C:\ProgramData\NortonProtectionMemo (1).exe (Trojan.Lop.H)

[liviu.c]

I'm not a computer expert and would need some help, please.

I have the following mbam log below, which shows a file that might be infected: C:\ProgramData\NortonProtectionMemo (1).exe (Trojan.Lop.H)

The full Norton Internet Security scan did not show any threats.

A full SAS scan did not find any threats, either.

I've tried to search my computer for C:\ProgramData\NortonProtectionMemo , and I got a small (Microsoft Windows) message/window saying

"Norton Protection Memo has stopped working.

A problem caused the program to stop working correctly.

Windows will close the program and notify you if a solution is available".

NortonProtectionMemo (1).exe might be a duplicate of NortonProtectionMemo.exe, as I did restore some files from a Mozy backup.

But what is this file, actually?

And do I have the file infected with a trojan (Trojan.Lop.H) ?

What should I do?

Thankfully,

Liviu

...

Malwarebytes' Anti-Malware 1.34

Database version: 1777

Windows 6.0.6001 Service Pack 1

19/02/2009 04:29:21

mbam-log-2009-02-19 (04-29-05).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 209127

Time elapsed: 4 hour(s), 34 minute(s), 55 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\ProgramData\NortonProtectionMemo (1).exe (Trojan.Lop.H) -> No action taken.

[GT500]

You can upload the file to our UploadNET for analysis.

[liviu.c]

You can upload the file to our UploadNET for analysis.

Thank you GT 500,

I updated mbam and had a second scan today, and the restored/duplicate file was still shown as suspected - same log as yesterday.

NIS 2009 and its LiveUpdate service worked well.

So I decided to let mbam quarantine the duplicate/restored file, as I don't think it is actually needed.

Now NIS seems to work well without it, as it did before.

Is this a good solution?

Thankfully,

Liviu

[GT500]

Is this a good solution?

Probably. This file does not sound like it's needed.

[liviu.c]

Probably. This file does not sound like it's needed.

Thank you, GT500. I very much appreciate this.

Best wishes,

Liviu

[GT500]

Thank you, GT500. I very much appreciate this.

You are quite welcome.