ATTENTION: You are viewing a page formatted for mobile devices; to view the full web page, click HERE.

Main Area and Open Discussion > General Software Discussion

Windows Security Essentials

<< < (18/28) > >>

Thanks for the feedback on my post.
@f0dder: I went to M/soft virus Encyclopedia and looked at those "viruses" detected by MSE. None of them seemed to be false positives, though they were not too nasty-looking.

As @Bamse ponted out - "without user consent" would be the trigger, or "Potentially harmful or otherwise unwanted" as I think M/soft describe it.

Mind you "unwanted" could include Adware, M/soft Windows Genuine Advantage and all those annoying and unnecessary plugins (e.g., DRM and Windows Media Player plugins) that M/soft has been quietly forcing into Firefox without telling you, every time you run Windows Update. One of those plugins Mozilla now blocks as it introduces a security risk and destabilises Firefox performance.    :P

@Bamse: Thanks for the advice - I have taken it and have changed the default actions in MSE to "Quarantine" from "Recommended" and unticked the box beneath for "apply recommended actions:...".

@Innuendo: I had not known of VirusTotal before now, thankyou. I shall use that in future now that I have set MSE actions all to "Quarantine". Actually, the file containing one of the viruses (I forget which one) found by MSE was uploaded to M/soft - the program requested permission to do so first, and I gave it. I also sent an email to the author of Unlocker with a snapshot of the MSE details screen describing the Trojan that MSE had found in the Unlocker install file.

I generally mistrust M/soft as they are a perfect example of a corporate psychopath (per the film "The Corporation") and I therefore use their software with well-advised caution. I try to control that software by, for example, stopping it from "phoning home" in ZoneAlarm. When you see how M/soft have forced those Firefox plugins on you, it speaks volumes about their motivation and shows their deliberate intention to put their needs/desires first and their often crass disregard for the needs of the customer/victim.   ;D

Thanks for the feedback on my post.
@f0dder: I went to M/soft virus Encyclopedia and looked at those "viruses" detected by MSE. None of them seemed to be false positives, though they were not too nasty-looking.-IainB (October 18, 2009, 05:22 PM)
--- End quote ---

I think F0dder's point wasn't how nasty-looking they were but MSE might have though the virus code was in those files when in reality there might have been nothing there. Every AV program has a false detection like that once in a while. Nobody & nothing is perfect, after all...

That is true

4 hours later perfect again

Yes, I wish Iain had uploaded the files to VirusTotal before deleting them, but I can totally understand his "get these files off my PC *NOW*!" reaction.

--- End quote ---
Anything to oblige!  :)  As it is a long weekend here in NZ and because I am very curious about such things, I took the time to search out those infected files from my backup drive and then run them through MSE and submit them to Total Response as you had suggested.

There were 5 viruses detected by MSE:

* 1. BrowserModifier Win32-Hijacker.A in file ico_printui0008.ico ("removed" by MSE).
* 2. TrojanDownloader-ASX-Wimad.BD in a partially donloaded Frostwire file T-3410427-connected barbie.mp3 (virus in ASF_Script_Commands)  ("removed" by MSE).
* 3. TrojanClicker:Win32/Yabector.gen and TrojanClicker:Win32/Yabector.A in 2 separately obtained copies of file unlocker1.8.7.exe (quarantined by MSE).
* 4. VirTool:Win32/Obfuscator.XY in file FreeskyVideotoMPEG.exe (quarantined by MSE)
* 5. Trojan:JS/Loop in filr (quarantined by MSE).
I was unable to locate backup copies of infected files Nos. 1 and 2, but I did have Nos. 3, 4 and 5, and I have detailed them below:

3. My copy of MSE detected TrojanClicker:Win32/Yabector.gen in my Archive copy of File unlocker1.8.7.exe
Virus Total report:
File unlocker1.8.7.exe was already a known file, received on 2009.10.24 22:11:12 (UTC)
Result: 4/41 (9.76%)
Microsoft 1.5202    2009.10.24    TrojanClicker:Win32/Yabector.gen
NOD32    4539       2009.10.24    a variant of Win32/Adware.ADON
Prevx    3.0       2009.10.25    Medium Risk Malware
VirusBuster    2009.10.24    Trojan.CL.Yabector.C

This file was downloaded from
When I downloaded a fresh copy of the same file from the same location, my copy of MSE detected TrojanClicker:Win32/Yabector.A
Virus Total report:
File unlocker1.8.7.exe received on 2009.10.25 06:19:07 (UTC)
Result: 5/41 (12.2%)
Ikarus   T3.   2009.10.25   Trojan-Clicker.Win32.Yabector
Microsoft 1.5202   2009.10.25   TrojanClicker:Win32/Yabector.A
NOD32 4539      2009.10.24   a variant of Win32/Adware.ADON
Prevx   3.0      2009.10.25   Medium Risk Malware
Sunbelt   3.2.1858.2   2009.10.24   Trojan.Win32.Generic!BT

Firefox did not block or give any cautions for

4. My copy of MSE detected: VirTool:Win32/Obfuscator.XY in file FreeskyVideotoMPEG.exe
Virus Total report:
File FreeskyVideotoMPEG.exe received on 2009.10.24 22:03:46 (UTC)
Result: 2/41 (4.88%)
Kaspersky   2009.10.24   Packed.Win32.Black.d
Microsoft   1.5202      2009.10.24   VirTool:Win32/Obfuscator.XY

This file was downloaded from
When I browsed to the FreeskyVideotoMPEG link, Firefox blocked and told me it is a "reported attack site".
5. My copy of MSE detected: Trojan:JS/Loop in filr
Virus Total report:
File was already a known file, received on 2009.08.22 12:13:58 (UTC)
Result: 5/41 (12.20%)
Contained viruses:
BitDefender    7.2    2009.08.22    JS.Trojan.Winbomb.F
F-Prot    2009.08.21    File is damaged
GData    19       2009.08.22    JS.Trojan.Winbomb.F
Microsoft    1.4903    2009.08.22    Trojan:JS/Loop
Panda    2009.08.22    Generic Trojan

This file was downloaded from and is for setting up a program called "1st Page 2000".
Currently, this file is advertised as being available from, but neither the download function nor any mirrors seem to work for that file.
Firefox did not block or give any cautions for

Hope this information helps or is of use. I think it shows that MSE seems to be doing its job quite well.

I think it shows that MSE seems to be doing its job quite well.-IainB (October 25, 2009, 02:22 AM)
--- End quote ---

Microsoft has already started beta-testing the next version & already has a new version out to testers. It appears they are very serious about improving MSE. I can't wait to see how the next release performs.

EDIT: Oh! And thanks for digging out those files for us, Iain. I know that had to be a pain to do.


[0] Message Index

[#] Next page

[*] Previous page

Go to full version