TR/Agent Trojan

**AgentX** · 03-03-2009, 04:31 AM

Having recently installed Replay Media Catcher, Avira AntiVir is detecting TR/Agent.507904 Trojan in C:/Program Files\Replay Media Catcher\plugins\plugin_zrtsp.dll (Windows Vista).

If I delete or quarantine the trojan it reappears upon next reboot.

How do I get rid of this - and why is it here?

**OhZone** · 03-03-2009, 08:41 AM

I just started to get the same thing. Avira started catching it today. I said to quarantine and media catcher tries to download the same plugin with the same trojan. Is it a false positive or what?

**AgentX** · 03-03-2009, 10:07 AM

That's true - it reappears when RMC downloads the plugin again.

**flvrec0r3r** · 03-03-2009, 03:27 PM

Upload the file to http://www.virustotal.com and report your results.

**Andy Heinlein** · 03-03-2009, 05:02 PM

Please use anti-virus software that is reputable and has been around for a while such as AVG. AVG has a free version and the AVG engineers know what is or is not a virus.

Of course this is a false report.

Some of the plug-ins are "compressed" using ASPack or PECompact to make them smaller. This saves on bandwidth as well as time spent downloading the plug-in. Because they are compressed, third rate anti-virus software report this file as a "virus" because it doesn't know how to decompress the plug-in properly. Because of this they throw up a red flag and say "Hi, we are too lazy to really analyze this file, so, it must be a virus!"

-andy.

**Andy Heinlein** · 03-03-2009, 05:44 PM

I recompiled the plug-in and didn't compress it with anything. Try it now. If it throws a flag, then there is something seriously wrong with your anti-virus software.

**AgentX** · 03-04-2009, 05:59 AM

I've just downloaded the recompiled plugin_zrtsp.dll and run Avira AntiVir.

No trojan reported

Avira AntiVir is reputable and has been around for a while (that's not to say it wasn't a false positive).

"Avira is a well-established name in Germany... its free PersonalEdition Classic product achieved a remarkable 92% detection rate in our tests... AntiVir is the most effective free antivirus package we've seen," PCPro Product Review July '07.