mlanders
Joined: 19 Feb 2008 |
Posts: 0 |
|
|
 |
Posted: Tue Feb 19, 2008 2:03 am |
|
 |
 |
 |
 |
Ran a memory scan today and got the following report:
=====
Scan Started Mon Feb 18 20:20:35 2008
-------------------------------------------------------------------------------
*** Scanning Programs in Computer Memory ***
Unloading program C:\Program Files\Synaptics\SynTP\SynTPEnh.exe from memory
*** Scanned 37 processes - 320 modules ***
*** Computer Memory Scan Completed ***
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe: Trojan.Agent-13561 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 215151
Engine version: 0.91.2
Scanned directories: 0
Scanned files: 357
Skipped non-executable files: 0
Infected files: 1
Data scanned: 104.97 MB
Time: 106.875 sec (1 m 46 s)
--------------------------------------
Completed
=====
If I read this right Clamwin is reporting my mouse pointer as a trojan. Afterwards I looked in Task Manager and it reports that SynTPEnh.exe is still loaded (otherwise I wouldn't have a working mouse). What's happening here?
|
|
GuitarBob
Joined: 09 Jul 2006 |
Posts: 9 |
Location: USA |
|
 |
Posted: Tue Feb 19, 2008 2:36 pm |
|
 |
 |
 |
 |
First, set ClamWin preferences to Notify you of malware--not to Quarantine/Remove. Then upload the file to Jotti for a scan with multiple AV scanners. If more than a couple of scanners there find malware, it may be infected, and you do have a problem. If there is no infection, upload the driver file to ClamAV at https://cgi.clamav.net/sendvirus.cgi on the Web and tell them it is a false positive. Give them a week or so to fix their signature. In the meantime, you can exclude the file from scanning by including it in Clamwin's Preferences--Filters--Exclude Matching Filenames (format is: filename.ext). In a week or so, remove the file from Filters and scan it again to see if it's been fixed.
Regards,
|
|
mlanders
Joined: 19 Feb 2008 |
Posts: 0 |
|
|
 |
Posted: Thu Feb 21, 2008 1:20 am |
|
 |
 |
 |
 |
Thanks GB. I couldn't use the online scanner; always 100% busy. But I did a thorough scan of my system and found the same trojan lurking in most of the files run at startup. Every time I'd fix one another would pop up on reboot. Figured out their common characteristics and wiped them all (I hope). Thank you and all of the ClamWin team for making a great program.
|
|
GuitarBob
Joined: 09 Jul 2006 |
Posts: 9 |
Location: USA |
|
 |
Posted: Thu Feb 21, 2008 2:37 am |
|
 |
 |
 |
 |
Well, the ClamWin team gets all the credit. I'm just another user trying to free them up to make Clamwin even better!
Regards,
|
|