2 Replies Latest reply on Feb 11, 2013 6:52 PM by dmeier

    Trojan Named Artemis!36C875DAD6EC

      Hello everyone, anyone,

       

      So, for some time now I have been getting a notification for a Trojan named Artemis!36C875DAD6EC, I've restarted my computer so McAfee can "fix the problem" but every time it just keeps coming back. It doesn't appear to be having any effect on anything, which leads me to believe that it is a false Trojan. if someone could please give me some insight on the situation and how to actually get rid of the Trojan or at lease the annoying notification that McAfee produces from it, that would be greatly appreciated.

       

      More recently I have just been ignoring it because McAfee won't remove it from my computer when I restart it and it doesn't give me any options to rid of it manually.

       

      It also says that it was quarantined from: C:\progra~2\zoomex\sprotector.dll if that is of any help

       

      Please and Thank you

        • 1. Re: Trojan Named Artemis!36C875DAD6EC

          Hi,

           

          This is being investigated. We will provide an update after the analysis is done.

           

          Regards,

          Showvik

           

          Message was edited by: showvik on 2/11/13 1:00:47 PM CST
          • 2. Re: Trojan Named Artemis!36C875DAD6EC
            dmeier

            This might more information than you care to read, but wanted to give you all the context:

             

            Is there any chance that you have the original installation package for this software? 

             

            In our research, we have been able to find that most likely this is installed as a bundle with another application installation. We found an installer that installed an application very closely related to this ‘zoomex’ . In that installer, the user was able to opt out of the installation and not have it install. If we did not opt-out, we were easily able to be remove it through add/remove programs. The problem is that we were NOT able to get the actual ‘zoomex’ installer, so we cannot verify if the actions are the same for both.

             

            Regarding the cleaning,  it appears that we are able to remove this dll with a detection so I do not suspect that we are failing to clean but rather there is another component that is restoring this dll. Hence, getting the install package will also assist in determining why the dll re-appears.

             

            - David