DPGHnt.dll False Positive?

[Bob L]

I have IOBit Security 360 v1.50 runs repeatedly finding: Trojan.Dropper, File, C:\Program Files\Microsoft Intellitype Pro\Components\Commands\DPGHnt\DPGHnt.dll, 12-984. When I take the remove option it comes back with "1 threat removed" - but a repeat run finds the exact same threat... all this with the computer disconnected from the net.

 

Next attempt was to run McAfee utility "Stinger" at highest sensitivity. This runs successfully - but does not appear to flag any problems. Follow up with a IOBit Security 360 v1.50 scan - this also shows no threats. A second run of IOBit Security 360 v1.50 scan identifies the original threat again. Can you explain what is happening - is it possible that running the scan is responsible for reintroducing the threat?

[hxin]

I have IOBit Security 360 v1.50 runs repeatedly finding: Trojan.Dropper, File, C:\Program Files\Microsoft Intellitype Pro\Components\Commands\DPGHnt\DPGHnt.dll, 12-984. When I take the remove option it comes back with "1 threat removed" - but a repeat run finds the exact same threat... all this with the computer disconnected from the net.

 

Next attempt was to run McAfee utility "Stinger" at highest sensitivity. This runs successfully - but does not appear to flag any problems. Follow up with a IOBit Security 360 v1.50 scan - this also shows no threats. A second run of IOBit Security 360 v1.50 scan identifies the original threat again. Can you explain what is happening - is it possible that running the scan is responsible for reintroducing the threat?

 

Dear Bob L，

 

Thanks for your feedback.

 

Firstly, after scanning, please save a report of the scanning result and send to us.

 

Secondly, you can upload or send us your suspicious file, and then we can further investigate it. At the same time, you can upload your suspicious file to http://www.virustotal.com for analyzing, and post your analysis report.

 

We are looking forward to your reply.

[Bob L]

DPGHnt.dll positive

 

I have uploaded four files - DPGHnt.dll after a computer restart - and a version after it had been flagged as containing a threat - and the threat had been "removed". A subsequent scan showed that there was still a detected threat with that file.

 

I have also enclosed two scan reports.

 

My sequence was:

1. Same sequence as 1-5 below - except scan showed three threats - however - the first two may have been related to having copies of DPGHnt.dll file ready for analysis that I'd deleted - so possibly in the bin system. (IObit Security 360 Report Sept 17th 2010). Removed threats - and then:

 

1. Reboot

2. Copied DPGHnt.dll file

3. Ran full McAfee virus scan (no issues detected)

4. Ran Stinger (anti malware) - All files clean

5. Ran Security 360 "Full Scan" - "Very High" sensitivity - 1 threat identified (IObit Security 360 Report Sept 17th 2010 #2)

6. "Removed" threat

7. Made second copy of DPGHnt.dll file

8. Re-ran Security 360 "Full Scan" - "Very High" sensitivity - 1 threat identified again.

 

Finally - re earlier post - this problem only shows in "Full Scan" from the "Scan" tab - I had previously run the first scan using the "Scan now" option from the "Overview" tab - which I believe is "Smart scan" - quick - which never identifies this threat - and the second using the full scan - so they were different scans where one finds the threat and one does not. Trust this is what you need - your help is appreciated.

[wozofoz]

Guidelines and Requirements for Reporting a False Positive

 

Welcome to the forum Bob L :smile:

 

Firstly, after scanning, please save a report of the scanning result and send to us.

 

Secondly, you can upload or send us your suspicious file, and then we can further investigate it. At the same time, you can upload your suspicious file to http://www.virustotal.com for analyzing, and post your analysis report.

 

For information and screenshots of this procedure, please see the thread Guidelines and Requirements for Reporting a False Positive

 

All the best, woz of oz

[hxin]

Welcome to the forum Bob L :smile:

 

 

 

For information and screenshots of this procedure, please see the thread Guidelines and Requirements for Reporting a False Positive

 

All the best, woz of oz

 

Thanks!:razz: