Results 1 to 7 of 7

Thread: Trojan-Spy.DeskAd.2

  1. #1
    whoyer Guest

    Default Trojan-Spy.DeskAd.2

    I am running ZA Pro Vers 6.5.737.000 with Anti-Spyware Engine and Dat 01.200609.355, After doing a scan it is telling me that a Win32.Trojan.Spy.DeskAd.2 is located in the registry under HKEY_Local_Machine\Software\Miscrosoft\Windows|Cur rent Version\Uninstall\Celestia_is1. This is the first time in 2 years that the anti-spyware part of ZA PRo has given me this warning. Lavasoft Ad-Aware 1.06 is not finding it, Windows Defender Beta 2 is not finding it and Trojan Remover 6.5.2 is not finding it either. This must be a false positive. How about checking on it?

    Operating System:Windows XP Pro
    Product Name:ZoneAlarm Pro
    Software Version:6.5

  2. #2

    Default Re: Trojan-Spy.DeskAd.2

    Try and see if Evido Anti-spyware sees anything. It works fully for 30 days before crippling parts of itself.

  3. #3
    henshawj Guest

    Default Re: Trojan-Spy.DeskAd.2

    Hi Folks
    My ZASS has found the same Trojan. ZASS has the latest updates.
    I checked with - Spybot, Spyware Doctor and Ewido, they found nothing.
    I deleted it with ZASS and up-to-now it has not returned.
    I have contacted Zone Labs with the results.

  4. #4
    hughesmarks Guest

    Default Re: Trojan-Spy.DeskAd.2

    I've gotten the same result with one difference:

    The "trojan" found was: Win32.Trojan.Spy.DeskAd.2 and the registry key identified was: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Audacity_is1

    "Audacity_is1" is the difference.

    I too have the latest version of updates and believe this is a false positive. I did report it but don't think I will hear back from anyone.

    (I do have Audacity on my computer and have had it for several years. It is NOT spyware! For the next week I plan to just ignore this. I had the Softomate false positive last week and another false positive last spring. This causes me a lot of wasted time searching and scanning with other programs. If these false warnings keep up I plan to switch to Spyweeper or something else I can trust.)

  5. #5
    alston Guest

    Default Re: Trojan-Spy.DeskAd.2

    I have also received this "trojan" detection when running ZA.It seems that there was a similar situation a few weeks ago with the win32.yok false positive.It turned out that spyware doctor (or perhaps other anti-virus program) was attempting to immunize against this trojan, by inserting a key in the registry. ZA saw this a key (incorrectly) as a problem andflagged it. Perhaps we have the same situation in this case.I'm wondering if most of these problems are cropping up shortly after updating anti-virus/spywareprograms.In the future before updating, I'll run ZA spyware and see if it comes up clean. Then I'll update.Then run ZA again and see what happens.Anyway, these are just my thoughts. I'm a newbie here so please forgive me if I've failed to expresse myself properly.

  6. #6
    camel Guest

    Default Re: Trojan-Spy.DeskAd.2

    i found it also in the same location in the registry but with a difference:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\W indows\CurrentVersion\Uninstall\WINGTK-2_is2 which is part of the Gimp program, must be a false reading i guess.

  7. #7
    toomuchdogfur Guest

    Default Re: Trojan-Spy.DeskAd.2

    Well I just got this one today during a routine scan! This time it was under the key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Shareaza_is1

    I've had Shareaza BEFORE ZoneAlarm was installed (a long time), so it seems as though this problem has only appeared in the latest round of updates. Also this is just speculation, but since all of our keys are uninstall keys with "_is1" or "_is2" tacked on the end, perhaps this is related somewhat to InstallShield? Well it makes sense, since I believe InstallShield is used by all of the programs mentioned.

    Phew... gave me a heart attack! Bloody made me change my eBay and Commonwealth Bank passwords!

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts