wbload.dll
Detected as W32 Trojan
Friday, June 22, 2007 by gavin63 | Discussion: Stardock Support General
I am running Zone Alarm Firewall with Antivirus and for some reason it detected wbload.dll in my system32 folder as a trojan and quarantined it. I have restored the file back as it is a dll process to load Window Blinds
Anyone else had this problem at all and is there a work around
 |
|
Page 1 of 2 | |
|
|---|
Reply #2 Friday, June 22, 2007 1:45 AM
Reply #3 Friday, June 22, 2007 4:24 AM
It sounds like ZoneAlarm need to work on their AV part a little more.
wbload.dll is not a trojan.
Reply #4 Friday, June 22, 2007 5:24 AM
Reply #5 Friday, June 22, 2007 7:57 AM
Reply #6 Friday, June 22, 2007 9:24 AM
Trojan reported as: Trojan.Win32.Agent.es (aka Vernet by McAfee)
Reply #7 Friday, June 22, 2007 10:06 AM
Are you 100% sure it was wbload.dll it complained about and not one of the other WB dlls?
wbload.dll is not used on Windows XP, only later versions of Windows.
Reply #9 Friday, June 22, 2007 11:33 AM
ZA uses Kaspersky. It's a false positive. Update your definitions.
Yes it does - but only from Version 7 onwards (which has only been released in the last 2-3 months. The original post did not specify the version used.
Definitions ARE up to date!
Reply #10 Friday, June 22, 2007 11:48 AM
Reply #11 Friday, June 22, 2007 3:07 PM
So for now it is quarantined.
Reply #12 Friday, June 22, 2007 11:54 PM
Strange the Stardock Central updated Windowblinds this evening and then this popped up an hour later.
Reply #13 Saturday, June 23, 2007 5:40 AM
It's probably a false positive - but theres no point in updating your antivirus and then ignoring what it says!
Reply #14 Saturday, June 23, 2007 5:44 AM
It seems that the latest virus definitions from a few companies all have the same false positive in them. This suggests they all share data, either that or one of them has some explaining to do!
We will be contacting the companies & requesting they correct their definitions as a matter of some urgency. Perhaps in the future they will do a better job of checking their definitions....
Testing here seems to suggest it is only triggering on a 20K version of wbload.dll which is included with some of the XP versions of WB. This file dates from 2005 and I suspect its size (it contains almost no code) has resulted in a signature clash where it looks like a different file to the AV apps.
If you are running XP 32 bit it is perfectly safe to allow it to quarantine that file. If the same file gets detected on Vista then the removal of that file will stop WB from functioning correctly, but the Vista file is much larger and AVG seems happy with it.
If anyone has a problem with any other AV packages and wbload.dll please post here so we can contact them and get them to correct their definitions. I suspect Norton AV etc all use their own definitions and so are unlikely to make the same mistake.
Reply #15 Saturday, June 23, 2007 5:44 AM
AVG tells me that not only is my latest wbload.dll infected - but also the ten or so archived copies that were auto backed-up at the time of previous updates (I forgot to delete them)..
so it MUST be a virus signature false positive and therefore ok to ignore
Reply #16 Saturday, June 23, 2007 6:43 AM
Reply #17 Saturday, June 23, 2007 6:59 AM
Not concerned, but one of my XP machines using AVG just recognized this file as a trojan as well.
Interestingly, it didn't on the other XP machine ...and they both have the same version of WindowBlinds on them, and are both running the AVG free latest version, on the same [year] build of XP Pro. All my machines updated to the latest signatures on bootup this afternoon.
Wierd....
The one that detected wbload.dll as a virus, auto deleted the file. Never gave me the option to quarantine.
No false positive or detection as a virus/trojan on Vista Ultimate machine though.
Thanks for the research, Neil. Appreciate it.
Reply #18 Saturday, June 23, 2007 7:49 AM
Thanks
Reply #19 Saturday, June 23, 2007 8:06 AM
Given the high rate of updates issued, I suspect the problem will be eliminated within hours.
Reply #20 Saturday, June 23, 2007 8:34 AM
Trust comments #14 and #16 as accurate and correct. [oh, and #10]...
It's a false positive....
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 1 of 2 | |
|
|---|
Reply #1 Friday, June 22, 2007 1:02 AM