Trojan.win32.fynben.b

I just did a scan with both Bitdefender and Advanced System Care and while Bitdefender came up clean Advanced System Care found Trojan.Win32.Fynben.b in C:windows\system32\autorun.exe I did a search in the system32 folder and I couldn't find this autorun.exe could this just be a case of false positive?

Find more posts tagged with

Comments

Ryan C.

UPDATE:

While Browsing the system32 folder I came across some .dat files that caught my eye.

pc_drugs.dat

pc_gambling.dat

pc_games.dat

pc_illegal.dat

pc_im.dat

pc_news.dat

pc_onlinedating.dat

pc_onlinepay.dat

pc_pornography.dat

csalgau

The mentioned file might be hidden and we might not detected it.

You may follow the steps described in this KB article and send me the results by PM for analysis.

http://www.bitdefender.com/KB490-en--The-s...s-infected.html

csalgau

You may also try using gmer to find and copy the mentioned autorun.exe and upload it then send me the link by PM.

Ryan C.

Thank you so much for your fast reply Catalin I'll do that ASAP. How do I upload the gmer.log and bd_sys_log?

csalgau

Instructions on archiving samples and uploading files can be found here and here

Ryan C.

I hope I did everything right I just sent you the bd_sys_log.xml I wasn't able to locate the Autorun.exe with gmr.

csalgau

I'm still waiting for the gmer log. The submitted file does not show any sign of the mentioned detection. It may be possible that the other security product has already removed it.

Ryan C.

I'm sorry for the delay I'm having some problems with gmr for some reason the log is blank?

Ryan C.

Ok well I sent the log.

csalgau

Indeed.. thank you for the empty file:)

Has gmer printed out something in it's interface but not in the log?

Ryan C.

Indeed.. thank you for the empty file:)

Has gmer printed out something in it's interface but not in the log?

There is nothing in the interface I'm afraid but there is a messege that pops up after the scan is complete that says something along the lines:

"gmer has detected no changes to your system"

csalgau

As I stated earlier, it may be possible that the other security product has already removed it the detected sample. Please do another scan and see if the threat pops up again under "Advanced System Care". If not, please check the quarantine of that product for the mentioned file.