trojan.agent

[ben7728]

Is this a false positive ?

Malwarebytes' Anti-Malware 1.43

Database version: 3479

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.11

02/01/2010 17:15:08

mbam-log-2010-01-02 (17-14-58).txt

Scan type: Quick Scan

Objects scanned: 108748

Time elapsed: 4 minute(s), 9 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\twain (Trojan.Agent) -> No action taken. [7B402D0C03E04698FD803B154EA731DE]

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Thank you .

mbam_log_2010_01_02__17_14_58_.zip

[nosirrah]

The only place I know this to exist is as a trace to a known infection . If you know of an alternate source to this object let us know .

In any event this is a harmless trace as its very worst so leaving it or removing it will no effect on your system .

It is most likely this this is a left over component to a long removed infection .

[ben7728]

The only place I know this to exist is as a trace to a known infection . If you know of an alternate source to this object let us know .

In any event this is a harmless trace as its very worst so leaving it or removing it will no effect on your system .

It is most likely this this is a left over component to a long removed infection .

Thank you nosirrah for your quick reply . I thought it had something to do with my epson stylus printer/scanner ? Or a leftover maybe from Simple OCR which was uninstalled using Revo ?

[nosirrah]

The word "twain" is scanner related but as is the case with reserved words malware frequently exploits the familiarity of these words to disguise itself as legit .

I am going to delist this for now so I check around a little more . This wont have a negative effect on protection as this is not an active component of the infection it marks .

[ben7728]

Thank you once again nosirrah ,

i have quarantined the item with no ill affects .