Potential virus, but scans show up nothing. False positive?

[michael123]

Hi all.

I wonder if anyone could shed a bit of light on a slight dilemma I'm having. The other day my bank phoned me up and said the software they tell all customers to download (called "Trusteer Rapport") had flagged up my computer as infected with Malware, namely "CerberusNG" and "SpyEye". Apparently this had detected the virus and somehow protected me from a keylogging attempt, but they suggested I run a scan anyway.

This surprised me a bit, because I've got firewalls up and I'm generally quite diligent with my virus-scanning. However, I decided to be thorough, so I ran scans with MSE, Malwarebytes, Avast, Kapersky, and Bitdefender. The Avast was a boot-time scan, but I got bored halfway through and gave up (it was taking ages and I'd already run the four other programs).

None of these threw anything up whatsoever. But I logged into my internet banking again today, and Rapport again said there was a keylogging attempt. This time, when I looked in the console, above the logged events it said:

This does not necessarily mean you have keyloggers on your PC. However, if any of the applications on your PC tried to log keystrokes while you were entering information to the websites below it failed.

However, to the best of my knowledge I have no applications which might try to log keystrokes. In normal circumstances I would be inclined to ignore this, but the virus warning has made me a bit jumpy.

Does anyone have any suggestions? Thanks for any help.

 

[cyclic]

IF it was your bank, you have done the things most advised to find and cure such things. If none of those shows a problem, chances are it's them that need to sort their software. I would feel very inclined to ignore it, after all the log does say if there was any attempt, it failed.!

 

[Jacee]

Here is information on Spyeye http://www.usatoday.com/tech/news/s...t-to-lead-to-surge-in-cyberattacks/50080368/1

Also, see this from Is your bank on SpyEye's Top 40 list? - F-Secure Weblog : News from the Lab

 

[michael123]

IF it was your bank, you have done the things most advised to find and cure such things. If none of those shows a problem, chances are it's them that need to sort their software. I would feel very inclined to ignore it, after all the log does say if there was any attempt, it failed.!

Thanks for the advice. I am certain that it was genuinely my bank. As you point out, the attack does seem to have been blocked; my only worry is that SpyEye looks like a pretty nasty virus, so it's making me a bit paranoid

Here is information on Spyeye http://www.usatoday.com/tech/news/s...t-to-lead-to-surge-in-cyberattacks/50080368/1

Also, see this from Is your bank on SpyEye's Top 40 list? - F-Secure Weblog : News from the Lab

:huh: Looks pretty clever. My bank is quite high up that list...

 

[CanIHaz]

If you did download "Trust Rapport"http://www.trusteer.com/ from their official site http://www.trusteer.com/ then there's is nothing to worry about. Your Antivirus just had a hiccup. Its a false positive for sure.

 

[F5ing]

Might be worthwhile to spend a little time scanning your system with some apps that are specifically designed to weed out rootkits. If you did get infected, say for instance, the day before your AV software was actually updated to identify that brand new particular infection, it may have already been able to burrow itself into your system and remove all detectable traces of its entry point before your now updated AV software has a chance to spot it. Rootkits are designed to do their dirty work at a lower layer of the system than AV software can typically detect.

Were you able to check any MD5 or SHA1 checksums or anything to verify that software you downloaded was genuine?