Denny_M Posted March 31, 2009 ID:68898 Share Posted March 31, 2009 hi, next yesterday to do a scan but none....yesterdaya new scan and Antimlawarebyte say have a TROYAN:Infect keys:HKEY_CLASSES_ROOT\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d} (Trojan.BHO) -> No action taken.HKEY_CLASSES_ROOT\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d} (Trojan.BHO) -> No action taken.HKEY_CLASSES_ROOT\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d} (Trojan.BHO) -> No action taken.HKEY_CLASSES_ROOT\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d} (Trojan.BHO) -> No action taken.HKEY_CLASSES_ROOT\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d} (Trojan.BHO) -> No action taken.and program infect is:C:\WINDOWS\system32\mswinsck.ocx (Trojan.BHO) -> No action taken. i have scan this MSWINSCK.OCX with Virus Scan and say no virus o trojan !!!is a false/positive ?????yestarday i have installed ONLY the update of Java RE6 version 13.help me ? what i to do ? Link to post Share on other sites More sharing options...
Staff miekiemoes Posted March 31, 2009 Staff ID:68907 Share Posted March 31, 2009 Hi,Please update your malwarebytes.Update tab > check for updates.Rescan again and let me know if it's still detected. Link to post Share on other sites More sharing options...
Denny_M Posted April 1, 2009 Author ID:69294 Share Posted April 1, 2009 later day i scan and result INFECT in system32 the MSWINSCK.OCX file ....yestarday i download the new database at 6 P.M. and re-scan ....NO VIRUS orTROJAN result ! !!! an false/positive !yesterday, at 9 P.M. download the new database: 1926 31 march 2009re-scan and it say:REGISTER KEY INFECT:HKEY_CLASSES_ROOT\ierunner.dochostuihandler (Trojan.FakeAlert) -> No action taken.HKEY_CLASSES_ROOT\CLSID\{3f2bbc05-40df-11d2-9455-00104bc936ff} (Trojan.FakeAlert) -> No action takewhat to do? kill this key or ANOTHER false/positive of Antimalwarebyte's ? help me....please Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 1, 2009 Staff ID:69310 Share Posted April 1, 2009 Please read the instructions here:http://www.malwarebytes.org/forums/index.p...amp;#entry11731Then post the developers log. Link to post Share on other sites More sharing options...
Denny_M Posted April 1, 2009 Author ID:69323 Share Posted April 1, 2009 Malwarebytes' Anti-Malware 1.35Versione del database: 1926Windows 5.1.2600 Service Pack 201/04/2009 5.13.14mbam-log-2009-04-01 (05-13-03).txtTipo di scansione: Scansione completa (C:\|)Elementi scansionati: 160823Tempo trascorso: 46 minute(s), 2 second(s)Processi delle memoria infetti: 0Moduli della memoria infetti: 0Chiavi di registro infette: 2Valori di registro infetti: 0Elementi dato del registro infetti: 0Cartelle infette: 0File infetti: 0Processi delle memoria infetti:(Nessun elemento malevolo rilevato)Moduli della memoria infetti:(Nessun elemento malevolo rilevato)Chiavi di registro infette:HKEY_CLASSES_ROOT\ierunner.dochostuihandler (Trojan.FakeAlert) -> No action taken.HKEY_CLASSES_ROOT\CLSID\{3f2bbc05-40df-11d2-9455-00104bc936ff} (Trojan.FakeAlert) -> No action taken.Valori di registro infetti:(Nessun elemento malevolo rilevato)Elementi dato del registro infetti:(Nessun elemento malevolo rilevato)Cartelle infette:(Nessun elemento malevolo rilevato)File infetti:(Nessun elemento malevolo rilevato) Link to post Share on other sites More sharing options...
Denny_M Posted April 1, 2009 Author ID:69324 Share Posted April 1, 2009 ok for post the log.... in italian languagewhat is the commnad ??? mbam.exe /developer, in italian ???? help Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 1, 2009 Staff ID:69326 Share Posted April 1, 2009 Hi, above is not the developers log.what is the commnad ???mbam.exe /developer, in italian ???? helpItalian, Chinese, Spanish, Russian..., it all stays the same.Just enter mbam.exe /developer in start>run.This will start mbam again, so scan and post the log here. Link to post Share on other sites More sharing options...
nosirrah Posted April 1, 2009 ID:69336 Share Posted April 1, 2009 Looking this up online I am seeing a lot of references to a password recovery tool , this could be used to steal passwords in the wrong hands .http://74.125.93.104/search?q=cache:d7fDlF...=clnk&gl=usThe highlighted component is the same that we are hitting in your system . Do you know what software Link to post Share on other sites More sharing options...
Denny_M Posted April 1, 2009 Author ID:69338 Share Posted April 1, 2009 ok.... but this infect in KEY REGISTER:ierunner.dochostuihandler is real or a false/positive ?help me ... Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 1, 2009 Staff ID:69350 Share Posted April 1, 2009 This has been fixed.Please use the update option in mbam, download latest updates and rescan again. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now