Trendmicro scan

Specified in the "SEG_WhiteListProcNum" key. [HKLM\SOFTWARE\TrendMicro\NSC\TmProxy\WhiteList\ABC] Name: ProcessImageName Type: REG_SZ Data: ABC.exe [HKLM\SOFTWARE\TrendMicro\NSC\TmProxy\WhiteList\DEF] Name: ProcessImageName Type: REG_SZ Data: DEF.exe For Windows 8 desktops and higher and Windows 2012 servers and higher: [HKLM\SOFTWARE\TrendMicro\Osprey\WhiteList] SEG_WhiteListProcNum=x SEG_WhiteListProc0=ABC.exe SEG_WhiteListProc1=DEF.exe SEG_WhiteListProc9=XYZ.exe Where x is the number of approved processes. The maximum is 10. The following installed subkeys are based on the number of processes that you specified in the "SEG_WhiteListProcNum" key. [HKLM\SOFTWARE\TrendMicro\Osprey\WhiteList\ABC] Name: ProcessImageName Type: REG_SZ Data: ABC.exe [HKLM\SOFTWARE\TrendMicro\Osprey\WhiteList\DEF] Name: ProcessImageName Type: REG_SZ Data: DEF.exe Registry keys installed in OfficeScan 11.0 Service Pack 1 (SP1) For machines before Windows 7 desktops and Windows 2012 Servers: [HKLM\SOFTWARE\TrendMicro\NSC\TmProxy\WhiteList] SEG_WhiteListProcNum=x SEG_WhiteListProc0=ABC.exe SEG_WhiteListProc1=DEF.exe SEG_WhiteListProc9=XYZ.exe Where x is the number of approved processes. The maximum is 10. The following installed subkeys are based on the number of processes that you specified in the "SEG_WhiteListProcNum" key. [HKLM\SOFTWARE\TrendMicro\NSC\TmProxy\WhiteList\ABC] Name: ProcessImageName Type: REG_SZ Data: ABC.exe [HKLM\SOFTWARE\TrendMicro\NSC\TmProxy\WhiteList\DEF] Name: ProcessImageName Type: REG_SZ Data: DEF.exe For Windows 7 desktops and higher and Windows 2012 servers and higher: [HKLM\SOFTWARE\TrendMicro\Osprey\WhiteList] SEG_WhiteListProcNum=x SEG_WhiteListProc0=ABC.exe SEG_WhiteListProc1=DEF.exe SEG_WhiteListProc9=XYZ.exe Where x is the number of approved processes. The maximum is 10. The following installed subkeys are based on the number of processes that you specified in the "SEG_WhiteListProcNum" key. [HKLM\SOFTWARE\TrendMicro\Osprey\WhiteList\ABC] Name: ProcessImageName Type: REG_SZ Data: ABC.exe [HKLM\SOFTWARE\TrendMicro\Osprey\WhiteList\DEF] Name: ProcessImageName Type: REG_SZ Data: DEF.exe Registry keys installed in OfficeScan XGFor machines before Windows 7 desktops and Windows 2008 R2 Servers: [HKLM\SOFTWARE\TrendMicro\NSC\TmProxy\WhiteList] SEG_WhiteListProcNum=x SEG_WhiteListProc0=ABC.exe SEG_WhiteListProc1=DEF.exe SEG_WhiteListProc9=XYZ.exe Where x is the number of approved processes. The maximum is 10. The following installed subkeys are based on

#1 signal-vol Members 3 posts OFFLINE Local time:11:16 PM Posted 29 April 2013 - 01:47 PM I ran a scan on RogueKiller.exe (32bit) and RogueKillerX64.exe (64bit) on VirusTotal. Each was reported to have virus.For RogueKiller.exe TrendMicro-HouseCall reported TROJ_GEN.F47V0319And for RogueKillerX64.exe McAfee-GW-Edition reported Heuristic.BehavesLike.Win32.Suspicious-BAY.GDoes truly know if these determinations are false positives?ThanksSignal-Vol Back to top"> Back to top BC AdBot (Login to Remove) BleepingComputer.com Register to remove ads #2 noknojon noknojon Gender:Not Telling Local time:01:16 PM Posted 29 April 2013 - 05:31 PM Hello -Can you Copy / Paste your results from Virus Total - Most likely a F/Pos as Trend will pick up many tools as infections.Re-run it on Jotti or another similar checking site -I just ran it and had no reaction -Thank You - Back to top"> Back to top #3 signal-vol signal-vol Topic Starter Members 3 posts OFFLINE Local time:11:16 PM Posted 30 April 2013 - 07:45 PM I downloaded the files from found a virus for the 32 bit and suspicious for the 64 bit.Jotti found Win32:packer for the 32 bit and clean for the 64 bit (didn't post)The Jotti post is converted to words by Notebook ++ because I can't post pics on the board.It is interesting that on VirusTotal Trend Micro HouseCall found a virus and on Jotti Trend Micro Antivirus did not.I appreciate the help.VirusTotal SHA256: 48ef0b014188d44411c32617ce62840e8ee86367dd75c3a9a6094e20e882da9e File name: RogueKiller Detection ratio: 1 / 46 Analysis date: 2013-04-30 20:31:07 UTC ( 0 minutes ago ) More details Antivirus Result Update Agnitum 20130430 AhnLab-V3 20130430 AntiVir 20130430 Antiy-AVL 20130430 Avast 20130430 AVG 20130430 BitDefender 20130430 ByteHero 20130430 CAT-QuickHeal 20130430 ClamAV 20130430 Commtouch 20130430 Comodo 20130430 DrWeb 20130430 Emsisoft 20130430 eSafe 20130423 ESET-NOD32 20130430 F-Prot 20130430 F-Secure 20130430 Fortinet 20130430 GData 20130430 Ikarus 20130430 Jiangmin 20130430 K7AntiVirus 20130430 K7GW 20130430 Kaspersky 20130430 Kingsoft 20130422 Malwarebytes 20130430 McAfee 20130430 McAfee-GW-Edition 20130430 Microsoft 20130430 MicroWorld-eScan 20130430 NANO-Antivirus 20130430 Norman 20130430 nProtect 20130430 Panda 20130430 PCTools 20130430 Sophos 20130430 SUPERAntiSpyware 20130430 Symantec 20130430 TheHacker 20130430 TotalDefense 20130430 TrendMicro 20130430 TrendMicro-HouseCall TROJ_GEN.F47V0319 20130430 VBA32 20130430 VIPRE 20130430 ViRobot 20130430 VirusTotal SHA256: dee73e429468ede4f4f918ad62116bab690e82f8228c610ca75e86de88495cfa File name: RogueKiller Detection ratio: 1 /

Menus+ Detection for Black Energy 2.1+ Rootkit+ Tools->File Delete+ Tools->Copy File+ Tools->Copy Folder+ Tools->File Hasher+ Tools->Timed Remote Report + Send Log to Email+ Tools->Send To FTP (send a file to remote FTP)+ Use Grid Lines for ListViews+ Optimized Processes Behavioral Analysis+ Verify File Signature+ Export data as HTML and CSV+ Mark in orange possible keylogger activity in Message Hooks+ Fixed FPs for MBR Scan+ Global Descriptor Tables (GDT) Hooks+ Autorun.Inf (Scan all removable devices and the system for autorun.inf)+ Hosts File (View, edit and reset hosts file)+ Hidden Modules (Any Hidden Modules in any Process can now be seen here)+ Hidden Modules->Force Unload Module+ Hidden Modules->Dump All Module Memory+ Registry Startups (View common registry startup entries)+ WinEvent Hooks+ Start with Windows+ Minimize to System Tray+ Maximize GUI+ Other additions and optimizations+ Minor changesMore details: Enrgy21 Registered Member Joined: Apr 6, 2011 Posts: 1 Website (Identity hidden)"Here is a list of engines that can be used:PcTools Browser Defender, Norton SafeWeb, MyWOT, Threat Log, MalwareDomainList, hpHosts, ZeuS Tracker, Google Diagnostic, PhishTank, Project Honey Pot, ParetoLogic, Spamhaus, URIBL, Malware Patrol, SURBL, SpamCop, Finjan TrendMicro Web Reputation, Web Security Guard, AMaDa, DNS-BH, joewein.de LLC, Spamhaus, DShield. At end of july 2010 we have integrated a new tool URL & Link Scanner that makes use of the engine of NoVirusThanks Scanner to scan a link, provided by the user, with multiple Antivirus engines to facilitate the detection of possible malicious code such as hidden iframes and evil javascript code. It can be used also to

AAct.exe is digitally signed by WZT.AAct.exe is usually located in the 'C:\Windows' folder.Some of the anti-virus scanners at VirusTotal detected AAct.exe. If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.Vendor and version information [?]AAct.exe does not have any version or vendor information.Digital signatures [?]AAct.exe has a valid digital signature.PropertyValueSigner nameWZTCertificate issuer nameWZTCertificate serial number08a8e826950f1a9940262589fcaf0b8fVirusTotal report23 of the 57 anti-virus programs at VirusTotal detected the AAct.exe file. That's a 40% detection rate.ScannerDetection NameAegisLab Spr.Hackkms.Sgde!cAhnLab-V3 HackTool/Win32.Activator.C1521067AVG Patched5_c.FMVAvira SPR/HackKms.sgde.6AVware Trojan.Win32.Generic!BTBkav W32.Clodd07.Trojan.ece3Cyren W32/Trojan.BZQC-5565ESET-NOD32 a variant of Win64/HackKMS.I potentially unsafeFortinet Riskware/HackKMSGData Win32.Application.Agent.FIGC8GIkarus HackTool.AutoKMSK7AntiVirus Unwanted-Program ( 004d8d201 )K7GW Unwanted-Program ( 004d8d201 )McAfee RDN/Generic PUP.xMcAfee-GW-Edition RDN/Generic PUP.xnProtect Trojan/W32.Agent.713328Panda Trj/CI.ASophos Generic PUA IM (PUA)Symantec ML.Relationship.HighConfidence [Trojan.Gen.2]TrendMicro TROJ_GEN.R08JC0OIK16TrendMicro-HouseCall TROJ_GEN.R08JC0OIK16VIPRE Trojan.Win32.Generic!BTYandex PUP.Agent!AAct.exe removal instructionsThe instructions below shows how to remove AAct.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the AAct.exe file for removal, restart your computer and scan it again to verify that AAct.exe has been successfully removed. Here are the removal instructions in more detail:Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes. When the scan is finished, locate AAct.exe in the scan result and tick the checkbox next to the AAct.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate AAct.exe in the scan result. Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the AAct.exe file. Restart your computer.Start FreeFixer and scan your computer again. If AAct.exe still remains in the scan result, proceed with the next step. If AAct.exe is gone from the scan result you're done.If AAct.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.Restart your computer.Start FreeFixer and scan your computer again. Verify that AAct.exe no longer appear in the scan result.Hashes [?]PropertyValueMD5a56e91d905be4e034158212b65f21ea3SHA25602ea279444b637d961d9a15d226c2a0d7b26aca852dac87d420febce7dd56f9aError MessagesThese are some of the error messages that can appear

-adi, --alexa-domain-info Just Domain option: Show Alexa domain info -wdi, --wot-domain-info Just Domain option: Show WOT domain info -tm, --trendmicro Just Domain option: Show TrendMicro category info -wt, --websense-threatseeker Just Domain option: Show Websense ThreatSeeker category -bd, --bitdefender Just Domain option: Show BitDefender category -wd, --webutation-domain Just Domain option: Show Webutation domain info -du, --detected-urls Just Domain option: Show latest detected URLs --pcaps Just Domain option: Show all pcaps hashes --samples Will activate -dds -uds -dc -uc -drs -urs -dds, --detected-downloaded-samples Domain/Ip options: Show latest detected files that were downloaded from this ip -uds, --undetected-downloaded-samples Domain/Ip options: Show latest undetected files that were downloaded from this domain/ip -dc, --detected-communicated Domain/Ip Show latest detected files that communicate with this domain/ip -uc, --undetected-communicated Domain/Ip Show latest undetected files that communicate with this domain/ip -drs, --detected-referrer-samples Undetected referrer samples -urs, --undetected-referrer-samples Undetected referrer samplesProcess emails: -pe, --parse-email Parse email, can be string or file -esa SAVE_ATTACHMENT, --save-attachment SAVE_ATTACHMENT Save email attachment, path where to store -peo, --parse-email-outlook Parse outlook .msg, can be string or fileBehaviour options: -bh, --behaviour The md5/sha1/sha256 hash of the file whose dynamic behavioural report you want to retrieve. VirusTotal runs a distributed setup of Cuckoo sandbox machines that execute the files we receive. Execution is attempted only once, upon first submission to VirusTotal, and only Portable Executables under 10MB in size are ran. The execution of files is a best effort process, hence, there are no guarantees about a report being generated for a given file in our dataset. a file did indeed produce a behavioural report, a summary of it can be obtained by using the file scan lookup call providing the additional HTTP POST parameter allinfo=1. The summary will appear under the behaviour-v1 property of the additional_info field in the JSON report.This API allows you to retrieve the full JSON report of the files execution as outputted by the Cuckoo JSON report encoder. -bn, --behavior-network Show network activity -bp, --behavior-process Show processes -bs, --behavior-summary Show summaryDownload options: -dl, --download The md5/sha1/sha256 hash of the file you want to download or txt file with .txt extension, with hashes, or hash and type, one by line, for example: hash,pcap or only hash. Will save with hash as name, can be space separated list of hashes to download -nm NAME, --name NAME Name with which file will saved when download it -dt DOWNLOAD_THREADS, --download-threads DOWNLOAD_THREADS Number of simultaneous downloadersAdditional options:

If I were sitting in front of your computer I could think of many things to check, but since I am not, I only have a few shots in the dark.First, let's try to clear the Flash Player's own temporary files. This is easiest done by using CCleaner. Download, install, and run it. On tab Applications, Multimedia, check 'Adobe Flash Player'. Before you click 'Run Cleaner' make sure that Cookies are unchecked under Windows (Internet Explorer) and Applications (whatever other browsers you have).Now click 'Run Cleaner'; this may run for a few minutes because it does a lot of cleaning. Do not run the Registry cleaner!Did this make any difference - try to install Flash Player again.Next thing I would try is to run CHKDSK - Start -> Run -> cmd -> chkdsk /fYou may need to reboot to get CHKDSK to run.Last thing for today, check your system for malware that is not covered by McAfee (what product is it exactly, VirusScan?). Run a full system scan with Trendmicro Housecall - it will show you if you have any malware infection on your system that could be responsible for your Flash Player installation problem.Sorry, I will be off for a few days, but I may check in here sometimes.