Good morning USA;)
Yesterday, when using my laptop, I have a WSA mesage: "this site is not secure".
Then I saw on the security bookmark: "1 threat has been elimanted".
Is it possible to see what was this threat?
A threat has been eliminated
Page 1 / 2
I don't see Rakanisheu online this morning, but I might be able to help.
It's hard to say just based on the file name. The file name alone doesn't tell us as much as the MD5 of the file would. The MD5 is submitted automatically when you contact us via the support system, which is why we suggest using that system in all cases of false positives or infections.
That said, I'm leaning more towards it being an infection, based on this. However, we won't really know for sure until we get a closer look, since file names alone can be misleading. If you update your support case, we can provide a better answer since we'll have more data to go on.
It's hard to say just based on the file name. The file name alone doesn't tell us as much as the MD5 of the file would. The MD5 is submitted automatically when you contact us via the support system, which is why we suggest using that system in all cases of false positives or infections.
That said, I'm leaning more towards it being an infection, based on this. However, we won't really know for sure until we get a closer look, since file names alone can be misleading. If you update your support case, we can provide a better answer since we'll have more data to go on.
Looking at the file now (MD5:C8BB4B1F3E8B5AB8809B836119209188). What makes you think its good(it might be I am still investigating it)?
@ wrote:
Update: I have marked that file as good.
Thanks!
Hello Rakanisheu
I'm not sure, it was a guess because the file looked like to those of my professional software.
Thanks Jim@ wrote:
I don't see Rakanisheu online this morning, but I might be able to help.
It's hard to say just based on the file name. The file name alone doesn't tell us as much as the MD5 of the file would. The MD5 is submitted automatically when you contact us via the support system, which is why we suggest using that system in all cases of false positives or infections.
That said, I'm leaning more towards it being an infection, based on this. However, we won't really know for sure until we get a closer look, since file names alone can be misleading. If you update your support case, we can provide a better answer since we'll have more data to go on.
This thread was on my old laptop and I cannot access to it before Saturday evening or Sunday.
You wont need to submit logs, I found the file in our database and its now good. Saves you doing any work 🙂
Thanks Rakanisheu:D@ wrote:
You wont need to submit logs, I found the file in our database and its now good. Saves you doing any work :)
But I don't understand the link given by Jim:@ :
http://www.prevx.com/filenames/X460799281356301372-X1/HDCTRLEX.DLL.html#nogo
Can you explain to me ?
That page is out of date since I just changed the database entry for that file. I assume it will autoupdate soon enough.
Thanks Rakanisheu:D
Can you tell me if this file is really a file of my professional program ?
Can you tell me if this file is really a file of my professional program ?
Hello Roy;)
I'm sorry to insist but I don't understand what I have to do.
Now I'm at home and I run my laptop, and I see that the suspicious file ("hdctrlex.dll") remains in the quarantine.
I don't know if I can restore it?
I'll send you a PM with the report of detection.
I'm sorry to insist but I don't understand what I have to do.
Now I'm at home and I run my laptop, and I see that the suspicious file ("hdctrlex.dll") remains in the quarantine.
I don't know if I can restore it?
I'll send you a PM with the report of detection.
Another think that I don't understand is that the page above reports always that the file hdctrlex.dll is a "fraudulent security program".@ wrote:
Thanks Rakanisheu:D@ wrote:
You wont need to submit logs, I found the file in our database and its now good. Saves you doing any work :)
But I don't understand the link given by Jim:@ :
http://www.prevx.com/filenames/X460799281356301372-X1/HDCTRLEX.DLL.html#nogo
Can you explain to me ?
Thanks Daniel for the info;)@ wrote:
Hi Robert you can call him Roy if you like!
Daniel
Replied to the PM! The file is good and can be restored. The prevx information is out of date.
Hi Roy,
Thanks for your help:D
I have restored the file, even if my laptop continued to works well without it.
Then I launched an analyse and the laptop is clean.
Good Sunday!
Robert
Thanks for your help:D
I have restored the file, even if my laptop continued to works well without it.
Then I launched an analyse and the laptop is clean.
Good Sunday!
Robert
Hi Roy,
I think that's WSA-C have blocked another sure file on my home PC this time:
Automated Cleanup Engine Starting Cleanup at 30/06/2013 - 16:05:42 GMT Starting Routine> Removing c:users
obertdesktoplanguagepack_french.exe...#(PX5: - MD5: D2AFB7BBE8DDF4C4BD05537BD1598870)... Deleting File> c:users
obertdesktoplanguagepack_french.exe
Is it this a false positive ?
I think that's WSA-C have blocked another sure file on my home PC this time:
Automated Cleanup Engine Starting Cleanup at 30/06/2013 - 16:05:42 GMT Starting Routine> Removing c:users
obertdesktoplanguagepack_french.exe...#(PX5: - MD5: D2AFB7BBE8DDF4C4BD05537BD1598870)... Deleting File> c:users
obertdesktoplanguagepack_french.exe
Is it this a false positive ?
Hello Robert I can't tell for sure but to me it looks like an FP and I did a Search on VT using your MD5 Hash File D2AFB7BBE8DDF4C4BD05537BD1598870 as only Symantec came up with some kind of detection so it's best to wait for a conformation from Roy or another Threat Researcher. I wish Webroot was listed on VT as I made a suggestion maybe if a few more will Kudo it they will look at again as it's on Hold. http://community.webroot.com/t5/Ideas-Exchange/Adding-a-Webroot-SDK-to-VirusTotal/idi-p/7462#.UdBubW2DmJO :D
HTH,
Daniel 😉
HTH,
Daniel 😉
I agree Daniel. If I could cheat and Triple Kudo it, I would. 😃@ wrote:
I wish Webroot was listed on VT as I made a suggestion maybe if a few more will Kudo it they will look at again as it's on Hold.
Hi@ wrote:
Hello Robert I can't tell for sure but to me it looks like an FP and I did a Search on VT using your MD5 Hash File D2AFB7BBE8DDF4C4BD05537BD1598870 as only Symantec came up with some kind of detection so it's best to wait for a conformation from Roy or another Threat Researcher. I wish Webroot was listed on VT as I made a suggestion maybe if a few more will Kudo it they will look at again as it's on Hold. http://community.webroot.com/t5/Ideas-Exchange/Adding-a-Webroot-SDK-to-VirusTotal/idi-p/7462#.UdBubW2DmJO :D
HTH,
Daniel ;)
Thanks Daniel!
Idea kudoed;)
Now I wait the Roy's answer.
Not sure why that file was removed on your PC, its not bad in our database. I have whitelisted the file in anycase, its not behaviour is not malicious and its associated files/processes are good. WSA not being on VT doesnt really bother me too much, VT is only a rough guide and should never be taken as gospel.
That doesnt look like it was us that removed that! My french is rusty is that saying that the file was not downloaded to your PC as it may cause damage?
No it says that this file was rarely downloaded and should be insecure.
The file was deleted by WSA-C after I have accepted to download it......
The file was deleted by WSA-C after I have accepted to download it......
Page 1 / 2
Reply
Login to the community
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.