Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

SAV Corporate Edition detected as PWS.Bancos.A Password Stealer

1 view
Skip to first unread message

Visser@discussions.microsoft.com Jacob Visser

unread,
Feb 10, 2006, 2:19:27 AM2/10/06
to
I just downloaded the tatest MS Antispyware definitions : Version: 5805
(2006-02-10 07:15:54)

A quick scan subsequently detected 614 Symantec AntiVirus Corporate Edition
10.0.2.2001 registry keys as a severe threat : PWS.Bancos.A Password Stealer
!!!

All keys and values under
HKEY_LOCAL_MACHINE\Software\Intel\Landesk\VirusProtect6 where detected as
being the password stealer.

Is this a marketing ploy to eliminate a future concurent after the anouncent
of a future Microsoft anitvirus product ? ;-)


Panda_man

unread,
Feb 10, 2006, 2:56:05 AM2/10/06
to
Is your Symantec Antivirus protection legal ?
It could be false positive.

Check your PC using Panda's free Active Scan where you can check your PC for
ALL kind of threats:
http://www.activescan.com

Also ,Microsoft has made special newsgroups for MS Antispyware Beta 1:

General
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.private.security.spyware.general&cat=en_US_9173989c-2d50-476c-b0dd-d72390cf0620&lang=en&cr=US


Signatures
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.private.security.spyware.signatures&cat=en_US_014cd20f-eaf3-4fba-9c79-74ee4fc56b19&lang=en&cr=US

Panda_man
--
Prevention is always better than cure !
Panda TruPrevent - the most intelligent technology to combat unknown malware
http://www.pandasoftware.com
http://pandaman.hit.bg

AlmostBob

unread,
Feb 10, 2006, 11:00:39 AM2/10/06
to
Malware attempts to disguise itself as legitimate software.

SAV is an obvious choice for such a disguise, it installs so many keys and
system hooks.
You should have the 2005 SAV engine installed, the 2001 keys should have
been removed by the automatic upgrade.

try another scanner, an online one that neednt install, a dos mode one,
adaware, spybot,
and find if it is a false positive or a real spy hiding in outdated SAV
keys.

Even if it turns out to be a false positive, MSAS is beta software, it is
Buggy by definition and should not be relied upon as a primary resource

--
-
Adaware http://www.lavasoft.de
spybot http://security.kolla.de
AVG free antivirus http://www.grisoft.com
Etrust/Vet/CA.online Antivirus scan
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Panda online AntiVirus scan http://www.activescan.com
Panda online AntiSpyware Scan
http://www.pandasoftware.com/virus_info/spyware/test/
Catalog of removal tools (1)
http://www.pandasoftware.com/download/utilities/
Catalog of removal tools (2)
http://www3.ca.com/securityadvisor/newsinfo/collateral.aspx?CID=40387
Trouble Shooting guide to Windows http://mvps.org/winhelp2002/
Blocking Unwanted Parasites with a Hosts file
http://mvps.org/winhelp2002/hosts.htm
links provided as a courtesy, read all instructions on the pages before
use
Grateful thanks to the authors/webmasters
_
"Jacob Visser" <Jacob Vis...@discussions.microsoft.com> wrote in message
news:E972FB4C-7456-49C1...@microsoft.com...

Help_Pc

unread,
Feb 10, 2006, 1:23:27 PM2/10/06
to
It is a false positive. Tested on several machines and different networks .

Panda_man

unread,
Feb 10, 2006, 2:17:27 PM2/10/06
to
Ok ,hopefully it is .:)
I don't know because I'm currently not using it .

Athena T

unread,
Feb 10, 2006, 2:55:31 PM2/10/06
to
Three of us in the office downloaded the new asw def this am. a scan
subsequently detected PWS.Bancos.A password stealer on each of our systems.
We uh-der, let ms asw remove the threat ! Then our PC's started acting funny.
Then NAV disappeared. We had to uninstall then our lan admin had to install
via cd as the server encountered errors pushing out to our clients (NAV v10)

I have my system set to check for updates every AM and run a scan every AM
at 11:00. I am a cautious surfer, etc. and wonder how long this could have
existed on my system.

The only other related KB article we could find was:
Receive Win32sys.exe Error Messages When You Start Your Computer

http://support.microsoft.com/kb/q236772/

T
--

msnews.microsoft.com

unread,
Feb 10, 2006, 3:22:28 PM2/10/06
to
Our office has seen this, we are set to automatically get antispyware
updates and run a scan at 11:00, it detects this and takes over symantec
antivirus. Then takes over 99% of cpu. threat must be removed and restart
system, uninstall symantec antivirus then reinstall it. you wont know it is
on some machines until you take a look.
I am on hold with Symantec for help now and will post agian when i find out
what they say.


"Athena T" <Ath...@discussions.microsoft.com> wrote in message
news:97A15356-FAAC-4047...@microsoft.com...

Panda_man

unread,
Feb 10, 2006, 3:27:27 PM2/10/06
to
Key word BETA...
Beta means not completed and in pre-released state and with bugs in it.Never
install Beta softwares unless you really want to make tests with it.


In your case you installed MS Antispyware because you read/or was
recommended it but as you are in corporate environment ,let only Norton work
for you and periodically make checks with another softwares such as

Lavasoft Ad-Aware SE Personal
http://www.lavasoftusa.com/software/adaware


Panda_man
--
Prevention is always better than cure !
Panda TruPrevent - the most intelligent technology to combat unknown malware
http://www.pandasoftware.com
http://pandaman.hit.bg

Panda_man

unread,
Feb 10, 2006, 3:30:27 PM2/10/06
to
And also ,those people who work in Microsoft are humans like you and me and
they also make wrongs :-) <stupid words but the truth> :)


Panda_man
--
Prevention is always better than cure !
Panda TruPrevent - the most intelligent technology to combat unknown malware
http://www.pandasoftware.com
http://pandaman.hit.bg

PA Bear

unread,
Feb 10, 2006, 6:33:24 PM2/10/06
to
Update your MWAS definitions to 5807.

Microsoft has established separate newsgroups for the Microsoft Windows
AntiSpyware Beta. Please post your query to:

http://communities.microsoft.com/newsgroups/default.asp?ICP=spyware&sLCID=us
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Shell/User, Security), Aumha.org VSOP, DTS-L.org

wait...@gmail.com

unread,
Feb 13, 2006, 1:52:26 PM2/13/06
to
" In your case you installed MS Antispyware because you read/or was
> recommended it but as you are in corporate environment ,let only Norton work
> for you and periodically make checks with another softwares such as
> Lavasoft Ad-Aware SE Personal
> http://www.lavasoftusa.com/software/adaware"

Ad-aware is a piece of junk. Honestly I find it hard to believe anyone
would still recommend it. Microsoft Antispyware has its issues but it
does help a lot. Spybot is what you need for serious freeware
antispyware cleaning.

Now let's get back to cleaning up after this Bancos.A false-positive
fiasco.

0 new messages