them, but when I manually updated the database, I immediately scanned again and they had returned.

 

But I just did a scan on this computer (after an automatic update) and did not get the trojans. Hopefully that means they've solved the problem.

[pascalg]

Hi A.T.

 

As my others AV do not detec it, I will not delete this Reg entries now, I will wait to see if the experts from IOBIT reply this. I read in this forum from an admin said that this is only "traces" of the infection (trash let behind after it is already deleted????).

 

Waiting for a reply from IOBIT.....

8)

 

Thanks

 

Pascal

 

 

No quarantine here either, I didn't delete, as I thought it a little strange that Ted and I would have an identical scan. At this point am waiting for more information. Now I see that Woz and Blackcat also have the same scan. Hope somebody will come up with a good explanation, before I start deleting registry keys.

 

A.T.

[pascalg]

What is the recomended action? Wait for IOBIT response?

 

I am not inclined to delete a Register entry, without further re-confirmation...

 

Thanks

 

Pascal

 

Hi Pascalg and all,

 

When I ran a scan this morning I received the same 10 Trojan.agent entries in my registry too. I only noticed, since the last 5 numbers on each line were near identlcal to those on mine. I am not at my computer right now,(I'm at work computer) but since I run a smart scan almost every day, until today my scans came up clean. Coincidence? Anyone else get these errors?

 

Lee

[enoskype]

OK everybody,

 

Please go to spyware library: http://www.spywarelib.com/ site and search for check each one and see the results.

 

When searching, use the format as below:

Example:

{3831331e-0d11-4716-871d-68f3b11d23c9}

 

Cheers.

[atailor1]

Trojans Update

 

Hi All

 

First of all thank you Enoskype for the information, I immediately went and checked out the list that I had reported, and all were some type of spyware/adware. Now the fun part, went back and rescaned with 360 and this time I only had the reference to the Canon Software (Easy Photo Print) which I had installed when I purchased my new camera a year ago. The others had all gone away (where'd they go)?? At the spywarelib.com site, there was an add for Advanced System Protector with a link to cnet for a download to remove the infections, so I said what the hell, I'll run it and see how it compares to 360. After down load I scanned with 360, malwarebytes and avast before installing. Before install I ran 360, malwarebytes, crap cleaner and advanced system care just to have a clean starting point. Took Advanced System Protector approximately 35mins to complete a full scan and reported no sign of infection, not even the Canon reference that 360, is still reporting. Sorry for being so long winded. It all comes down to why are we all getting the same scan for same malware?, in my case if I didn't delete them, where did they go? As some of you know, I've been an Iobit fan almost from the beginning, and this not meant to be negative, I'm just one those folks who when they see something out of the ordinary, goes "hmmmm??" Enough from me, everybody have good evening/day.

 

A.T.

[enoskype]

Hi A.T.,

 

These were seen as malware by MBAM also for a while ago, but I think, either they are taken out of IS 360's database, or there were values which were not default in the registery of the PCs that, IS 360 has shown as malware, but the first is more probable, as I have those entries in my registry and have the values as below shown as default:

 

SkinRadio Object

SkinForm Object

SkinFrame Object

SkinPlasma Object

SkinTab Object

SkinMiscControls Object

SkinFreeForm Object

SkinStatic Object

SkinScrollBar Object

SkinButton Object

 

with respect to same order.

 

Cheers.

[pascalg]

Just in time, I have made another scan with Iobit360 today, and even if I do no have deleted the keys, the new scan do not show the problem again. Who have fixed the problem? Iobit, Comodo or Windows Defender? I do not know.

[poppetdk]

Spy.Matles.A

 

I tog a scan 5 minuttes ago and this "Spy.Matles.A" came up, can i just delete it or does anyone know it, its my printers uninstall file that are infected, that sounds weird to me.

[enoskype]

Hi poppetdk,

 

Please post the Report, so IObit can have a look at it.

 

It is also a good idea to upload that file to VirusTotal and post the result here.

 

Cheers.

[atailor1]

Spy.Matles.A

 

Hi Enoskype

 

Looks like the above does not want to go away. My original post (4) shows Spy.Matles.A in the last item for my Canon camera software. Based on your responses in posts (17 & 19) I can only assume that this is a false positive and something that IObit needs to take a closer look at.

 

A.T.

[enoskype]

Hi A.T.,

 

I think, that uninstall file, when used, connect to the web site and ask you why you have chosen to uninstall the software, etc..

 

I would put it in the ignore list until the need to unistall the Cannon software arises, if you ever need to uninstall anyway. And, it is not a bad idea to check that uninstall file in VirusTotal also.

 

IObit should have a look to that file too.

 

Cheers.

[cherylann402]

Spy.Martles. A

 

I've been showing the spy.matles.a warning as well attached to my genealogy file. If I quarantine this file I will no longer be able to access it & that is unacceptable as I have over 22,000 name in my file. How can I clear this infection? I submitted this file to virus total. It said 0/41(0%) does that mean it is not there & is false. I am getting a new tower & do not want to transfer an infected file. Is this a real threat or bogus. I went back to virus total & scanned the file this was supposedly in & still nothing shows up.