Results 1 to 6 of 6

Thread: What is Win32.Trojan.Aavirus.1

  1. #1
    trainman Guest

    Default What is Win32.Trojan.Aavirus.1

    I did a search for Win32.Trojan.Aavirus.1 and found a couple of messages which mention this is a false positive for Adobe reader. Is mine a false positive, too? Zone Alarm identified a CLSID:

    HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{60409BC 0-4978-11d6-9E1E-204C4F4F5020}

    Should I get rid of it or just ignore it.

    Thanks for any help you can give.

    Trainman

    Operating System:Windows Vista Home Premium
    Software Version:7.1 (Vista)
    Product Name:ZoneAlarm Internet Security Suite

  2. #2
    findley Guest

    Default Re: What is Win32.Trojan.Aavirus.1


    <blockquote><hr>trainman wrote:
    I did a search for Win32.Trojan.Aavirus.1 and found a couple of messages which mention this is a false positive for Adobe reader. Is mine a false positive, too? Zone Alarm identified a CLSID:

    HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{60409BC 0-4978-11d6-9E1E-204C4F4F5020}

    Should I get rid of it or just ignore it.

    Thanks for any help you can give.

    Trainman

    Operating System:
    Windows Vista Home Premium
    Software Version:
    7.1 (Vista)
    Product Name:
    ZoneAlarm Internet Security Suite

    <hr></blockquote>trainman,
    If found this at http://www.siteadvisor.com/sites/wom...loads/3984555/

    indicating the registry key above is installed by wombatsaverV2
    More information at link posted above.


    WombatSaverV2

    &quot;The following modifications to the system registry were detected:<div class="codeBlockLrg"><pre>CHANGE [HKEY_CURRENT_USER\Control Panel\Desktop]ADD SCRNSAVE.EXE=&quot;C:\\WINDOWS\\WOMBAT~1.SCR&quot; CHANGE ScreenSaveActive=&quot;1&quot;CHANGE [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion]ADD SCRNSAVE.EXE=&quot;C:\\WINDOWS\\WOMBAT~1.SCR&quot; ADD [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60409BC 0-4978-11d6-9E1E-204C4F4F5020}]ADD [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{60409BC 0-4978-11d6-9E1E-204C4F4F5020}\WombatSaverV2]ADD Data=hex:d7,07,09,00,05,00,1c,00,17,00,1e,00,17,00 ,00,00</pre><pre>
    </pre><pre>(End quote)</pre><pre>
    </pre><pre>See link above for more information</pre><pre>Findley
    </pre>

  3. #3
    trainman Guest

    Default Re: What is Win32.Trojan.Aavirus.1

    I have a brand new Fujitsu laptop but don't have WombatSaverV2 installed. It did come with the Flash8.ocx installed in the location mentioned in the link, so that must be it. I guess I'll just leave it alone.

    Thanks for your help.

    Trainman

  4. #4
    findley Guest

    Default Re: What is Win32.Trojan.Aavirus.1

    trainman,

    You are welcome and since this looks like a false positive you could submit your information to Zone Alarm for confirmation.

    Report the false positive to:
    http://www.zonealarm.com/store/conte...are_report.jsp

    Be sure to report as much details as possible to Zone Alarm so that they can fix it.
    Use Internet Explorer browser to submit the report - other alternative browsers, Firefox, Opera and others are not recommended for use in submitting report to Zone Alarm.

    Findley

  5. #5
    trainman Guest

    Default Re: What is Win32.Trojan.Aavirus.1

    Findley:

    I'll run the scan again and note all the details, then submit it. Thanks for the tip about browsers; I use Firfox.

    Thanks again for your help.

    Robin

  6. #6
    findley Guest

    Default Re: What is Win32.Trojan.Aavirus.1

    Robin,
    Sounds good and please post back any information on this you receive from the false positive report submitted to zone alarm.
    Regards,Findley

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •