SVCHOST.exe Backdoor.Frauder ??? [SOLVED by db 1603]

[yuniverse]

I've been getting this detection in all the computers with iobit 360 installed.

Windows 7 Ultimate, 7 Professional, XP Pro

 

Backdoor.Frauder

C:\Windows\system32\svchost.exe

 

I opened the location of the file and scanned it with several other antivirus/malware program, but none can detect it. (BitDefender, MS Security Essentials, Adaware)

I can't even detect it when i try the svchost.exe file with 360. It just appears when it does a regular scan.

 

I'm worried that if i "remove" the file, the window might be corrupted.

 

Please help.

--------------------------------

IObit Security 360

 

OS:Windows 7

Version:1.4.1.11

Define Version:1602

Time Elapsed:00:02:54

Objects Scanned:47848

Threats Found:6

 

|Name|Type|Description|ID|

Tracking Cookies, Cookies, Cookie:yuniverse@atdmt.com/, 7-1541

Backdoor.Frauder, File, C:\Windows\system32\svchost.exe, 4-12487

 

This happens on all my computers with 360 installed (Windows 7, XP)

[enoskype]

Hi yuniverse,

 

It could be false positive, but please do not delete it.

 

Please follow the procedures in Guidelines and Requirements for Reporting a False Positive thread, and post the results here in this thread.

 

I have specificly tried and IS360 does not show svchost.exe (version: 5.1.2600.5512) 14 KB as a threat neither by normal scan, nor by single file scan.

 

It is important that you check the file by uploading to VirusTotal. All explained in the above link.

 

Cheers.

[yuniverse]

Backdoor.Frauder

 

IObit Security 360

 

OS:Windows 7

Version:1.4.1.11

Define Version:1602

Time Elapsed:00:02:54

Objects Scanned:47848

Threats Found:6

 

|Name|Type|Description|ID|

Tracking Cookies, Cookies, Cookie:yuniverse@atdmt.com/, 7-1541

Backdoor.Frauder, File, C:\Windows\system32\svchost.exe, 4-12487

 

 

VIRUS TOTAL RESULT: 1/40

analisis/121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2-1276177042

 

Thank you,

Yuniverse

[enoskype]

Give the link to VirusTotal report please.

 

Read the posts in the thread Guidelines and Requirements for Reporting a False Positive in my previous post.

Since there was one AV that found malware, the other procedures are also needed.

 

Cheers.

[yuniverse]

Oh, sorry, i didn't complete the link

 

 

http://www.virustotal.com/analisis/121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2-1276177042

 

 

i've attached the svchost.zip file with "infected" pw

svchost.zip