Jump to content
IObit Forum
Top Free Driver Updater Tools Best 25 PC Optimization Software Best 22 Antimalware Best 22 Uninstaller Software IObit Coupons & Discount Offers PC Optimizer Mac Boost Advice IObit Coupons A Good Utility Program From IObit IObit Promo Codes IObit Coupon Codes IObit Coupons and Deals FAQs Driver Booster Pro Review

Trojan.Sdbot & Trojan.Agent FP?? [SOLVED]

Darkmore

Recommended Posts

Darkmore Newbie

Darkmore

Posted
Posted

Carrying out a scan with IOBit360 v.4.0(Free) it came up with a couple of infections.(see reports inc. HijackThis).My question being, are therse false positives??As recent scans with my NIS 2009 and Windows Defender have failed to produce anything.Appreciate some help.

 

IObit Security 360

 

OS:Windows Vista

Version:1.4.1.11

Define Version:1330

Time Elapsed:00:03:41

Objects Scanned:48463

Threats Found:2

 

|Name|Type|Description|ID|

Trojan.Agent, File, C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe, 12-912

Trojan.SdBot, File, C:\Windows\system32\SynTPCo4.dll, 12-1695

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 02:22:56, on 23/02/2010

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18882)

Boot mode: Normal

 

Running processes:

C:\Program Files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Launch Manager\LManager.exe

C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Acer\Empowering Technology\NotificationCenter\Framework.NotificationCenter.exe

C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE

C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Windows\system32\SearchFilterHost.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com/?fr=fp-yie8

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=1008&m=aspire_5535

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=1008&m=aspire_5535

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.8.0.41\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.8.0.41\IPSBHO.DLL

O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll

O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.8.0.41\coIEPlg.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [skytel] Skytel.exe

O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe

O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe

O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"

O4 - HKLM\..\Run: [MobileConnect] %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [Google Update] "C:\Users\robcameron\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [DynAdvance Notifier] C:\Program Files\DynAdvance\DynAdvance Notifier\MailNotifier.Exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Startup: OneNote Table Of Contents.onetoc2

O4 - Startup: Update Notifier.lnk = C:\Program Files\Update Notifier\updatenotifier.exe

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.8.0.41\coIEPlg.dll

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe

O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe

O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

O23 - Service: Google Desktop Manager 5.9.909.30391 (GoogleDesktopManager-093009-130223) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Update Service (gupdate1c9b6b23e9c828c) (gupdate1c9b6b23e9c828c) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe

O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe

O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe

O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

 

--

End of file - 8535 bytes

yowanvista Newbie

yowanvista

Posted
Posted

False Positive

 

I360 is detecting harmless MS components as Trojans.

 

IObit Security 360

 

OS:Windows 7

Version:1.4.1.11

Define Version:1330

Time Elapsed:00:02:01

Objects Scanned:46525

Threats Found:2

 

|Name|Type|Description|ID|

Trojan.Agent, File, C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe, 12-912

Trojan.SdBot, File, C:\Windows\system32\OpenAL32.dll, 12-1697

 

 

Also scanned with Virustotal.com, no malware found

John Widger Newbie

John Widger

Posted
Posted

False positives?

 

IObit Security 360

 

OS:Windows 7

Version:1.4.0.11

Define Version:1330

Time Elapsed:00:42:28

Objects Scanned:57935

Threats Found:5

 

|Name|Type|Description|ID|

Tracking Cookies - Removed, Cookies, Cookie:john@quantserve.com/, 7-2075

Trojan.SdBot, File, C:\Program Files\Microsoft Money\System\mnyolinv.dll, 12-1695

Trojan.Agent - Quarantined, File, C:\Windows\winsxs\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_6.1.7600.16385_none_ba476986f05abc65\cvtres.exe, 12-912

Trojan.IRCBot, File, C:\Program Files\Microsoft Office\Office12\1033\OISINTL.DLL, 12-1724

Trojan.Agent, File, C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe, 12-912

 

The ones in bold appear to be part of MS apps and I don't believe they should be reported. Not identified by Kaspersky, Returnil or Malwarebytes

rhundley5 Newbie

rhundley5

Posted
Posted

False Postive

 

IObit Security 360

 

OS:Windows 7

Version:1.4.1.11

Define Version:1330

Time Elapsed:00:01:13

Objects Scanned:46470

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Agent, File, C:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe, 12-912

Process Hacker Newbie

Process Hacker

Posted
Posted

Process Hacker

 

C:\Windows\Microsoft.NET\Framework\v2.0.50727

 

-----------------------------------------------------------------------------------

IObit Security 360

 

OS:Windows Vista

Version:1.4.0.11

Define Version:1330

Time Elapsed:00:03:07

Objects Scanned:46860

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Agent, File, C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe, 12-912

 

-----------------------------------------------------------------------------------

... a false positive ?????

LesBater Newbie

LesBater

Posted
Posted

False Positive on file cvtres.exe

 

After updating the database dated 2/25/2010 I now get an threat indicating a Trojan Agent. The file in question is cvtres.exe which has been on my system since 3/29/2009. This is under the folder Microsoft.net.

 

I have run other anti virus programs/malware/spyware and not one of them indicated that this file was bad.

 

What up?

rcamen Newbie

rcamen

Posted
Posted

Is this a false Positive

 

IObit Security 360

 

OS:Windows Vista

Version:1.4.0.11

Define Version:1330

Time Elapsed:00:02:50

Objects Scanned:47343

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Agent, File, C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe, 12-912

hxin Newbie

hxin

Posted
Posted

Hello guys

 

Thanks for your feedback.

Please upload or send us your suspicious file, and then we can further investigate it. At the same time, you can upload your suspicious file to http://www.virustotal.com for analyzing, and post your analysis report.

 

We are looking forward to your reply.

hxin Newbie

hxin

Posted
Posted

hello guys update please

 

This issue has been resolved in version 1332, please update.Then if you have questions,tell us.

thanks for your feedback.

  • 2 months later...
inspectorweb Newbie

inspectorweb

Posted
Posted

My suggestion. Download and install AnVir Task Manager. It also has free version. AnVir shows you all startup programs and Windows processes, so you’ll find harmful file within one minute. IMHO it’s the best such tool among other similar tools. Sorry for the offtopic.

enoskype Newbie

enoskype

Posted
Posted

Hi inspectorweb,

 

What has AnVir Task Manager got to do with the topic?

 

Although you say it is off topic, but it is false posititives that are discussed here.

 

I have delinked your link.

 

This is your first and last warning.

 

Cheers.

Archived

This topic is now archived and is closed to further replies.

Go to topic listing
×
×
  • Create New...