PDA

View Full Version : TR/Agent Trojan


AgentX
03-03-2009, 04:31 AM
Having recently installed Replay Media Catcher, Avira AntiVir is detecting TR/Agent.507904 Trojan in C:/Program Files\Replay Media Catcher\plugins\plugin_zrtsp.dll (Windows Vista).

If I delete or quarantine the trojan it reappears upon next reboot.

How do I get rid of this - and why is it here?
OhZone
03-03-2009, 08:41 AM
I just started to get the same thing. Avira started catching it today. I said to quarantine and media catcher tries to download the same plugin with the same trojan. Is it a false positive or what?
AgentX
03-03-2009, 10:07 AM
That's true - it reappears when RMC downloads the plugin again.
flvrec0r3r
03-03-2009, 03:27 PM
Upload the file to http://www.virustotal.com and report your results.
Andy Heinlein
03-03-2009, 05:02 PM
Please use anti-virus software that is reputable and has been around for a while such as AVG. AVG has a free version and the AVG engineers know what is or is not a virus.

Of course this is a false report.

Some of the plug-ins are "compressed" using ASPack or PECompact to make them smaller. This saves on bandwidth as well as time spent downloading the plug-in. Because they are compressed, third rate anti-virus software report this file as a "virus" because it doesn't know how to decompress the plug-in properly. Because of this they throw up a red flag and say "Hi, we are too lazy to really analyze this file, so, it must be a virus!"

-andy.
Andy Heinlein
03-03-2009, 05:44 PM
I recompiled the plug-in and didn't compress it with anything. Try it now. If it throws a flag, then there is something seriously wrong with your anti-virus software.
AgentX
03-04-2009, 05:59 AM
I've just downloaded the recompiled plugin_zrtsp.dll and run Avira AntiVir.

No trojan reported :o :o :o

Avira AntiVir is reputable and has been around for a while (that's not to say it wasn't a false positive).

"Avira is a well-established name in Germany... its free PersonalEdition Classic product achieved a remarkable 92% detection rate in our tests... AntiVir is the most effective free antivirus package we've seen," PCPro Product Review July '07.
MatthewC1000
03-04-2009, 07:12 AM
"Hi, we are too lazy to really analyze this file, so, it must be a virus!"

-andy.
That's what I like Applian support: They're polite & happy people and, have a sense of humour...:):cool:
AgentX
03-05-2009, 06:17 AM
Yes - and I forgot my manners. Thanks for sorting the problem and for the reassurance that it wasn't really a problem.