I've been using Airtel 3G Dongle (Data Card) on Windows and ClamWin has detected the following viruses in the dialer software of Airtel:

C:\Program Files\airtel\TCPOptimizer.exe: Win.Trojan.Swrort-4757 FOUND
C:\Program Files\airtel\UpdateDog\QueryStrategy.dll: Win.Trojan.Agent-1154787 FOUND
C:\Program Files\airtel\UpdateDog\RunOuc.exe: Win.Trojan.Agent-1384356 FOUND
C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll: Win.Trojan.Agent-1154787 FOUND

But I couldn't find any more information about it online. I found this page for Win.Trojan.Agent-1384356 that seems to suggest that a lot of other AV like TrendMicro and MalwareBytes don't consider this as a virus. Does that means its a false positive?

I'm using ClamWin because its a light-weight and offline scanner and I don't want to use any resident "heavy" scanners as they could strain my computing resources. But is there a way to disable/quarantine these exe files or should I just delete them?

  • @Hollowproc I checked the SHA256 checksum of mine and the one at VirusTotal and they match, so its identical to my copy. But it doesn't seem to have any more information at the moment. Jul 17 '16 at 4:49
  • depending on when the last time VT scanned it, you may want to re-scan to see if any other AV engines now recognize it.
    – HashHazard
    Jul 17 '16 at 4:50

You can upload the files to VirusTotal yourself and see what other AVs think about them. (I saw your link, but you should upload your copies as well) Also check malwr.com to see if it has any more info. There is also HerdProtect.

Side note: malwr.com allows you to search by MD5 hash (you can get this from VT when you upload your files)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.