system
November 20, 2007, 7:44am
1
My avast home detected that 2kadiras.exe as Win32:Dialer-gen. However, after doing research from internet, I found a website that say 2kadiras.exe is a valid program:http://www.bleepingcomputer.com/startups/2kadiras.exe-10303.html
Scanning result from virustotal:
system
November 20, 2007, 7:45am
2
2kadiras.exe is a startup item in my computer.
Running processes:
C:\WINDOWS\System32\smss.exe
O2 - BHO: {BCBF738C-4891-4B9A-959A-C6BF7F608C3A} - {0B1B0D47-95F7-4bad-9309-A945B655AE61} - C:\WINDOWS\SYSTEM32\regsvr32.exe@btrez.dll ,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm@btrez.dll ,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htmhttps://www.windowsonecare.com/install/cli/0.8.0794.38/WinSSWebAgent.CAB http://go.microsoft.com/fwlink/?linkid=39204 http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab http://by124w.bay124.mail.live.com/mail/resources/MsnPUpld.cab http://messenger.zone.msn.com/EN-MY/a-UNO1/GAME_UNO1.cab http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126858001537 http://filelodge.bolt.com/ImageUploader3.cab http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab http://gameadvisor.futuremark.com/global/msc37.cab
–
http://i6.photobucket.com/albums/y248/zfc/2kadiras_2.jpg
So, should I delete this file?
DavidR
November 20, 2007, 2:08pm
3
It is all right saying that the ‘file name’ is valid as that is all you have to work on. But avast isn’t alone in seeing something wrong with this file.
You need to look deeper and on the link you gave it mentions some hardware that uses the legit file name, do do you have that hardware installed ?
Here is also where some of the malware names that have been given in VT (a Dialer) would seem related to the hardware mentioned above.
[b]Description:[/b] Allied_Telesyn AT series router/modem related - apparently required .
So there is a possibility that it might be an FP (if you have that hardware installed), in which case you should submit it as a possible FP giving links to this topic.
I would try to see if there is a later version of this file that doesn’t get detected. Otherwise you are left with the decision to exclude it from scans with any associated risk, since you can’t be 100% sure it isn’t infected.
Hi
Those files where present before. They where in your first HJT log. I checked on google when we where cleaning out the vundo and msn. The names just looked suspicious, but came back as required.
This is from your first DSS log
“2kadiras”=“2kadiras.exe” [07/18/2003 05:53 PM C:\WINDOWS\2kadiras.exe]
From another link
Required for Allied Telesyn DSL Modem AT-AR215. This will not run without it
The other files was 9xadiras.exe
Same info as above for the other file. Both are also referenced to a router by the same manufacturer.
I’m inclined to believe it to be a FP as avast didn’t pick it up before. You can check in device manager and make sure that you do have that hardware.
By set to autorun, do you mean at startup? If you meant as a start up item, that’s where they should be.
system
November 22, 2007, 5:46am
5
Yes, I mean it is a startup item.
http://i6.photobucket.com/albums/y248/zfc/device_manager.jpg
Seem that I don’t have that modem installed. So, what should me do?
Hi
system
November 22, 2007, 6:19am
7
It does not seem to be causing problem. I think it not trying to gain internet access.
http://i6.photobucket.com/albums/y248/zfc/pctfw.jpg
I don’t see anthing in the list that looks out of the ordinary.
I’ve come across a lot of HJT logs on tother forums. Those twq files where always left.
What about your ADSL(hi speed) modem, do you know the manufacturer?
system
November 22, 2007, 6:27am
9
It’s Aztech, not Allied Telesyn.
This isn’t the first time concern about a possible FP being raised on this file, all though it’s been with different scanners.
Can you move it to the users section of the chest and send it to avast? Send a message saying it may be a false positive and a link to this thread. Maybe alwil can analyze it and give better advise as what to do.
The file will still remain in it’s origonal location as it’s just a copy that goes to the chest.
Try resubmitting it to www.virustotal.com and see if the deections by others have changed.
In the mean time I’ll keep looking.
polonus
November 22, 2007, 6:54am
11
Hi zfc,
This seems a legit file, according to this info:http://www.bleepingcomputer.com/startups/2kadiras-10303.html
pol
system
November 22, 2007, 6:59am
12
The result still the same:
File 2kadiras.exe received on 11.22.2007 07:52:57 (CET)
I have submitted the file to avast.
Ok, I’ll keep looking. Just keep an eye out for any suspicious behavior. Hopefully alwil will be able to shed some light on this quickly. If I find anything, I’ll post it in this thread.
Hi Polonus
We’re just checking. Most references to the file come back as a reguired file for a modem, router. It’s possible other manufacturers use the same software. We’re just tryig to cover all the bases, as should be.
if you got some troubles related to this detection, pls add the file to exclusions… i’ll tell to someone, that he should test the file under vmware with some diag tools (filemon, regmon, tcpmon) and judge what to do…