Adware Virus?

Discussion in 'NOD32 version 2 Forum' started by WilliamP, Dec 19, 2004.

Thread Status:
Not open for further replies.
  1. WilliamP

    WilliamP Registered Member

    Joined:
    Jun 1, 2003
    Posts:
    2,201
    Location:
    Fayetteville, Ga
    I was making a secondary snapshot in FD-ISR and got a NOD virus popup. I tried to Quarinteen but got an error. So I ran NOD32 and got 2 viruses. Deleted them. Just what was it? Please give details on how to get things to Eset so they can be checked out.
     

    Attached Files:

  2. WilliamP

    WilliamP Registered Member

    Joined:
    Jun 1, 2003
    Posts:
    2,201
    Location:
    Fayetteville, Ga
    This is the other screen shot.
     

    Attached Files:

  3. jg88swe

    jg88swe Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    181
    yea same here as WilliamP ..

    I've submited a sample to nod32..
     
  4. spy1

    spy1 Registered Member

    Joined:
    Dec 29, 2002
    Posts:
    3,139
    Location:
    Clover, SC
    Yeah, I saw that I got those two, too, when I ran a scan this morning.

    Since they haven't bothered to answer or fix the last issue I posted about, I didn't bother to send those two in - doesn't seem to be much point. Pete
     
  5. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    Just scanned out of curiousity and it found those 2 entries here also....



    snowbound
     
  6. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,719
    Location:
    Texas
    I'm not using Spybot. I didn't get any alarms scanning my system.
     
  7. fredra

    fredra Registered Member

    Joined:
    Jul 25, 2004
    Posts:
    366
    Interesting .....
    I got those also...on the first run it said it was unable to Quarantine the file, so I changed my profile and ran it again....the second time I could delete the file.(that is my fault for not making sure my profile was updated :'( )
    I then ran S&D 1.3 and it still works.
    I was not satisfied, so on my other PC (same OS ..xp, but with Panda) I checked and Panda says everything is clean, including the "dummy" for "alexa" in the S&D folder. So I copied it over to the NOD PC and checked again. NOD still said it was a virus.
    IMHO I think it is a FP.
    Just my .00000002 cents.
    Cheers :)
     
  8. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    I also think it is a False Positive, samples have been submitted to Eset, hopefully after the weekend we will see some answers.

    Cheers :D
     
  9. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    If you don't hear from Eset on any matter, please advise us here in the forum as Eset Mod's frequent this place.

    Cheers :D
     
  10. FanJ

    FanJ Guest

    Yep, I've got those too on my W98SE machine:

    C:\WINDOWS\WEB\RELATED.HTM - Win32/Adware.Alexa Application

    C:\Program Files\Spybot - Search & Destroy\Dummies\dummy.related.htm - Win32/Adware.Alexa Application

    As I guessed that ESET had indeed received already examples from others about those, I thought it better not to send them again.

    I'm sure that the Eset guys will look at them after the weekend ;)
    Keep up the good work ESET !

    Cheers, Jan.
     
  11. Detox

    Detox Retired Moderator

    Joined:
    Feb 9, 2002
    Posts:
    8,507
    Location:
    Texas, USA
    I'll bet they're f/ps - especially the one in Spybot. I also found them both with Nod this morning. AdAware doesn't find any Alexa traces though - I'd cleaned them long ago.
     
  12. Rainwalker

    Rainwalker Registered Member

    Joined:
    May 18, 2003
    Posts:
    2,106
    Location:
    USA
    Ditto
     
  13. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
Thread Status:
Not open for further replies.