Phlox Posted May 19, 2009 ID:81544 Share Posted May 19, 2009 I was running Malwarebytes and suddenly AVG popped up to say that one of the files accessed was a Trojan Downloader.Malwarebytes found nothing on this scan, so I don't know what to believe, I've still got this alert window sitting on my screen.I've had this game on more than one PC with no problems at all and I can find nothing on the net about the Agent2.cxs. Link to post Share on other sites More sharing options...
mountaintree16 Posted May 19, 2009 ID:81656 Share Posted May 19, 2009 Hi I had the same problem with a Trojan on a friends computer and then on my own computer it popped up with a cookie alert.Try reading through the thread I started and see if that helps. I am not completely sure what is happening either though. Hopefully this is figure-out able AdvancedSetup has been helping me a lot in that thread but we are still trying to figure it out.http://www.malwarebytes.org/forums/index.php?showtopic=15344 That's the thread that I started. Link to post Share on other sites More sharing options...
Phlox Posted May 19, 2009 Author ID:81663 Share Posted May 19, 2009 Thank you Mountaintree for your response.I did see your post 'after' I had made mine.. although I did use the search beforehand to find out if it was something known, but nothing came up.I've run umpteen virus checks locally and online on this system and the other PC where that game has been installed for years and have never ever had anything come up before, I'm not about to remove my favourite game without investigating it first, especially when I can find no reference to the Trojan Agent2.cxs on a google search.Looking at the responses to your post, I would like to know what we have to put in AVG to ignore it, I have no exceptions listed in mine.. do we just type in Malwarebytes and hope for the best, or just put in the 2 files mentioned... Or is there a complete list that we need?Good fun this stuff.. NOT Link to post Share on other sites More sharing options...
Phlox Posted May 19, 2009 Author ID:81666 Share Posted May 19, 2009 Dear god!!!! I just ran Hijackthis for a look and see, and it shows my login and pass for a games forum.. Argh!!!!!!! Link to post Share on other sites More sharing options...
mountaintree16 Posted May 20, 2009 ID:81695 Share Posted May 20, 2009 You're welcome!The computer that I am having the problem with had a Spyware Protect 2009 infection so I am pretty much certain that what the ResidentSheild found is a virus. I just don't understand why it was ONLY found this way. It concerns me.I had Malwarebytes run on the computer again today and the ResidentSheild issue did not come up again, so I am so confused. I don't want to change the settings IF this is the only way the virus gets found. At least with the Sheild it tells you that its finding a virus.I have heard of perfectly legitimate .exe files getting infected and being used as a host for a virus. One example I have heard of is lsass. I don't know anything about it really but that is one example.Maybe that happened with your game file?In my case, I have never HEARD of ker.exe before and I googled it and there was slim pickings. What version of AVG do you have? And is it free or paid?I couldn't find where to put them either, but I am going to look again. I didn't look too thoroughly before.I just ran Hijackthis for a look and see, and it shows my login and pass for a games forum.. Argh!!!!!!! Link to post Share on other sites More sharing options...
Phlox Posted May 20, 2009 Author ID:81811 Share Posted May 20, 2009 My AVG is a Free version 8.5.339, as is my Malwarebytes. I do tend to go for free applications as they are usually as good with the necessary features as the Pro versions.I never ever saw anyone's login and pass before on a hijackthis log, so if I ever have to post it in a forum, I will make sure it's clean of that information. Link to post Share on other sites More sharing options...
Phlox Posted May 20, 2009 Author ID:81816 Share Posted May 20, 2009 Can't seem to edit my previous post I found where to put exceptions in AVG.It's in Tools > Advanced > Exceptions > Add Path, you can navigate to where you want there....I chose to add the folder, don't know if that's right, we shall see Link to post Share on other sites More sharing options...
elero Posted May 21, 2009 ID:82097 Share Posted May 21, 2009 Maybe an AVG false positive? What about uploading the file to VT? Link to post Share on other sites More sharing options...
Phlox Posted May 21, 2009 Author ID:82277 Share Posted May 21, 2009 Thanks, I uploaded it there and got this result.File AquaBall.exe received on 05.21.2009 22:29:19 (CET)Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPEDResult: 1/40 (2.5%)Not sure what that means, according to that list only 1 found a problem, that was AVG. Link to post Share on other sites More sharing options...
elero Posted May 21, 2009 ID:82290 Share Posted May 21, 2009 It looks like a false positive Link to post Share on other sites More sharing options...
Phlox Posted May 21, 2009 Author ID:82295 Share Posted May 21, 2009 That's what I thought I just tried to update MB and failed, I tried a few times with no result.. I was a bit worried, but I decided to close it and reopen it again..bingo, it updated perfectly.. how odd These things are sent to make us sweat a little Link to post Share on other sites More sharing options...
mountaintree16 Posted May 26, 2009 ID:83678 Share Posted May 26, 2009 Hey sorry for the late reply.Thanks for letting me know what the fields to enter were!However, I am not sure if I want to change the setting because it seems that this was the only way the virus got found? If that makes any sense. On my friends computer that this virus popped up on with the AVG Shield (and it happened on my computer once, but mine was a tracking cookie not a virus) it seems as though that was the only way the virus was found. If the settings get changed, I am not sure if that will hurt the ability to find that virus or similar viruses in the future if they happen again (which hopefully they won't!)The AVG conflict hasn't happened again since that day on the friends computer, so I am thinking that it was actually a virus being found and not a false positive.Do you think that your system is clean now? Link to post Share on other sites More sharing options...
Phlox Posted May 28, 2009 Author ID:84301 Share Posted May 28, 2009 Ohhhh, I'm not suggesting that you put things in Exceptions that you know are real problems.I've had that file on 2 of my PCs for years with no problem, it's been through many Virus checks online and locally without incident.I researched the file that was causing a problem for AVG here.. http://www.virustotal.com/ and it was only AVG that marked it, so 1 out of 40 is a good sign that it's a false positive in AVG. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 28, 2009 Root Admin ID:84306 Share Posted May 28, 2009 DO NOT add items to the Ignore List unless you're absolutely sure it is a False Positive and even then you should submit it to us so that we can confirm and remove it from detection for everyone. If you're wrong and it is Malware and you've placed it on the Ignore list then we won't detect or remove it as it sits there and damages your system. Link to post Share on other sites More sharing options...
mountaintree16 Posted May 28, 2009 ID:84485 Share Posted May 28, 2009 Thanks AdvancedSetup! I haven't added anything to an ignore list on Malwarebytes or AVG.I moved the detected virus into the vault on AVG when it was picked up during the MBAM scan and did the same with the cookie that came up. I did not alter any settings on AVG or MBAM on either computer.Not that I have, but if I did accidentally put something on the ignore list, is there a way to get it off of the ignore list? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 28, 2009 Root Admin ID:84489 Share Posted May 28, 2009 Yes, just click on it and select to remove from the list and we'll once again notify if we find it again. Link to post Share on other sites More sharing options...
mountaintree16 Posted May 28, 2009 ID:84492 Share Posted May 28, 2009 AdvancedSetup:Thanks Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now