Trojan-Spy.Pophot.WX and Trojan-Dropper.Agent.BPF

[ckm]

I recently had SpyDoctor + AV catch, quarantine and remove over 390 infections of the malware: Trojan-Spy.Pophot.WX and Trojan-Dropper.Agent.BPF. I was surprised and dismayed that I was not protected by SD=AV. After SD cleaned the infections I could not access anything in the Control Panel of my Windows XP SP3. The missing file in question was was C:\WINDOWS\system 32\rundll32.exe. I remember during the clean up process , SD asked for my XP install disk. I had my original XP2, but not XP3 which I recently updated to, so of course the original disk was not recognized. I proceeded anyway with the clean up, which I guess removed this important windows file. I had to pay a computer expert to fix my computer. He had to re-install windows XP2 and the new XP3 service pack. After reading posts on this forum. I see where a few others have had this problem I am a novice, but something about false positives were said. What does this mean? Do I have to not trust my SD? I really thought I had picked up a Trojan, but maybe not. A suggestion was to add to the Global Exclusions, but I am not sure how or why or what that means. If anyone could offer some feedback, I would really appreciate it. I am not sure I should continue using SD+ AV if it is for the more advanced computer user.

[gringopig]

I recently had SpyDoctor + AV catch, quarantine and remove over 390 infections of the malware: Trojan-Spy.Pophot.WX and Trojan-Dropper.Agent.BPF. I was surprised and dismayed that I was not protected by SD=AV. After SD cleaned the infections I could not access anything in the Control Panel of my Windows XP SP3. The missing file in question was was C:\WINDOWS\system 32\rundll32.exe. I remember during the clean up process , SD asked for my XP install disk. I had my original XP2, but not XP3 which I recently updated to, so of course the original disk was not recognized. I proceeded anyway with the clean up, which I guess removed this important windows file. I had to pay a computer expert to fix my computer. He had to re-install windows XP2 and the new XP3 service pack. After reading posts on this forum. I see where a few others have had this problem I am a novice, but something about false positives were said. What does this mean? Do I have to not trust my SD? I really thought I had picked up a Trojan, but maybe not. A suggestion was to add to the Global Exclusions, but I am not sure how or why or what that means. If anyone could offer some feedback, I would really appreciate it. I am not sure I should continue using SD+ AV if it is for the more advanced computer user.

"I had to pay a computer expert to fix my computer. He had to re-install windows XP2 and the new XP3 service pack."

Really? You paid to re-install XP?

"A suggestion was to add to the Global Exclusions, but I am not sure how or why or what that means."

You don't?

Right then, this is exactly the point I made in the original post about this false positive and poor old Agnes with her laptop (AKA average n00b punter) - a direct result of the incompetent update recently.

A false positive is an addition to the list of threats, added by update to the program which is NOT in fact a threat. In this case, PC Tools issued an update which isolated a perfectly legitimate Windows system file as a threat and allowed you to make 2 choices: 'Block' or 'Allow'.
Both of these choices lead to the inclusion or exclusion of the 'threat' in the part of the program called 'Global Action List'. This is a threat manager which will either, in the case of the 'Block' option, stop the threat by deletion/isolation or in the 'Allow' case, exclude the file from further investigation.
Unfortunately, PC Tools saw fit to issue an update without testing it on XP SP3 systems, thereby causing problems.

It is however, sort of incumbent on yrself to be able to use the program correctly and to, dare I say it, read the documentation. It would have been easy to delete the rule in the 'Global Actions List' which was the result of yr choice to 'Allow' or 'Block' and remake it to 'Allow' if obvious functionality was lost. In no way was it necessary to re-install yr OS. That's just ridiculous and the tech who agreed to it was ripping you off big time! :eek:

There are a number of points here:
* You are ultimately responsible for the correct operation of yr box. Read the documentation. It's not hard. Computer programs are just programs - they are non-thinking automatons.
* PC Tools are wholly responsible for their error and you may consider asking them to compensate you for this.
* Think before you hit a key. Visit a forum. Read/Google for a solution. Make a backup regularly.

[ckm]

Well, you have sufficiently admonished me globally. Sorry to offend you. I really did think this forum was designed to offer help and information to the uninformed. You see me as "poor old Agnes ". You said PC Tools issued an update without testing it on XP SP3 systems--"incompetent update" you said. You seem to have a low tolerance for "incompetence". I do thank you for your explanation of false positives. You were kind enough to reveal your competence. However, I do feel bullied. Where is the Moderator when needed?

[Reversemidas]

Hey I was in the same situation as this CKM individual. I had no idea what happened, especially on a shared computer in my case, it was only upon just reading thru other topics in the various discussion forums that I recalled someone had posted some error message that I vaguely recalled being similar to message I was getting when I tried going into control panel and from there realized the rundll32.exe was blocked and deleted by SD + AD. My knee jerk reaction was very similar to CKM. I wonder what happened to those out there who are not members of the forum what have they done to resolve their situation and the residual rnegative reflection on the PCTools product. Product quality control is an important and critical responsibility of any manufacturer/producer or risk adoption or reduction of their user base (i.e. customers). What was the objectives of PCTools products? Easier to use, Easy to navigate, Simple User Interface, straightforward, reliable to a broad spectrum of folks that are pc beginners, novice, advance, experts, and eggheads.

[gringopig]

Well, you have sufficiently admonished me globally. Sorry to offend you. I really did think this forum was designed to offer help and information to the uninformed. You see me as "poor old Agnes ". You said PC Tools issued an update without testing it on XP SP3 systems--"incompetent update" you said. You seem to have a low tolerance for "incompetence". I do thank you for your explanation of false positives. You were kind enough to reveal your competence. However, I do feel bullied. Where is the Moderator when needed?

"I do feel bullied" - c'mon now, steady on!

The 'incompetence' was on the part of PC Tools, not yrself...

You are not the n00b as you have come to the forum for help! My reference to 'poor old Agnes' was in relation to those who have don't have the ability to seek answers. The only admonishment was the suggestion to read the documentation for the product.
You are not at fault for relying on the program to keep you secure and you have been let down by a mistake on the part of PC Tools. Many of us were in the same boat, ckm!

[ckm]

Thank you gringopig for your clarification. And, thank you Reversemidas for your support. Now, PC Tools, what do you have to say about the problematic update? Your customers deserve an acknowledgement of the poor update issue.

[AChen]

Apologies for this. The issue managed to get past the reviewer and was later detected, we worked on a fix right away to have this available via the Smart updates as soon as we could.

Sorry again for the inconvenience.

[Reversemidas]

Understood AChen. It is always a challenge for any software firm to maintain that edge that puts them or maintains them at a professional product level. Hopefully, the incident has developers relooking to improve/adjust their quality control plan before placing updates out into production and to minimize "reactive" fixes situations. Keep up the good work at PCTools.