Download TrojanHunter Now
Free 30-day trial!
Latest TrojanHunter Version:
TrojanHunter 5.0
Order Now
License file delivered within minutes.
Welcome, Guest. Please Login or Register.
Sep 30th, 2008, 7:05pm
   Mischel Internet Security Forum
   TrojanHunter
   TrojanHunter Guard (Moderators: Helena, Gavin_Coe, Magnus)
   False Positive		 « Previous topic | Next topic »
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print
   Author  Topic: False Positive  (Read 1029 times)
Lora316K
Newbie
*





   


Gender: female
 Posts: 5
False Positive
« on: Aug 19th, 2006, 7:53pm »		 Quote Quote  Modify Modify
Yesterday when I started my computer up TrojanHunter had deleated SpyProDll.dll. Now Spy Protector doesn't start up. Is there a workaround for this.
 
Thank you for help,
 
Lora
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 5641
Re: False Positive
« Reply #1 on: Aug 20th, 2006, 12:26am »		 Quote Quote  Modify Modify
Welcome to the forum Lora316K,  Wink
 
Sorry that you are have an FP problem generated from TH.
 
I have emailed Gavin concerning this problem so that he can correct the false positive.
 
You can get Spy Protector back in service by doing a search for SpyProDll.dll.  It will show up as SpyProDll.dll.tcf  Just rename it back to SpyProDll.dll.
 
You may have to disable THGuard's automatic removal feature temporarily until this false positive is corrected.
IP Logged
______
TrojanHunter V5.0.962...No. 1 AT in my Book and on my Box!
Lora316K
Newbie
*





   


Gender: female
 Posts: 5
Re: False Positive
« Reply #2 on: Aug 20th, 2006, 12:41am »		 Quote Quote  Modify Modify
Thank you for help.
 
Lora
IP Logged
Gavin_Coe
Trojan Analyst
*****





   
WWW  

Posts: 2025
Re: False Positive
« Reply #3 on: Aug 20th, 2006, 12:51pm »		 Quote Quote  Modify Modify
Please send SpyProDll.dll to submit (at) misec.net
IP Logged
Lora316K
Newbie
*





   


Gender: female
 Posts: 5
Re: False Positive
« Reply #4 on: Aug 20th, 2006, 2:29pm »		 Quote Quote  Modify Modify
I am sorry for asking a stupid question. How can I send SpyProDll.dll? Do I send it as an attachment to the forum of do I have to send it via email?
 
Lora
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 5641
Re: False Positive
« Reply #5 on: Aug 20th, 2006, 4:37pm »		 Quote Quote  Modify Modify
Here is the procedure to manually submit a file for analysis.
 
http://forum.misec.net/board/FAQ/1139308293
IP Logged
______
TrojanHunter V5.0.962...No. 1 AT in my Book and on my Box!
Lora316K
Newbie
*





   


Gender: female
 Posts: 5
Re: False Positive
« Reply #6 on: Aug 20th, 2006, 10:22pm »		 Quote Quote  Modify Modify
I send it. Thank you for help.
 
Lora
IP Logged
Asawa
Newbie
*





   


Posts: 2
Re: False Positive
« Reply #7 on: Aug 21st, 2006, 8:16pm »		 Quote Quote  Modify Modify
I have the same problem.   Sad
 
I have Security Task Manager and TH is flagging 2 of its files as trojans:
 
1. SpyProDll.dll
2. ascode.dll  
 
It claims the first is TrojanSpy.Keylogger.153.  
I forget what it said about the second.  The second is not flagged until you go into Security Task Manager.  I guess it isn't brought into memory until then.
 
The modules getting flagged as trojans are definitely part of the Security Task Manager folder, etc.. When I "cleaned" the ascode file, Security Task Manager stopped working and told me it couldn't find ascode.dll.  I'm 99.99% sure this is a false positive.
 
This started happening after I installed an update on Saturday or Sunday. This update mentioned TrojanSpy.Keylogger.153 as one of the new things it's checking for.
 
Thanks
IP Logged
Gavin_Coe
Trojan Analyst
*****





   
WWW  

Posts: 2025
Re: False Positive
« Reply #8 on: Aug 21st, 2006, 9:18pm »		 Quote Quote  Modify Modify
Both are now on my machine for future false positive testing. You can update and these will not be detected with 21/08 ruleset
IP Logged
Lora316K
Newbie
*





   


Gender: female
 Posts: 5
Re: False Positive
« Reply #9 on: Aug 21st, 2006, 11:29pm »		 Quote Quote  Modify Modify
An update has helped. The file is no longer flaged as trojan.
IP Logged
Asawa
Newbie
*





   


Posts: 2
Re: False Positive
« Reply #10 on: Aug 22nd, 2006, 12:50am »		 Quote Quote  Modify Modify
The update worked for me, too.  
 
Thanks!
IP Logged
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print

« Previous topic | Next topic »
Search
Members
Login
Register