Click here to get back home

Win32.TrojanSpy.Goldun False Positive?
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.security.virus    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Win32.TrojanSpy.Goldun False Positive? 1234 01-27-2008
Posted by 1234 on January 27, 2008, 5:16 pm
Please log in for more thread options
 Hello,

I started a thread 1-12-08 about Ad-Aware finding this Trojan. I did
nothing to eliminate it, and several subsequent checks with Ad-Aware showed
nothing.

I am still treating the machine as infected and plan to restore the original
HP Recovery partition CDs.

Has anyone seen this appearance and disappearance act, and could this be
considered a "false positive"?

Thanks for any thoughts,
Ellen



Posted by David H. Lipman on January 27, 2008, 5:40 pm
Please log in for more thread options
| Hello,
|
| I started a thread 1-12-08 about Ad-Aware finding this Trojan. I did
| nothing to eliminate it, and several subsequent checks with Ad-Aware showed
| nothing.
|
| I am still treating the machine as infected and plan to restore the original
| HP Recovery partition CDs.
|
| Has anyone seen this appearance and disappearance act, and could this be
| considered a "false positive"?
|
| Thanks for any thoughts,
| Ellen
|

Yes. Your information indicates a False Positive declaration.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Posted by 1234 on January 27, 2008, 6:19 pm
Please log in for more thread options

>
> | Hello,
> |
> | I started a thread 1-12-08 about Ad-Aware finding this Trojan. I did
> | nothing to eliminate it, and several subsequent checks with Ad-Aware
> showed
> | nothing.
> |
> | I am still treating the machine as infected and plan to restore the
> original
> | HP Recovery partition CDs.
> |
> | Has anyone seen this appearance and disappearance act, and could this be
> | considered a "false positive"?
> |
> | Thanks for any thoughts,
> | Ellen
> |
>
> Yes. Your information indicates a False Positive declaration.
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>

Dave,

Thank you for this. Would YOU consider the machine in question to be
uninfected, or feel comfortable treating it as such?

Ellen



Posted by David H. Lipman on January 27, 2008, 6:34 pm
Please log in for more thread options


| Dave,
|
| Thank you for this. Would YOU consider the machine in question to be
| uninfected, or feel comfortable treating it as such?
|
| Ellen
|

There is NO way from here I can consider your machine "uninfected". You may
have something
on your PC that Ad-aware has no signatures for. That's the only anti malware
application
you indicated you used.

I can say that if an anti malware declared an infection with one signature
release and then
a subsequent signature release no longer identifies it, then the original
declaration was
falsely made.

What else have you used beside Ad-aware to scan your PC ?

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Posted by 1234 on January 27, 2008, 6:56 pm
Please log in for more thread options

>
>
> | Dave,
> |
> | Thank you for this. Would YOU consider the machine in question to be
> | uninfected, or feel comfortable treating it as such?
> |
> | Ellen
> |
>
> There is NO way from here I can consider your machine "uninfected". You
> may have something
> on your PC that Ad-aware has no signatures for. That's the only anti
> malware application
> you indicated you used.
>
> I can say that if an anti malware declared an infection with one signature
> release and then
> a subsequent signature release no longer identifies it, then the original
> declaration was
> falsely made.
>
> What else have you used beside Ad-aware to scan your PC ?
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>

Dave,

What I MEANT to say was would you consider the machine
"Win32.TrojanSpy.Goldun-free?", as in, do you normally trust a False
Positive indication?

That was my real question.
Ellen



Similar ThreadsPosted
TrojanSpy.Goldun --- Format=Cure? January 12, 2008, 9:07 pm
Zone Alarm Pro - False Positive Report of Ardamax.e? November 12, 2007, 9:31 am
Is this a false positive or bug with IE 6, McAfee 8/9/10 or both IE 6 and McAfee? June 26, 2006, 6:57 am
TROJAN.GOLDUN December 17, 2005, 10:40 am
trojan.goldun January 5, 2006, 3:52 pm
False Reading? November 10, 2005, 3:43 pm
WIN2000NT False prophets(!). November 19, 2005, 7:21 am
seemingly false "webmaster" reports? November 6, 2005, 10:13 am
Exploit.Win32.WMF-PFV February 22, 2006, 9:35 am
win32/beovens April 9, 2006, 1:11 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap