I’m receiving tons of notification (every 10 min) of Event: Malicious object detected
About wpad
Event: Malicious object detected
User type: Active user
Application name: svchost.exe
Application path: C:\Windows\System32
Component: Web Anti-Virus
Result description: Detected
Type: Trojan
Name: Trojan.Script.Agent.dc
Precision: Exactly
Threat level: High
Object type: File
Object name: wpad.dat
Virus Scan does not find anything. I need a suggestion about what I can do to stop it. Thank a lot
Hello,
There exists something called WPAD or Web Proxy Autodiscovery Protocol, it's designed to pinpoint the location of the necessary configuration file, called the pac-file. Usually such location would look like this: wpad.domain[.]name/wpad.dat. Experienced users will understand that this "location" is actually a DNS suffix.
A lot of routers/modems are preset that DNS suffix.
This isn't new, this has been used for 20 years now.
Using a DNS suffix like that means that it is theoretically possible for a mal-wisher to change the file at its location, and eventually have it loaded into the user's system, thus setting up an unwanted proxy server, and intercept browsing data.
Follow these steps:
- Try to connect to the Internet via some other Internet connection, for example, via mobile hot spot. Or try to connect without router. Will there be a detection?
- If there is no detection after step 1: please reset router to default settings then connect again to the Internet via router.
- Also update firmware on the router, if there is a newer version is available on the router manufacturer site. Change password of the router.
- If points 2 and 3 do not solve the problem and point 1 fix problem, then this router is not recommended for use. Or contact the support of the router manufacturer.
View original