[DarqueMist]

I noticed a few people in the hijackthis forum having problems with AVG 8 finding Trojan Horse Dropper.Agent.Joc, since I can't post there I'm leaving a general note about it here.

It was found on my computer as well this morning (the infected file being knlwrap.exe in the windows installer folder). I suspected it was a false positive so uplaoded the file to joti.org and yes indeed the only scan done there that reported it infected was AVG. I then sent the file to AVG to have them look at it and they got back to me (a couple of hours later which is an impressive response time) stating it is indeed a false positive. Heres an exerpt from the e-mail I received

thank you for your email.

Unfortunately, the current virus database version may detect the
mentioned virus on some legitimate applications. We can confirm that
it is a false alarm. We would like to inform you that the false
positive will be removed in the next Definitions update. Please update
your AVG and if a new Definitions update was downloaded, check whether
the file is still detected.

If you need to restore deleted files from AVG Virus Vault you can do
it this way:
- Open AVG user interface.
- Choose "Virus Vault" option from the "History" menu.
- Locate the file that was incorrectly removed and select it (one
click).
- Click on the "Restore" button.

We are sorry for the inconvenience.

Should you have any further questions, feel free to contact us again.

Best regards,

Jiri Drozd
AVG Technical Support

[Cookiegal]

I had been seeing this too and was sure it was a false positive but thanks for posting the comfirmation.

[LauraMJ]

I got it too. Thanks for posting this!

[kenroffmann]

This is also on my computer for the third day now. What causes it...meaning what did I do o cause it? Also when I try to place it in virus vault I get a message stating file is too big for remaining space?????? Can anyone explain?

[Cookiegal]

Thre is no need to place it in the virus vault as it's a false positive detection, meaning the file is not actually infected.

[kenroffmann]

Thank you for answering my question...I am still very curious as to what could cause this to happen but answering this may take more time than is reasonable

[Cookiegal]

It's likely because there is a keylogger that uses the same file name but it would be in a different location. So basically it's an error on the part of AVG when providing new definitions.

[Keith Warner]

So, uh, does the file that was moved to the vault need to be restored? Someone on another board is asking 'cause I guess they deleted it.

[Cookiegal]

Originally Posted by Keith Warner

So, uh, does the file that was moved to the vault need to be restored? Someone on another board is asking 'cause I guess they deleted it.

Yes, it should be restored from the vault. If it was deleted perhaps running the system file checker will repair it, I'm not really sure.