Trojan.Agent in Crawler Toolbar?

[sandy1312]

I downloaded install file of Web Security Guard 5.1.0.245 compatible with Firefox 3 (with Crawler Toolbar) separately from the official site and installed it.

Then Malwarebytes' Anti-Malware 1.24 finds Trojan.Agent in Crawler Toolbar for Internet Explorer.

Is this a false positive?

Thanks for the answer

Malwarebytes' Anti-Malware 1.24

Database version: 1054

Windows 5.1.2600 Service Pack 3

12:41:46 15/8/2008

mbam-log-8-15-2008 (12-41-46).txt

Scan type: Quick Scan

Objects scanned: 41327

Time elapsed: 4 minute(s), 0 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 6

Registry Values Infected: 3

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\ctbr.r404pro (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{1cb20bf0-bbae-40a7-93f4-6435ff3d0411} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1cb20bf0-bbae-40a7-93f4-6435ff3d0411} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1cb20bf0-bbae-40a7-93f4-6435ff3d0411} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{4b3803ea-5230-4dc3-a7fc-33638f3d3542} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{4d25fb7a-8902-4291-960e-9ada051cfbbf} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{1cb20bf0-bbae-40a7-93f4-6435ff3d0411} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{4b3803ea-5230-4dc3-a7fc-33638f3d3542} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4b3803ea-5230-4dc3-a7fc-33638f3d3542} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Program Files\Crawler\ctbr.dll (Trojan.Agent) -> Quarantined and deleted successfully.

[JeanInMontana]

Your using an outdated version of MBAM. The current version is 1.25. Where did you download from? Link please.

[sergelepine]

Probably from CNet Download.com, version 1.24 is being offered for for download.

Serge

Your using an outdated version of MBAM. The current version is 1.25. Where did you download from? Link please.

[sandy1312]

Your using an outdated version of MBAM. The current version is 1.25. Where did you download from? Link please.

I dowloaded from download.com link:

http://www.download.com/Malwarebytes-Anti-...cdlPid=10876030

Where can I download version 1.25?

I see now version 1.25 on the link I gave you. I downloaded and installed the new version. Thanks!

[sandy1312]

Probably from CNet Download.com, version 1.24 is being offered for for download.

Serge

Yes, this version is still being offered.

Now, there is version 1.25 on CNET download.com. I downloaded and installed it.

[nosirrah]

Please update and let us know if this FP is gone .

[JeanInMontana]

I dowloaded from download.com link:

http://www.download.com/Malwarebytes-Anti-...cdlPid=10876030

Where can I download version 1.25?

That links straight to 1.25 for me.

[sergelepine]

You are right, it was updated after I had checked and wrote my message. Have you noticed the new screen for CNet, much better?

Serge

That links straight to 1.25 for me.

[sandy1312]

That links straight to 1.25 for me.

Yes, I noticed that. That's why you wanted the link. I downloaded and installed it. Thanks!

[sandy1312]

Please update and let us know if this FP is gone .

I downloaded, installed and updated version 1.25. The FP is gone. Thank you very much for the answer.