Courier Email 3.50.00 Infection?

I have been using Courier Email 3.50.00 for the last year or two, and suddenly I’m getting a warning from CAVS, build 1.1.0.3, Virus Database Version 1.1.1.89 that the “courier.exe” file is infected with “backdoor.win32.agent.lb” and then CAVS throws it in quarantine. I tried to disinfect the file, with no luck, and then restored it back to it’s original location. Then, CAVS discovers it again and throws it back in quarantine. I used three other virus-scanners to check this particular file (after restoring it once again and then shutting down the On Access scanner on CAVS) but the other scanners don’t find anything wrong with this particular file. I have since submitted it to Comodo, hoping there might be an answer out there somewhere. As of now, I can’t download my email with Courier email unless I turnoff the On Access scanner, but that’s not a solution I prefer to use. Thanks!!!

You could always exclude the Courier Email executable from being scanned.

Ewen :slight_smile:

Thanks for the information, and I gave it a try. Amazingly, it works for about 5 minutes, then I get a warning from the On-Access scanner that “courier.exe” is infected by backdoor.win32.agent.lb and then quarantines the executable for my email program once again. I even re-installed the email program, with the executable file still listed as being excluded from the On-Access scanner, and CAVS immediately tells me the file is infected and quarantines it. Any help?

If its excluded, then its excluded. I’ve never seen it “unexclude” something once it has been excluded. Do you have any software running that monitors or control “writes” tothe registry that could have prevented this exclusion being added?

Have you re-added courier.exe to the exclusion list after re-installing (different time/date stamp etc.)?

Ewen :slight_smile: