Buffalo Posted February 4, 2009 ID:53453 Share Posted February 4, 2009 During the extra and hueristics scan, Winnit\System32\internat.exe is found as a Trojan Agent in my Win2000Pro SP4 system.It is a MS file dated 1999 and it is a Keyboard Language IndicatorApplet, version 5.0.2920.0.The log is:Malwarebytes' Anti-Malware 1.33Database version: 1725Windows 5.0.2195 Service Pack 42/4/2009 9:00:50 AMmbam-log-2009-02-04 (09-00-50).txtScan type: Quick ScanObjects scanned: 45818Time elapsed: 1 minute(s), 27 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:I:\WINNT\system32\internat.exe (Trojan.Agent) -> Not selected for removal. [3857535134305383807566791534727079851301422761564247475361849084857078201961747985708379668515708970] Link to post Share on other sites More sharing options...
myez Posted February 4, 2009 ID:53467 Share Posted February 4, 2009 During the extra and hueristics scan, Winnit\System32\internat.exe is found as a Trojan Agent in my Win2000Pro SP4 system.It is a MS file dated 1999 and it is a Keyboard Language IndicatorApplet, version 5.0.2920.0.The log is:Malwarebytes' Anti-Malware 1.33Database version: 1725Windows 5.0.2195 Service Pack 42/4/2009 9:00:50 AMmbam-log-2009-02-04 (09-00-50).txtScan type: Quick ScanObjects scanned: 45818Time elapsed: 1 minute(s), 27 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:I:\WINNT\system32\internat.exe (Trojan.Agent) -> Not selected for removal. [3857535134305383807566791534727079851301422761564247475361849084857078201961747985708379668515708970]Got the same thing today. Did an online analysis with jotti and virustotal - file was found not infected. Emailed the zipped file to MB. Waiting for their response. Link to post Share on other sites More sharing options...
iDiaz Posted February 4, 2009 ID:53495 Share Posted February 4, 2009 It showed up on my boss' computer, as well. I tried removing it, but it comes back the next time I scan, so I opened up c:\winnt\system32\ in Explorer and deleted internat.exe manually, but it respawns itself in a few seconds. I also tried overwriting it with a 0 byte text file named internat.exe and it overwrote it within a few seconds. AVG did not detect it. Here are some of its attributes:File Version: 5.0.2920.0Description: Keyboard Language Indicator AppletCopyright: Copyright © Microsoft Corp. 1994-1999Company Name: Microsoft CorporationInternal Name: INTERNATLanguage: English (United States)Original Filename: INTERNAT.EXEProduct Name: Microsoft® Windows ® 2000 Operating SystemProduct Version: 5.00.2920.0000Size: 20.2 KB (20,752 bytes)Size on disk: 24.0 KB (24,576 bytes)Created: Monday, July 14, 2003, 4:00:00 AMModified: Monday, July 14, 2003, 4:00:00 AMAccessed: Today, February 04, 2009, 11:09:02 AM Link to post Share on other sites More sharing options...
Buffalo Posted February 4, 2009 Author ID:53556 Share Posted February 4, 2009 It showed up on my boss' computer, as well. I tried removing it, but it comes back the next time I scan, so I opened up c:\winnt\system32\ in Explorer and deleted internat.exe manually, but it respawns itself in a few seconds. I also tried overwriting it with a 0 byte text file named internat.exe and it overwrote it within a few seconds. AVG did not detect it. Here are some of its attributes:File Version: 5.0.2920.0Description: Keyboard Language Indicator AppletCopyright: Copyright Link to post Share on other sites More sharing options...
iDiaz Posted February 5, 2009 ID:53571 Share Posted February 5, 2009 It is a valid file, as far as I can tell.Looks that way to me, too, but there's nothing stopping a good virus coder from replicating that information for their replacement file.Do not delete files like that unless you are sure they are really bad.You can Quarantine them if you wish, because that way you can easily put them back where they belong, if necessary.Yeah, I know. I just know this isn't an applet we use and we have other Windows 2000 Professional systems should I need to replace it, so I figured I'd delete it and restore it if necessary. Link to post Share on other sites More sharing options...
Raid Posted February 5, 2009 ID:53580 Share Posted February 5, 2009 Hello All.Sorry about this, our hueristics are hitting on a combination of things Trojan.Agent is known to take advantage of. Please select to ignore the file for the time being. Link to post Share on other sites More sharing options...
nosirrah Posted February 5, 2009 ID:53734 Share Posted February 5, 2009 This will be fixed in the next update . Link to post Share on other sites More sharing options...
Buffalo Posted February 5, 2009 Author ID:53767 Share Posted February 5, 2009 Hello All.Sorry about this, our hueristics are hitting on a combination of things Trojan.Agent is known to take advantage of. Please select to ignore the file for the time being.Database Version 1731 no longer picks it up. Thanks for the quick action.Buffalo Link to post Share on other sites More sharing options...
Ravenheart Posted February 16, 2009 ID:57116 Share Posted February 16, 2009 Database Version 1731 no longer picks it up. Thanks for the quick action.BuffaloIt is flagged for me in Database Version 1766 (internat.exe in Win2000 SP4). Link to post Share on other sites More sharing options...
nosirrah Posted February 16, 2009 ID:57140 Share Posted February 16, 2009 1767 will have an adjustment , I need to know if this resolves this issue .If it does noes not I need a scan log . Link to post Share on other sites More sharing options...
Ravenheart Posted February 16, 2009 ID:57141 Share Posted February 16, 2009 1767 will have an adjustment , I need to know if this resolves this issue .If it does noes not I need a scan log .Nosirrah, thanks--when/where should I look for that DV? Link to post Share on other sites More sharing options...
nosirrah Posted February 17, 2009 ID:57162 Share Posted February 17, 2009 Update and check now , it should be up for everyone . Link to post Share on other sites More sharing options...
Ravenheart Posted February 17, 2009 ID:57186 Share Posted February 17, 2009 Update and check now , it should be up for everyone .Okay, received 1768, no infected objects reported. Link to post Share on other sites More sharing options...
nosirrah Posted February 17, 2009 ID:57242 Share Posted February 17, 2009 Good , now I have the best of both worlds on this one . Link to post Share on other sites More sharing options...
fpfp Posted February 18, 2009 ID:57478 Share Posted February 18, 2009 I got this false positive with database version: 1773Here's the log file:Malwarebytes' Anti-Malware 1.34Database version: 1773Windows 5.0.2195 Service Pack 418.02.2009 11:32:46mbam-log-2009-02-18 (11-32-31).txtScan type: Quick ScanObjects scanned: 72081Time elapsed: 7 minute(s), 39 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 1Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\internat.exe (Trojan.Agent) -> No action taken. [38575351343041443858643654515138475364545238516152483953563451386146746883808480718561567479698088846136868383707985557083847480796151867993747985708379668515708970]Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\WINNT\system32\internat.exe (Trojan.Agent) -> No action taken. [38575351343041443858643654515138475364545238516152483953563451386146746883808480718561567479698088846136868383707985557083847480796151867993747985708379668515708970] Link to post Share on other sites More sharing options...
nosirrah Posted February 18, 2009 ID:57507 Share Posted February 18, 2009 I tweaked this even further , let me know if it is completely fixed now . Link to post Share on other sites More sharing options...
fpfp Posted February 19, 2009 ID:57810 Share Posted February 19, 2009 I tweaked this even further , let me know if it is completely fixed now .It seems to be OK now. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now