AVG Detection - Virus or False Positive?

[MinusTheBear]

Resident Shield detection detected this

"Trojan horse BackDoor.Ircbot.JAO";"C:\Windows\System32\igfxzoom.exe";"Infected";"13/07/2009, 2:35:56 PM";"file";"C:\Windows\System32\svchost.exe"

I googled this and did not receive much info. Seems to have popped up within the last 48 hours. Here is a link to one discussion.


http://community.spiceworks.com/topic/71888

Any advice is appreciated.

Thanks!

 

[vizionut]

I would scan with malwarebytes if you have it. If you dont you can find it cnet.com for free.

 

[highfigh]

According to http://computerhaven.info/forum/tm.aspx?high=&m=91689&mpage=1#91691, it's a Dell driver.

 

[MinusTheBear]

According to http://computerhaven.info/forum/tm.aspx?high=&m=91689&mpage=1#91691, it's a Dell driver.

What does that mean then?

 

[bandphan]

Ive used this removal tool before and copied the instructions from the afterdawn forum





Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer into Safe Mode by doing the following:
• Restart your computer
• After pressing the power button, repeatedly tap the F8 key.
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose the administrator's account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.

 

[MinusTheBear]

I dug around the AVG forum and found 3 threads. Its funny that these threads did not show up in the google searchers I performed. Based on the responses it sounds like a false positive which is good news.

http://forums.avg.com/ww.avg-free-forum?sec=thread&act=show&id=4959

http://forums.avg.com/ww.avg-free-forum?sec=thread&act=show&id=4981

http://forums.avg.com/ww.avg-free-forum?sec=thread&act=show&id=5111

 

[lsiberian]

What does that mean then?

It means that Dell uses a trojan to get information on you. Big brother is watching you and we all want to know why. Please share. Confession always helps.

It's a false positive.