Author Topic: What's the Scoop on acslang.exe and acsrolb.exe?  (Read 7513 times)

0 Members and 1 Guest are viewing this topic.

Offline Chim

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1151
What's the Scoop on acslang.exe and acsrolb.exe?
« on: July 13, 2008, 05:40:41 PM »
My friend E-mailed me yesterday suggesting that I run a Manual Scan because she had just run an avast! Manual Scan and it had found 6 Viruses and since she E-mails me, she was worried that she had passed on the Viruses to my computer.  She says she had initially run her Manual Scan because her husband ran an avast! Manual Scan on his computer and it came back with 7 Viruses.  I told her that she need not worry as just by chance, just that previous night ... LATE, I had run both a Complete SUPERAntiSpyware Scan and a FULL Thorough / Search Archives avast! Manual Scan on my computer and everything was Cool.

For now, she says she moved the 6 Viruses, which I think were actually Trojans as per her followup E-mail, which mentioned --- win32:trojan-gen{other}.  They all seemed to be of the File Path:  C:\Program files\Common Files\AOL\Backup\ACS from what I gathered.  And while I'm still waiting on more details from her and answers to some questions I tossed at her, the Trojans seemed to I guess all be variations of:  acslang.exe and acsrolb.exe.  I Googled the first one and one of the Hits actually led me to a mention of it here on the avast! Forums on June 30 or thereabouts.  I think the Poster had at the time been suspecting it was a False Positive.

Since my friend hasn't gotten back to me, I haven't confirmed whether her computer's 6 Trojans and her husband's 7 Trojans / Viruses are the SAME.  And I don't know whether they E-mail each other so as to one having passed it them on to the other.  I know she's got Windows Vista, but I don't know what her husband's computer has.

Any insight on this situation?  Like I said, hopefully she'll have more details for me later today.  I already told her of the possibility that she might have to Restore the alleged Infected Files to their original locations and have VirusTotal scan them.  I just wanted to check here first in case someone might know if these were False Positives.
Dell Optiplex 780 / Core 2 Duo E8400 3.00 GHz / 4 Gig RAM / Windows XP Pro 32-Bit SP3 / Panda Dome  Free 18.07.00 / MBAM / SAS / NetZero Dial Up / Maxthon MX5 5.2.5.4000

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: What's the Scoop on acslang.exe and acsrolb.exe?
« Reply #1 on: July 13, 2008, 11:26:39 PM »
I think the Poster had at the time been suspecting it was a False Positive.
I just wanted to check here first in case someone might know if these were False Positives.
To know if a file is a false positive, please submit it to VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com. VirusTotal has a file size limit of 10Mb. Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.

Maybe you need to disable Hide protected operating system files and enable View hidden files and folders to manage the file(s).

As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the 'a' blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button...
You can use wildcards like * and ?. But be careful, you should 'exclude' that many files that let your system in danger.
The best things in life are free.