Virus Alert: Generic9.acnh (dgnetc.dll)

If you've researched this problem and the recommendation is to scan in safe mode, have you done that? That would be a logical first step!

please confirm the presence of the letter 'c' at the end of the file name:   is it really dgnetc ?  or is it simply dgnet (without the 'c') ?

 

dgnet.dll (without the 'c') is a legitimate Microsoft file.   in fact, i have two copies of it (on my xp pro system), one located in windows\system32 , the other located in \i386

 

the 'generic' detection... generally indicative of a heuristic 'hit'... is often prone to being a false positive.

 

[you can try temporarily turning heuristic anlysis off:

click on the avg control center

resident shield

properties

UNcheck the box marked Use Heuristic Analysis]

 

i don't know if avg will even allow you to access the file, but if you can

you might be able to upload a copy of the file to one, or both, of the following sites, to have them analyze it for you:

 

jotti's virusscan  

 

virustotal.com

 

if they say it's clean, you should be okay.

 

p.s.  if you temporarily turned-off heuristics in order to access/upload the file, be sure to turn heuristic back on when you're done.

Hi,

 

Yes, it's dgnetc.dll

 

Thanks for the AVG tip on the false positive. I will check those once I access his laptop again. While the client had McAfee running in the systray, it had expired and he also admitted to frequently visiting porn sites so I expected something like this to happen.

 

My main concern is the fact that the laptop reboots if we try to heal the virus. Whether or not it's clean, it needs to be removed so I'll try the Safe Mode scan at that point.

 

What's your thoughts on the Comodo Firewall?  Is it annoying like ZoneAlarm or quiet like Windows?  This client is not tech-savy and I would hate to explain how to deal with the constant ZA pop-ups, etc.

 

Thanks again,

Dan

with the 'c', i have no idea what the file is.... but a "gut"/"hunch" says it could be a virus, trying to "pass itself off" as the legitimate microsoft file (no 'c').

 

if you can access that file (avg may not let you), the jotti and/or virustotal online scanners would still be the way to go:   each one accesses a large database of virus companies (including symantec/norton and mcaffee) and displays the results of each.   should avg be the sole product asserting it's an infection, then odds are it's a false positive.  but if others likewise find problems with the file, that's another story.

 

as for comodo (vs. zonealarm), there are at least two points [and probably more] that need to be considered... effectiveness of the product, and ease-of-use.

 

it seems you're concerned about the latter:  ease of use.   comodo goes through a "learning" process... when first installed, it can inquire about any attempt to access the internet.  you have to "teach" it... telling it to remember your answers... and after a "short" while, you tend to see fewer popups from it.

however, any time a particular program is updated, changing its "cryptographic signature", comodo will advise you as such [just in case it was spyware tampering with a program, rather than an actual update].   so yes, your client will need to interact somewhat with comodo.

 

the current version, 3.x, seems to require more input on the part of the user.   the previous version, 2.4.x, is still fully supported, and more "user friendly".   if you opt for comodo for your client, i would suggest the 2.4 rather than the 3.0

 

in terms of effectiveness, commodo is getting raving reviews, while zone alarm --- in particular, the free version --- is getting massacred.

Yes, I believe your gut hunch is a good one...anything that shuts down the OS in defense of being eliminated is grounds for a virus in my humble opinion.

 

Thanks for the Comodo feedback.  I myself use only Windows FW, and haven't encountered any attacks after almost a year (I also don't intentionally enter porn sites, lol) but I knew there had to be something as thorough as ZA, but not as obtrusive while surfing and without having to purchase a full fledged security suite.

 

I will report back here after verifying the .dll with jotti/virustotal and doing a Safe Mode scan with AVG.

 

Lastly, which free Anti-Spyware program(s) do you find to be the best these days?  I use Ad-Aware free and I splurge on Spyware Doctor as I found Webroot to be less than satisfying.

 

Have a great Easter weekend!

 

Dan 

 

 

one other point on firewalls... nowadays, many people are connected via routers, which typically include their own hardware (generally "NAT" -- Network Address Translation) firewall.  it's okay to combine such a hardware firewall, together with ONE software firewall (Windows, ZoneAlarm, Comodo, etc).   While Windows FW by itself leaves much to be desired, when used in conjuction with a router firewall, the combination is formidable.

 

i was a long time user of Ad-Aware SE.   but i've been very disappointed with their 2007 "upgrade"... and no longer recommend it. 

 

my anti-spyware recommendations are somewhat dependent on the user's operating system.   You mentioned XP at the start of this thread... 

 

for Windows XP (especially for people still using I.E.6):

 

resident protection:   Windows Defender along with Spybot's TeaTimer (yes, I use/run both).

[Note:  Windows Defender and SpyBot each include a "rudimentary" on-demand scanner]

additional on-demand scanners:  SuperAntiSpyware (SAS) and MalwareBytes AntiMalware (MBAM)

immunization via Spybot [optionally including HOSTS file immunization], as well as  SpywareBlaster.

use of Spybot's SDHelper BHO.

pseudo-protection:   WinPatrol.

 

==============================================================================

 

Here are the program links: