(Trojan.Agent)

[Everest]

Is this file part of my OS?

is it infected?

can I clean the file without deleting it?

it's probably False positive because me Avira Antivir say it's clean..

any help is welcomed ... thank you

P.S. I did run dev mod as suggested and attached the Log .. hope you can help me with that B)

mbam_log_2009_03_12__20_40_13_.txt

mbam_log_2009_03_12__20_40_13_.txt

[Fatdcuk]

Is this file part of my OS?

is it infected?

can I clean the file without deleting it?

it's probably False positive because me Avira Antivir say it's clean..

any help is welcomed ... thank you

P.S. I did run dev mod as suggested and attached the Log .. hope you can help me with that B)

Always a good idea with any suspect files to upload the suspect file to VirusTotal service for 39 second opinions.

http://www.virustotal.com

Can you please copy and paste a link to the scan report page generated.

Thanks in advance

[Everest]

This link?

http://www.virustotal.com/analisis/447c1bb...643f99b8d9205ca

this is the page that shows results for Winhost.exe

Looks fine (except for one engine that flagged it)

[nosirrah]

Let me see if I can fix this , there might actually be a rare app that uses this path . I'm going add a filter on this that should miss the legit version .

[nosirrah]

The filter is installed .

[Everest]

what filter ?

installed where ?

so ..

I don't get it.. Is the file infected?

I will update and restore the file and scan again ..

thanx

[Fatdcuk]

Hi,

Could you upload your copy of winhost32.exe to the following Forum for further analysis.

You will need to zip(compress) it for it to upload.

http://www.malwarebytes.org/forums/index.php?showforum=55

PX will are hitting the file on its MD5 checksum alone and not a heuristic flag.

Thanks in advance

[Everest]

Uploaded the file Winhost.exe in zip format: http://www.malwarebytes.org/forums/index.php?showtopic=12683

good luck B)

[Fatdcuk]

Many thanks for uploading your sample

I can confirm that this is a genuine detection by MBAM and not a F/P after prelimary analysis.

Here's some handy pointers since the file has faked Microsoft information attached to it and at first glance would appear genuine.

VirusTotal Report was inconclusive as only PX flagged the file but simple google search of MD5 returns 0 results.

http://www.google.co.uk/search?sourceid=na...2e9cdadd8febc10

This is totally irregular for a Microsoft genuine file and the first clear indicator all is not what it seems B)

[Everest]

MBAM does not detect the file anymore !!!

maby detection was removed with the update !!

the file is still in C:/windows/system32 ..

detection for the file was removed and MBAM no longer detect the file !!

should I delete it manually ?

if so, make shore to add it back to the detection file.

what does MD5 mean anyway?

thanx,

[Fatdcuk]

MBAM does not detect the file anymore !!!

maby detection was removed with the update !!

the file is still in C:/windows/system32 ..

detection for the file was removed and MBAM no longer detect the file !!

should I delete it manually ?

if so, make shore to add it back to the detection file.

what does MD5 mean anyway?

thanx,

Hi,

In laymans terms it is a tool for indexing files by generating a value unique to that particular file.

Here's the Wiki for MD5

http://en.wikipedia.org/wiki/MD5

If you look at the bottom of the virustotal report amongst other data there will always be a MD5 generated value for the uploaded file.

As far as the target file goes then it is safe to manually delete it if you know how too and it was removed from being flagged by MBAM until we could investigate it further and determine whether it was f/p or not B)