Spyware, Viruses, & Security forum

General discussion

Trojan Dropper

by dirtnapper / November 16, 2005 10:43 AM PST

Just found "Trojan-Dropper.Win32.Agent.aao" in the "uninst.exe" file from FastStone Image viewer..any info on this one? Thanks.

Discussion is locked
You are posting a reply to: Trojan Dropper
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Trojan Dropper
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
You Can Try This One: Follow the Link, About 1/3 Down....
by tobeach / November 16, 2005 12:57 PM PST
In reply to: Trojan Dropper

on the left side you'll find the removal tool.
http://www.kaspersky.com/removaltools
You might have to dump your system restore points if trojan is also in "System Volume" file.
Hope this gets it. Good Luck !! Happy

Collapse -
Agent W not found
by dirtnapper / November 16, 2005 9:53 PM PST

After running the gamut of scanners, a squared found Agent W and disinfected it - 4 occurances. I also just ran the recommended one here, and nothing. It inidcated the file was in an email "bankinfo.pdf.exe" each time...
Also, during the scan Passview.E was found in Protected storage: "pspv.zip(pspv.exe)"...I undertand this is for passwords..I removed it... Of note, I just downloaded a trial version of Photoshop from Adobe...what are the chances of "pspv" slipping in from there? Thanks.

Collapse -
Not Really Sure. A couple of Loose Conections via Google...
by tobeach / November 17, 2005 3:40 PM PST
In reply to: Agent W not found

but nothing definative. Also found some mention of false positives by some AV re your file. Found Home Page of pspv.exe and have linked below. Was pspv found by you on board AV? Does it have a "right click:scan w/AV" option? If so, you could scan the photoshop file singlely and see if it's there. You at least got rid of some other nasties. Sometimes running scan in safe mode will allow access to inaccessable folder.
Pspv.exe home page:http://www.nirsoft.net/utils/pspv.html
There also seemed to be another file (from Google) with a loose connection with name varied to: Tcpsvrs also password related (near bottom of page):
http://www.helpfeeds.com/showthread.php?t=44719
Don't know if this helps but you could use your find files & folders to see if you've got.
Anyone else have physical contact with your machine?
Sorry can't be of more help! G'Luck! Happy

Collapse -
PSPV
by dirtnapper / November 17, 2005 10:43 PM PST

Read about and ran the scanners again on the Adobe download..nothing. I deleted the zip file of "pspv"..no other users and only broadband connection, running ZASS and other scanners...strange. Thanks.

Collapse -
A few months ago, Corphyeus, one of
by roddy32 / November 18, 2005 2:30 AM PST
In reply to: PSPV

the regulars posted a news article from, PC Mag (I think) about a tool (pspv.exe) to check to see if your passwords stored in a certain area of the computer were safe or not from a certain keylogger. Also in the same article was a link to another tool (SSAloggerclean) from CounterSpy that would detect and remove the keylogger. The first tool, the pspv.exe IS a hacktool so SOME scanners picked it up as a hacktool (Which it is so they were doing their job). I have Norton myself and I chose to ''exclude'' if from scans because I knew what it was. McAfee also picks up that tool. Are you sure that you didn't download that tool back then and maybe forget it was on your computer? IF you did, that would explain where it came from and maybe ease your mind some.

Collapse -
PSpv...from where
by dirtnapper / November 18, 2005 9:41 PM PST

No, I am sure I did not download it, it was in a folder ''Protected Storage''. I would have no reason for the file and then it is not even the area where I save my downloads. I also checked some backups, it was not on the backups, this was new. So, it can be a legit program to check on passwords and/or malware?Thanks.

Collapse -
Yes, It CAN be a legit program
by roddy32 / November 18, 2005 9:55 PM PST
In reply to: PSpv...from where

but if you didn't knowingly download it, than it probably is not. I just thought that MAYBE you had downloaded it back when myself and some of the others did. If you'd like, CounterSpy came out with a small scanner that looks for the keylogger that infects that area. It's free and it wouldn't hurt to download and try it.
http://research.sunbelt-software.com/ssaclean.cfm?download

Collapse -
Not looking to ''beat this to death'' but..
by Carol~ Moderator / November 19, 2005 10:26 AM PST
In reply to: PSpv...from where

it sure does sound familiar. I do have it. And it's also in a folder called ''Protected Storage''. And a few of my scans pick up pspv.zip and pspv.exe every time I run them. (Those being the programs that won't give me the option to ignore it, as I do want to keep it.)

Does this ring a bell at all:http://reviews.cnet.com/5208-6132-0.html?forumID=32&threadID=119247&messageID=1353529

As usual, all of what Roddy said applies. If you are sure you never intentionally downloaded it, I would agree with Roddy that it is not legit. How else would it have gotten there? (A rhetorical question)

So now.. I AM beating it to death.. :D!

Just wanted to jiggle your mind - one last time!

Consider it ''jiggled and over''!! Wink
Carol

Collapse -
(NT) (NT) Very Welcome. Perhaps Another w/ More Knowledge.......
by tobeach / November 18, 2005 2:50 PM PST
In reply to: PSPV

Popular Forums

icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

FALL TV PREMIERES

Your favorite shows are back!

Don’t miss your dramas, sitcoms and reality shows. Find out when and where they’re airing!