Win32.Agent.cs

[tomoz]

Not sure if this is a false positive but neither Norton, nor Superantispyware, Counterspy or Cureit show anything.

I attach the latest SB reports - I even uninstalled and reinstalled SB but fixing by SB does not really fix anything, the same alert just pops up again. The first time the alert happened was when I was checking out either some Ebay Listing or a computer website - both Norton and Spybot came up at the time. I denied / blocked this and shut down my internet connection. Norton now does not show anything but SP still comes up with a warning re win32. agent.cs. - the alert references a registry entry which in turn refers to ...spooll.exe under application/ data etc. However I cannot even find the folder under application data that is referenced even though I have turned of hidden folders.

[glennhubbster]

Hi Tomoz

How do you manage to generate those reports?
Wish I knew.

[tomoz]

Hi Tomoz

How do you manage to generate those reports?
Wish I knew.

You find the reports in your logs folder wherever your SB is storing them, probably under AppData/User/Spybot/Logs

[Yodama]

hello,

this does not look like a false positive, the the file you name is aimed at looking like a system file. However the file is not existent otherwise it would be listed in the results as well. So what Spybot S&D flags here is a system start item with a dead reference.
You should do the following to see if there is any remaining infection :

do a scan with Spybot S&D
right click the scan results screen
choose to save the full report to file
attach this report file to your next post


With this we will be able to tell if there are other parts of Win32.Agent.cs installed on your computer.

[Yodama]

if the log file is too large you can also email it to detections@spybot.info with a reference to this thread