Results 1 to 3 of 3

Thread: Spybot detects Stration.C

  1. #1
    Junior Member
    Join Date
    Dec 2007
    Posts
    3

    Default Spybot detects Stration.C

    I first posted in safer networking forums/software/spybot S&D and was told to repost in the false positive

    I detect Stration.C with Spybot, I delete the worm, reboot and the worm is not there anymore
    However it comes back after a few reboots. It's in the Samsung HKEY, does it have something to do with Samsung ???


    My operating system is Windows XP SP2
    Browser is Internet Explorer 6.0
    Version of SpyBot is 1.3 with update 2007-11-28


    --- Report generated: 2007-12-03 14:46 ---

    Omniture: Tracking cookie (Internet Explorer: Owner) (Cookie, fixed)


    Microsoft.WindowsSecurityCenter_disabled: Settings (Registry change, fixed)
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start!=W=2

    Stration.C: Autorun settings (Samsung PanelMgr) (Registry value, fixed)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Samsung PanelMgr


    --- Spybot - Search && Destroy version: 1.3 ---
    2007-11-28 Includes\Cookies.sbi
    2007-10-31 Includes\Dialer.sbi
    2007-11-07 Includes\Hijackers.sbi
    2007-10-04 Includes\Keyloggers.sbi
    2007-11-07 Includes\Malware.sbi
    2007-11-28 Includes\Revision.sbi
    2007-05-30 Includes\Security.sbi
    2007-11-07 Includes\Spybots.sbi
    2007-11-28 Includes\Trojans.sbi
    2007-11-06 Includes\Tracks.uti
    2004-11-29 Includes\LSP.sbi
    2007-10-24 Includes\PUPS.sbi
    2007-11-28 Includes\TrojansC.sbi
    2007-11-28 Includes\SpybotsC.sbi
    2007-11-28 Includes\SecurityC.sbi
    2007-11-28 Includes\PUPSC.sbi
    2007-11-28 Includes\MalwareC.sbi
    2007-11-28 Includes\KeyloggersC.sbi
    2007-11-28 Includes\HijackersC.sbi
    2007-11-28 Includes\DialerC.sbi
    2007-06-06 Plugins\TCPIPAddress.dll

  2. #2
    Junior Member
    Join Date
    Dec 2007
    Posts
    3

    Default

    Quote Originally Posted by beaureg View Post
    I first posted in safer networking forums/software/spybot S&D and was told to repost in the false positive

    I detect Stration.C with Spybot, I delete the worm, reboot and the worm is not there anymore
    However it comes back after a few reboots. It's in the Samsung HKEY, does it have something to do with Samsung ???


    My operating system is Windows XP SP2
    Browser is Internet Explorer 6.0
    Version of SpyBot is 1.3 with update 2007-11-28


    --- Report generated: 2007-12-03 14:46 ---

    Omniture: Tracking cookie (Internet Explorer: Owner) (Cookie, fixed)


    Microsoft.WindowsSecurityCenter_disabled: Settings (Registry change, fixed)
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start!=W=2

    Stration.C: Autorun settings (Samsung PanelMgr) (Registry value, fixed)
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Samsung PanelMgr


    --- Spybot - Search && Destroy version: 1.3 ---
    2007-11-28 Includes\Cookies.sbi
    2007-10-31 Includes\Dialer.sbi
    2007-11-07 Includes\Hijackers.sbi
    2007-10-04 Includes\Keyloggers.sbi
    2007-11-07 Includes\Malware.sbi
    2007-11-28 Includes\Revision.sbi
    2007-05-30 Includes\Security.sbi
    2007-11-07 Includes\Spybots.sbi
    2007-11-28 Includes\Trojans.sbi
    2007-11-06 Includes\Tracks.uti
    2004-11-29 Includes\LSP.sbi
    2007-10-24 Includes\PUPS.sbi
    2007-11-28 Includes\TrojansC.sbi
    2007-11-28 Includes\SpybotsC.sbi
    2007-11-28 Includes\SecurityC.sbi
    2007-11-28 Includes\PUPSC.sbi
    2007-11-28 Includes\MalwareC.sbi
    2007-11-28 Includes\KeyloggersC.sbi
    2007-11-28 Includes\HijackersC.sbi
    2007-11-28 Includes\DialerC.sbi
    2007-06-06 Plugins\TCPIPAddress.dll
    I tried to install AVG 7.5 and get the following message when trying to install
    Local machine: installation failed
    Installation:
    Error: Action failed for file contact_us.txt: creating file....
    Permission denied
    Warning: Action failed for registry value HKLM\SOFTWARE\Classes\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}:409: creating registry value....
    Access is denied. (5)
    Rollback:
    Error: Action failed for registry value HKLM\SOFTWARE\Classes\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}:409: restoring registry value....
    Access is denied. (5)
    Error: Action failed for file contact_us.txt: removing file....
    Access is denied. (5) %PATH% = "C:\Program Files\Grisoft\AVG7\contact_us.txt"

  3. #3
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,955

    Default

    Hello.

    --- Spybot - Search && Destroy version: 1.3 ---
    The log is from an outdated version of Spybot-S&D.

    Spybot-S&D is now at Version 1.5






    Available as a Beta which resolves some minor issues found in the first release:
    http://forums.spybot.info/showthread.php?t=20250

    Beta Forum: http://forums.spybot.info/forumdisplay.php?f=12

    Please upgrade and then produce a log.
    How to report False Positives

    Cheers.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •