Technical Discussion
  >> Security Related Issues


Register (or login) on our website and you will not see this ad.


These posts have been archived and can no longer be replied to or modified.
  Print Thread
Standard User deleted
(deleted) Sun 06-Dec-09 17:09:07
Print Post

unknown trojan/virus?


[link to this post]
 
I have been using kaspersky IS 2009 for some time, running under vista.sp2

Most weeks I do a full scan. In addition to a couple of irritating 'vulnerabilities' which (following advice given here) I just ignore it has, for the past few weeks, come up with something that looks to this untutored eye more sinister. It's a virus, shown as:
HEUR.Trojan-Downloader.Win32.Generic
which it says is residing in an administrator Temporary Internet File:
content. IE5/NTRAK0BB\R182272_DellVideoChat_Setup_support.exe

When it's flagged up I carefully quarantine it, but it pops up again the next week. Although i have a dell desktop and use the webcam I don't use DellVideoChat as far as I know, and can't find it anyway. Can't find anything about this in the usual lists of nasties either. Obviously I have looked at TIFs (not there) and deleted all found. Tried sending on the Kaspersky notification link but the e-mail bounced.

Any advice would be welcomed!
Standard User deleted
(deleted) Sun 06-Dec-09 17:43:12
Print Post

Re: unknown trojan/virus?


[re: deleted] [link to this post]
 
Have you tried deleting all your temporary files and then rescan and see if it is still there.
Standard User deleted
(deleted) Sun 06-Dec-09 17:56:33
Print Post

Re: unknown trojan/virus?


[re: deleted] [link to this post]
 
It's probably a false positive.

The HEUR and Generic parts means it's being flagged by the Heurystic Analyzer part of KIS. This means it may not actually be malware it just displays signs of malware and on the face of it, given the name of the program and what it probably does, you can probably see why it would trigger the alarm with AV.

If the file is quarantined, for peace of mind, consider sending it into Kaspersky for them to classify if it is actually malware (unlikely).

http://support.kaspersky.com/virlab/helpdesk.html

Either that or get onto Dell and verify with them that it's a legitimate program, which it does appear to be after a bit of googling - just the usual junk that gets installed by OEM's.

Something like HijackThis would probably get rid of it.

edit-
I downloaded the file from Dells site:
http://support.dell.com/support/downloads/download.a...
and scanned it with KIS2010 (full updated and Heurystics enabled) and there was no warnings.

ps. You should update to KIS2010 regardless of this issue anyway, it should be free.

Edited by deleted (Sun 06-Dec-09 18:09:59)


Register (or login) on our website and you will not see this ad.

Standard User deleted
(deleted) Sun 06-Dec-09 23:02:57
Print Post

Re: unknown trojan/virus?


[re: deleted] [link to this post]
 
I did clear all temps, and tried to notify kaspersky using the link supplied which was different to the one you quoted, but it was kicked back at me.

You should update to KIS2010 regardless of this issue anyway, it should be free.

Thanks anyway, and I will update as you suggest.
Standard User deleted
(deleted) Mon 07-Dec-09 09:52:46
Print Post

Re: unknown trojan/virus?


[re: deleted] [link to this post]
 
Did the freebie upgrade to 2010 as you suggested and the message seems to have disappeared. Thanks!
  Print Thread

Jump to