Win32.TrojanSpy.Goldun False Positive?

[1234]

Hello,

I started a thread 1-12-08 about Ad-Aware finding this Trojan. I did
nothing to eliminate it, and several subsequent checks with Ad-Aware showed
nothing.

I am still treating the machine as infected and plan to restore the original
HP Recovery partition CDs.

Has anyone seen this appearance and disappearance act, and could this be
considered a "false positive"?

Thanks for any thoughts,
Ellen

 

[David H. Lipman]

From: "1234" <1234@calm.com>

| Hello,
|
| I started a thread 1-12-08 about Ad-Aware finding this Trojan. I did
| nothing to eliminate it, and several subsequent checks with Ad-Aware showed
| nothing.
|
| I am still treating the machine as infected and plan to restore the original
| HP Recovery partition CDs.
|
| Has anyone seen this appearance and disappearance act, and could this be
| considered a "false positive"?
|
| Thanks for any thoughts,
| Ellen
|

Yes. Your information indicates a False Positive declaration.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

 

[1234]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:u4eCRWTYIHA.5900@TK2MSFTNGP02.phx.gbl...
> From: "1234" <1234@calm.com>
>
> | Hello,
> |
> | I started a thread 1-12-08 about Ad-Aware finding this Trojan. I did
> | nothing to eliminate it, and several subsequent checks with Ad-Aware
> showed
> | nothing.
> |
> | I am still treating the machine as infected and plan to restore the
> original
> | HP Recovery partition CDs.
> |
> | Has anyone seen this appearance and disappearance act, and could this be
> | considered a "false positive"?
> |
> | Thanks for any thoughts,
> | Ellen
> |
>
> Yes. Your information indicates a False Positive declaration.
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>

Dave,

Thank you for this. Would YOU consider the machine in question to be
uninfected, or feel comfortable treating it as such?

Ellen

 

[David H. Lipman]

From: "1234" <1234@calm.com>


| Dave,
|
| Thank you for this. Would YOU consider the machine in question to be
| uninfected, or feel comfortable treating it as such?
|
| Ellen
|

There is NO way from here I can consider your machine "uninfected". You may have something
on your PC that Ad-aware has no signatures for. That's the only anti malware application
you indicated you used.

I can say that if an anti malware declared an infection with one signature release and then
a subsequent signature release no longer identifies it, then the original declaration was
falsely made.

What else have you used beside Ad-aware to scan your PC ?

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

 

[1234]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:uqJx40TYIHA.6044@TK2MSFTNGP05.phx.gbl...
> From: "1234" <1234@calm.com>
>
>
> | Dave,
> |
> | Thank you for this. Would YOU consider the machine in question to be
> | uninfected, or feel comfortable treating it as such?
> |
> | Ellen
> |
>
> There is NO way from here I can consider your machine "uninfected". You
> may have something
> on your PC that Ad-aware has no signatures for. That's the only anti
> malware application
> you indicated you used.
>
> I can say that if an anti malware declared an infection with one signature
> release and then
> a subsequent signature release no longer identifies it, then the original
> declaration was
> falsely made.
>
> What else have you used beside Ad-aware to scan your PC ?
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>

Dave,

What I MEANT to say was would you consider the machine
"Win32.TrojanSpy.Goldun-free?", as in, do you normally trust a False
Positive indication?

That was my real question.
Ellen

 

[David H. Lipman]

From: "1234" <1234@calm.com>


| Dave,
|
| What I MEANT to say was would you consider the machine
| "Win32.TrojanSpy.Goldun-free?", as in, do you normally trust a False
| Positive indication?
|
| That was my real question.
| Ellen
|

I would consider it Goldun Trojan free.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

 

[1234]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:%23F2qVNUYIHA.5132@TK2MSFTNGP02.phx.gbl...
> From: "1234" <1234@calm.com>
>
>
> | Dave,
> |
> | What I MEANT to say was would you consider the machine
> | "Win32.TrojanSpy.Goldun-free?", as in, do you normally trust a False
> | Positive indication?
> |
> | That was my real question.
> | Ellen
> |
>
> I would consider it Goldun Trojan free.
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>

Dave,
I really appreciate your help.
Ellen

 

[paul]

On Jan 28, 3:16 am, "1234" <1...@calm.com> wrote:
> Hello,
>
> I started a thread 1-12-08 about Ad-Aware finding this Trojan. I did
> nothing to eliminate it, and several subsequent checks with Ad-Aware showed
> nothing.
>
> I am still treating the machine as infected and plan to restore the original
> HP Recovery partition CDs.
>
> Has anyone seen this appearance and disappearance act, and could this be
> considered a "false positive"?
>
> Thanks for any thoughts,
> Ellen

scan your computer with spybot and supreantispyware to be sure it is a
false positive and not malware
Run the anti spyware remove programs spybot
http://securitynewsfromthenet.blogspot.com/2007/03/spybot-search-and-destroy-spyware-and.html

and superantispyware
http://securitynewsfromthenet.blogspot.com/2007/04/superantispyware-home-edition-free.html