False positive (SkyNet)

[serwar]

Malwarebytes' Anti-Malware 1.40

Verze datab

[miekiemoes]

Hi,

Can you export this key please? Because afaik, it's used by this one:

http://www.symantec.com/security_response/...-99&tabid=2

So please export the contents of the key HKLM\System\CurrentControlSet\Services\SkyNet, save it as a txt file and copy and paste it in your next reply.

Thanks

[serwar]

Hi miekiemoes,

it's small diferent between txt and reg version, because reg version is export (few days ago) before fix and reinstall drivers for card.

Skynet_txt_version.txt

SKYNET_reg_version.txt

[miekiemoes]

Interesting. This one even uses the same driver name as mentioned on the Symantec site, however, in your case, it runs from the system32\drivers folder.

In case of the one mentioned on the Symantec site, it runs from the Windows folder.

I'll pass this on so we can fix this in a way while we still detect the bad one.

[leeds6]

Interesting. This one even uses the same driver name as mentioned on the Symantec site, however, in your case, it runs from the system32\drivers folder.

In case of the one mentioned on the Symantec site, it runs from the Windows folder.

I'll pass this on so we can fix this in a way while we still detect the bad one.

06/09/2009 18:28:20

mbam-log-2009-09-06 (18-28-20).txt

Scan type: Quick Scan

Objects scanned: 101970

Time elapsed: 5 minute(s), 47 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 5

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\Root\LEGACY_DRVFLTIP (Rogue.UnVirex) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DrvFltIp (Rogue.UnVirex) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_DRVFLTIP (Rogue.UnVirex) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DrvFltIp (Rogue.UnVirex) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SkyNet (Trojan.Agent) -> Quarantined and deleted successfully.

first post and moaning already but is there any news of a fix for this because around the planet there are tens if not hundreds of thousands of skystar2 users ,just used mbytes somebody told me it was good gear ,but as you can tell by the above log it took out my skynet dll which is needed to drive this satellite card http://www.technisat.com/index381f.html?na...ducts,en,76-174 and now i'm gonna have to searching round my place for the install disc or someplace on the net to download this driver again ....when did this skynet trojan first appear because i have used these cards for years with no problem from trojan or spyware soft

cheers people

[nosirrah]

That scan log has been modified , please post a full unaltered log .

The key component is missing .

[digimon]

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SkyNet (Trojan.Agent).Yes false positive.I delete this and skystar2 not working.I restor this i restarted system and skystar2 again work.

[MAM]

Run Malwarebytes' Anti-Malware, this the NEW

[leeds6]

That scan log has been modified , please post a full unaltered log .

The key component is missing .

modified by who or what i am not a tech head or coder i just posted what was in the mbytes log i have no clue what you are talking about the only other soft running on my pc at the time were symantec antivirus 10.1.1.5 and ashampoo firewall are these incompatable with mbytes

cheers people

[nosirrah]

modified by who or what i am not a tech head or coder i just posted what was in the mbytes log i have no clue what you are talking about the only other soft running on my pc at the time were symantec antivirus 10.1.1.5 and ashampoo firewall are these incompatable with mbytes

cheers people

There were some FPs fixed on this one already and there is no way to verify if this is a new or old problem here as the version # and definitions # have been edited out of the scan log . If you can get me a current log with that part included I will have a starting point to work with .

[leeds6]

There were some FPs fixed on this one already and there is no way to verify if this is a new or old problem here as the version # and definitions # have been edited out of the scan log . If you can get me a current log with that part included I will have a starting point to work with .

Malwarebytes' Anti-Malware 1.40

Database version: 2748

Windows 5.1.2600 Service Pack 2

06/09/2009 22:23:49

mbam-log-2009-09-06 (22-23-49).txt

Scan type: Quick Scan

Objects scanned: 1

Time elapsed: 6 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

there you go pal this log is a couple of hours after with version no and defs left at the top the report is clean but i hadnt put the driver back yet

cheers