Trojan horse inside Nokia\Phoenix folder??? - GSM-Forum

Ciux · 04-07-2006, 08:40

Hallo Griffin team,
My Avast Profesioanl AntiVirus software find Trojan inside
this: C:\Program Files\Nokia\Phoenix\FlashUsb\hhk_usb_cleanup.exe

Trojan name is: Win32:Agent-MD [Trj]

This is info about this Trojan from Sophos web site:

***********************************************
Troj/Agent-MD is a Trojan downloader for the Windows platform.

Troj/Agent-MD includes functionality to download, install and run new software.
When Troj/Agent-MD is installed the following files are created:
<Windows>\svchost.exe
<System>\<random 18-character filename>
The file svchost.exe is registered as a new system driver service named "moto", with a display name of "svchost.exe" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\moto\
Troj/Agent-MD attempts to download three files from www.procounter.biz to the Windows System folder. At the time of writing, these files were unavailable for download.
**********************************************

I didn't start jet this hhk_usb_cleanup.exe.
Please, Griffin team, tell me is this false alarm or not?

Thanks in advance for answer,

Ivan

Ciux · 04-09-2006, 08:30

why nobody want to say nothing about this?
Is this false alarm or what?

SoftMobile · 04-09-2006, 17:13

Fake alarm from your antivirus software.

.:GSM International:. · 04-09-2006, 20:12

Quote:

Originally Posted by Ciux

Hallo Griffin team,
My Avast Profesioanl AntiVirus software find Trojan inside
this: C:\Program Files\Nokia\Phoenix\FlashUsb\hhk_usb_cleanup.exe

Trojan name is: Win32:Agent-MD [Trj]

This is info about this Trojan from Sophos web site:

***********************************************
Troj/Agent-MD is a Trojan downloader for the Windows platform.

Troj/Agent-MD includes functionality to download, install and run new software.
When Troj/Agent-MD is installed the following files are created:
<Windows>\svchost.exe
<System>\<random 18-character filename>
The file svchost.exe is registered as a new system driver service named "moto", with a display name of "svchost.exe" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\moto\
Troj/Agent-MD attempts to download three files from www.procounter.biz to the Windows System folder. At the time of writing, these files were unavailable for download.
**********************************************

I didn't start jet this hhk_usb_cleanup.exe.
Please, Griffin team, tell me is this false alarm or not?

Thanks in advance for answer,

Ivan

funny, that, i use avast too, and ive not had a problem.....chances are you already had it on your system before installing!

netgalaxy · 03-30-2007, 22:23

I HAVE A SAME PROBLEM TOO BUT I MA USING MCAFEE 8.5
IT IS DELETING ALL EXE FILES NOW.I AM NOT GETTING WHATS GONG ON WITH ME PC.aNY BODY HAVE PERMANET SOLTION??
TELLL ME URGENT

04-07-2006, 08:40	#1 (permalink)
Ciux No Life Poster Join Date: Feb 2006 Location: Croatia Age: 49 Posts: 501 Member: 234440 Status: Offline Thanks Meter: 20	Trojan horse inside Nokia\Phoenix folder??? Hallo Griffin team, My Avast Profesioanl AntiVirus software find Trojan inside this: C:\Program Files\Nokia\Phoenix\FlashUsb\hhk_usb_cleanup.exe Trojan name is: Win32:Agent-MD [Trj] This is info about this Trojan from Sophos web site: ********************************************* Troj/Agent-MD is a Trojan downloader for the Windows platform. Troj/Agent-MD includes functionality to download, install and run new software. When Troj/Agent-MD is installed the following files are created: <Windows>\svchost.exe <System>\<random 18-character filename> The file svchost.exe is registered as a new system driver service named "moto", with a display name of "svchost.exe" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under: HKLM\SYSTEM\CurrentControlSet\Services\moto\ Troj/Agent-MD attempts to download three files from www.procounter.biz to the Windows System folder. At the time of writing, these files were unavailable for download. ******************************************** I didn't start jet this hhk_usb_cleanup.exe. Please, Griffin team, tell me is this false alarm or not? Thanks in advance for answer, Ivan

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Dont Open Nokia 1661 Unlocker by Manole is Trojan Inside	Formingus	Off Topic Zone	0	02-19-2010 11:43
Trojan Horse!!! [SOLVED]	kcsystems	PolarBox 3	4	12-10-2009 17:31
+ Three new Trojan Horses Affecting Symbian S60 Devices	apocalypso	Nokia Multimedia	0	01-21-2006 19:56
Trojan Horse in version 7.10?	The Dog	Cruiser Suite	4	11-23-2005 20:12
play mp3 which is stored in subfolder inside mp3 folder	erwinsie	x1x to x45/x50	3	11-14-2003 06:51

04-09-2006, 08:30	#2 (permalink)
Ciux No Life Poster Join Date: Feb 2006 Location: Croatia Age: 49 Posts: 501 Member: 234440 Status: Offline Thanks Meter: 20	why nobody want to say nothing about this? Is this false alarm or what?

04-09-2006, 17:13	#3 (permalink)
SoftMobile No Life Poster Join Date: Feb 2002 Location: Hong Kong Posts: 4,330 Member: 9290 Status: Offline Sonork: 100.57287 Thanks Meter: 35	Fake alarm from your antivirus software.

03-30-2007, 22:23	#5 (permalink)
netgalaxy Crazy Poster Join Date: Jan 2006 Posts: 54 Member: 225135 Status: Offline Thanks Meter: 1	I HAVE A SAME PROBLEM TOO BUT I MA USING MCAFEE 8.5 IT IS DELETING ALL EXE FILES NOW.I AM NOT GETTING WHATS GONG ON WITH ME PC.aNY BODY HAVE PERMANET SOLTION?? TELLL ME URGENT