Trojan found in plugins folder

Vlodec · Post by **Vlodec** » May 18th, 2008, 1:59 am

Avast anti-virus scanner has just a found a Trojan in my Mozilla Firefox/plugins folder. The offending file was NPAskSBr.dll and the trojan it claims to have found in it was Win32:Agent-XIT[Trj]. I don't know what this dll is used for. My addons are Roboform, RealPlayer, Interclue, Downthemall, and PDF download; the last three being recent addititions.

I just thought you all might like to know.

Soul Stealer · Post by **Soul Stealer** » May 18th, 2008, 5:24 am

Could be a false positive. Do you have the ask.com toolbar?

Vlodec · Post by **Vlodec** » May 18th, 2008, 7:05 am

Friar Tuck wrote:Could be a false positive. Do you have the ask.com toolbar?

I don't have the ask.com toolbar and I'm aware it could be a false alarm.

Post by **BenBasson** » May 18th, 2008, 7:41 am

None of the three recent extensions you installed contain anything like that as far as I can see (I quickly scanned through the contents of the installers available from Mozilla Add-ons). If it is malware, which is quite possible, then I suspect another application is trying to compromise Firefox by installing that plug-in.

Post by **steviex** » May 18th, 2008, 7:47 am

It is also possible that you might have a spyware infection on your machine. Install and run these programs.
SuperAntispyware
AdAware
Spybot Search & Destroy
Malwarebytes' Anti-Malware

If these don't find it or can't clear it, post in one of these forums for specialized malware removal help:
http://castlecops.com/
http://www.spywarewarrior.com/index.php
http://forum.aumha.org/
http://forums.spywareinfo.com/

(Thanks to Daifne for the list)

Ardiva40 · Post by **Ardiva40** » May 18th, 2008, 7:34 pm

Vlodec wrote:Avast anti-virus scanner has just a found a Trojan in my Mozilla Firefox/plugins folder. The offending file was NPAskSBr.dll and the trojan it claims to have found in it was Win32:Agent-XIT[Trj]. I don't know what this dll is used for. My addons are Roboform, RealPlayer, Interclue, Downthemall, and PDF download; the last three being recent addititions.

I just thought you all might like to know.

Have you also gone onto the Avast! forum to report this?

http://forum.avast.com/

Vlodec · Post by **Vlodec** » May 19th, 2008, 4:53 am

Oops. I DID have the ASK toolbar, it just wasn't enabled. Damned if I know how it got there I certainly didn't install it knowingly.

Soul Stealer · Post by **Soul Stealer** » May 19th, 2008, 2:52 pm

Imagine that ....