Search
Forum Home | Login
gavin63
gavin63
Join Date 04/2007
0

wbload.dll

Detected as W32 Trojan

June 22, 2007 1:01:15 AM from WinCustomize ForumsWinCustomize Forums
Hi there

I am running Zone Alarm Firewall with Antivirus and for some reason it detected wbload.dll in my system32 folder as a trojan and quarantined it. I have restored the file back as it is a dll process to load Window Blinds

Anyone else had this problem at all and is there a work around
Locked Post
Search this post
Advanced Search
Subscription Options
Reason for Karma (Optional)
Successfully updated karma reason!
2 Pages1 2 
gavin63
gavin63
Join Date 04/2007
0
Reply #1 June 22, 2007 1:02:08 AM
from WinCustomize ForumsWinCustomize Forums
PS sorry forgot to say my thanks
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Bichur
Join Date 10/2003
+253
Reply #2 June 22, 2007 1:45:27 AM
from WinCustomize ForumsWinCustomize Forums
not yet, but TrendMicro just picked up JPGUtils.dll as a keylogger
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Neil Banfield
Join Date 04/2001
+1104 sdemployee
Reply #3 June 22, 2007 4:24:08 AM
from WinCustomize ForumsWinCustomize Forums

It sounds like ZoneAlarm need to work on their AV part a little more.

wbload.dll is not a trojan.

Reason for Karma (Optional)
Successfully updated karma reason!

Sign Up or Login and this ad disappears!
There are many great features available to you once you register. Sign Up for a free account and browse the forums without ads.

gavin63
Stephen Lee-Woolf
Join Date 07/2001
0
Reply #4 June 22, 2007 5:24:39 AM
from WinCustomize ForumsWinCustomize Forums
Maybe not, but my installation of Kaspersky 7.0 just reported the same thing. Have been forced to uninstall WindowBlinds just to get the system to boot up properly!
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Neil Banfield
Join Date 04/2001
+1104 sdemployee
Reply #5 June 22, 2007 7:57:58 AM
from WinCustomize ForumsWinCustomize Forums
Which version of Windows and what trojan do they think it is?
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Stephen Lee-Woolf
Join Date 07/2001
0
Reply #6 June 22, 2007 9:24:27 AM
from Stardock ForumsStardock Forums
Windows XP Professional SP2 with all subsequent fixes/patches
Trojan reported as: Trojan.Win32.Agent.es (aka Vernet by McAfee)
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Neil Banfield
Join Date 04/2001
+1104 sdemployee
Reply #7 June 22, 2007 10:06:07 AM
from WinCustomize ForumsWinCustomize Forums

Are you 100% sure it was wbload.dll it complained about and not one of the other WB dlls?

wbload.dll is not used on Windows XP, only later versions of Windows.

Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
yrag
Join Date 08/2001
+393
Reply #8 June 22, 2007 11:27:33 AM
from WinCustomize ForumsWinCustomize Forums
Kaspersky 7.0 just reported the same thing


Zone Alarm Firewall with Antivirus




ZA uses Kaspersky. It's a false positive. Update your definitions.

If it still comes up positive on a scan then scan it here: WWW Link
If it shows nothing, exclude it.
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Stephen Lee-Woolf
Join Date 07/2001
0
Reply #9 June 22, 2007 11:33:26 AM
from WinCustomize ForumsWinCustomize Forums


ZA uses Kaspersky. It's a false positive. Update your definitions.


Yes it does - but only from Version 7 onwards (which has only been released in the last 2-3 months. The original post did not specify the version used.

Definitions ARE up to date!
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
yrag
Join Date 08/2001
+393
Reply #10 June 22, 2007 11:48:14 AM
from WinCustomize ForumsWinCustomize Forums
You're both using the same main kernel driver: V7 (e.g. Klif.sys)
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
tranle
Join Date 10/2005
0
Reply #11 June 22, 2007 3:07:12 PM
from Stardock ForumsStardock Forums
I have also got a trojan (Generic5.AJZ) warning using AVG antivirus on C:\windows\system32\wbload.dll.

So for now it is quarantined.
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Ladysarajane
Join Date 07/2003
0
Reply #12 June 22, 2007 11:54:36 PM
from Stardock ForumsStardock Forums
I too have recieved the Trojan Horse Generic5.ajz from AVG antivirus warning from wbload.dll. My antivirus already deleted it. Mine is also quarantined. I have the latest defintions from AVG also.
Strange the Stardock Central updated Windowblinds this evening and then this popped up an hour later.
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Iain Whitehead
Join Date 08/2005
0
Reply #13 June 23, 2007 5:40:09 AM
from WinCustomize ForumsWinCustomize Forums
Ditto the above - anyone filed the issue with support or heard anything yet?

It's probably a false positive - but theres no point in updating your antivirus and then ignoring what it says!
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Neil Banfield
Join Date 04/2001
+1104 sdemployee
Reply #14 June 23, 2007 5:44:45 AM
from WinCustomize ForumsWinCustomize Forums

It seems that the latest virus definitions from a few companies all have the same false positive in them.  This suggests they all share data, either that or one of them has some explaining to do!

We will be contacting the companies & requesting they correct their definitions as a matter of some urgency.  Perhaps in the future they will do a better job of checking their definitions....

Testing here seems to suggest it is only triggering on a 20K version of wbload.dll which is included with some of the XP versions of WB.  This file dates from 2005 and I suspect its size (it contains almost no code) has resulted in a signature clash where it looks like a different file to the AV apps.

If you are running XP 32 bit it is perfectly safe to allow it to quarantine that file.  If the same file gets detected on Vista then the removal of that file will stop WB from functioning correctly, but the Vista file is much larger and AVG seems happy with it.

If anyone has a problem with any other AV packages and wbload.dll please post here so we can contact them and get them to correct their definitions.  I suspect Norton AV etc all use their own definitions and so are unlikely to make the same mistake.

 

Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Iain Whitehead
Join Date 08/2005
0
Reply #15 June 23, 2007 5:44:59 AM
from WinCustomize ForumsWinCustomize Forums
Hang on a minute.....

AVG tells me that not only is my latest wbload.dll infected - but also the ten or so archived copies that were auto backed-up at the time of previous updates (I forgot to delete them)..

so it MUST be a virus signature false positive and therefore ok to ignore
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Neil Banfield
Join Date 04/2001
+1104 sdemployee
Reply #16 June 23, 2007 6:43:24 AM
from WinCustomize ForumsWinCustomize Forums
I did some searching and it seems AVG uses definitions from Kaspersky and Kaspersky seem to have had a number of false positive issues in the last week.
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Erk.
Join Date 10/2003
+77
Reply #17 June 23, 2007 6:59:04 AM
from WinCustomize ForumsWinCustomize Forums

Not concerned, but one of my XP machines using AVG just recognized this file as a trojan as well.

Interestingly, it didn't on the other XP machine ...and they both have the same version of WindowBlinds on them, and are both running the AVG free latest version, on the same [year] build of XP Pro. All my machines updated to the latest signatures on bootup this afternoon.

Wierd....

The one that detected wbload.dll as a virus, auto deleted the file. Never gave me the option to quarantine.

No false positive or detection as a virus/trojan on Vista Ultimate machine though.

Thanks for the research, Neil. Appreciate it.

Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Beeswax
Join Date 08/2001
0
Reply #18 June 23, 2007 7:49:47 AM
from WinCustomize ForumsWinCustomize Forums
I have the same problem on my XP machine using AVG. Is it a False Positive? Now my Start Menu background won't skin but The Program Menu's will skin. Is there a work around for that problem?

Thanks
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Stephen Lee-Woolf
Join Date 07/2001
0
Reply #19 June 23, 2007 8:06:14 AM
from WinCustomize ForumsWinCustomize Forums
I have informed Kaspersky of the problem, and have just received an E-Mail from them confirming that the false positive will be fixed in the next updates.

Given the high rate of updates issued, I suspect the problem will be eliminated within hours.
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Jafo
Join Date 03/2001
+1845 sdemployee
Reply #20 June 23, 2007 8:34:23 AM
from WinCustomize ForumsWinCustomize Forums

Is it a False Positive?

Trust comments #14 and #16 as accurate and correct. [oh, and #10]...

It's a false positive....

Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Ladysarajane
Join Date 07/2003
0
Reply #21 June 23, 2007 10:58:00 AM
from WinCustomize ForumsWinCustomize Forums
Good to know that it is a false positive.
I anxiously await the new update from AVG.
My AVG also auto deleted the file instead of giving me the option, but I don't know if it really did, because WB seems to working fine for me so far.

Thank you for keeping us informed.   
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Katrinakat
Join Date 12/2003
+4
Reply #22 June 23, 2007 1:26:59 PM
from WinCustomize ForumsWinCustomize Forums

I just got the same results from AVG, which scans every day. In my case, however, the suspect files were on Drive D, which has recently been demoted from being my main hard drive--because there seemed to be a virus that no one could isolate. Oddly enough, the original symptoms were these: When I went online, a virus warning would pop up, window blinds would unload, and the internet would be disconnected.

WB seems to be working fine on the new drive, and that pesky "trojan" was not detected there.
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Ladysarajane
Join Date 07/2003
0
Reply #23 June 23, 2007 2:33:17 PM
from WinCustomize ForumsWinCustomize Forums
AVG has the new dat file for the day. I am updating and rescanning my computer now to see if it picks it up.
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Nakor
Join Date 03/2001
+41 sdemployee
Reply #24 June 23, 2007 3:01:52 PM
from WinCustomize ForumsWinCustomize Forums
As of the 269.9.6/863 6/23/2007 11:08 am AVG update, it was still incorrectly detecting it. I've emailed them again this afternoon. And F-Secure for good measure. The latest Kaspersky updates seem sorted.
Reason for Karma (Optional)
Successfully updated karma reason!
gavin63
Ladysarajane
Join Date 07/2003
0
Reply #25 June 23, 2007 4:47:06 PM
from WinCustomize ForumsWinCustomize Forums
As of the 269.9.6/863 6/23/2007 11:08 am AVG update, it was still incorrectly detecting it. I've emailed them again this afternoon. And F-Secure for good measure. The latest Kaspersky updates seem sorted.



I used that update and it did not detect it this time.   

Ummm....seems like my computer cannot find that file. It is strange that Windowblinds is still working for me. Any suggestions on what I should do?
PS...I do have the file wbload64.dll
Reason for Karma (Optional)
Successfully updated karma reason!
2 Pages1 2 
View all recent posts
Mark all posts as read Delete cookies created by the forum Return to Top
Stardock Forums v        Server Load Time:   Page Render Time: