Webhancer

[John Allen]

MSAS reported Webhancer spyware with recommended action = Ignore. The
detected locations were:
c:\windows\temp\jet85b5.tmp
c:\windows\temp\jet89c1.tmp

Looks like a false positive to me - any advice?

Thanks

John Allen

 

[Guest]

Hello John,

Go to

signatures
Subject: Webhancer
12/4/2005
By: David

I hope that post is helpful, let us know how it works ºut

Engel

 

[Randy Knobloch]

MSAS reported Webhancer spyware with recommended action = Ignore. The
detected locations were:
c:\windows\temp\jet85b5.tmp
c:\windows\temp\jet89c1.tmp

Looks like a false positive to me - any advice?

Not a false positive, falsely flagged to ignore!
You may be under a Hijack situation.
Download and run HijackThis;
(http://aumha.org/downloads/hijackthis.zip)
Read this Tutorial *before* first use;
(http://www.bleepingcomputer.com/forums/index.php?showtutorial=42)
Once done > run HijackThis > save a scan log and post it to /any/ of the
following (expert) forums for analysis.
*Note, registration is required prior to posting a log.
- Not listed in any particular order -
(http://aumha.net/viewforum.php?f=30)
(http://www.bleepingcomputer.com/forums/forum22.html)
(http://www.dslreports.com/forum/security)
(http://castlecops.com/forum67.html)
(http://www.cybertechhelp.com/forums/forumdisplay.php?f=25)
(http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html)
(http://gladiator-antivirus.com/forum/index.php?showforum=170)
(http://forum.iamnotageek.com/f-130.html)
(http://forums.maddoktor2.com/index.php?showforum=17)
(http://www.spywarewarrior.com/viewforum.php?f=5)
(http://forums.spywareinfo.com/index.php?showforum=18)
(http://forums.techguy.org/f54-s.html)
(http://forums.tomcoyote.org/index.php?showforum=27)
(http://forums.subratam.org/index.php?showforum=7)
(http://www.5starsupport.com/ipboard/index.php?showforum=18)

Post back the URL where you posted your log *here* (not) the entire
HijackThis log -

 

[John Allen]

Thanks for the link

John

Hello John,

Go to

signatures
Subject: Webhancer
12/4/2005
By: David

I hope that post is helpful, let us know how it works ºut

Engel

 

[John Allen]

Thanks Randy

HijackThis showed nothing unusual, Adaware, Spybot showed nothing
Asked MSAS to remove the threat and it has not reappeared and
everything works OK.

John

 

[Randy Knobloch]

Thanks Randy

HijackThis showed nothing unusual, Adaware, Spybot showed nothing
Asked MSAS to remove the threat and it has not reappeared and
everything works OK.

Good to hear that things seem back to normal, John, but I'd highly recommend
that you have your log analysed by a Hijack handler at one of the Forums that
I posted, it's as simple as registering and posting your log to the appropriate URL.

Reminding you that MSAS is still in Beta and may not have detected the entire
threat.

Your call.

Regards,


--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.

 

[John Allen]

Thanks, I will do that.

John

Good to hear that things seem back to normal, John, but I'd highly recommend
that you have your log analysed by a Hijack handler at one of the Forums that
I posted, it's as simple as registering and posting your log to the appropriate URL.

Reminding you that MSAS is still in Beta and may not have detected the entire
threat.

Your call.

Regards,