Malicious object detected: wpad.dat, wpad.domain.name, Trojan.Script.Agent.dc [merged]

[serval1959]

I did the suggested steps. No way.

The router is a Netgear Pro Safe. It’s an old product with no more support.

I tried to find a new router with quite the same specs. No way.

I use this router for 3 PC : this one with Kaspersky AV: full of this kind of messages, the others with others AV: no messages.

Where is the truth ?

 

[Flood and Flood's wife]

Hello @mehdifirefox & @serval1959, 

Log a case with Kaspersky Technical Support, fill in the Malware, Detected threat appears over & over template; support may request Logs, Traces & other data, they will guide you:

• After submitting the case, you’ll receive an automated email with an INC+12digits reference number, then, normally, within 5 business days, a Kaspersky Technical Support human will be in touch, also by email, you may continue to engage with the Kaspersky Technical Team via email or by updating the INC in their MyKaspersky account.

➡ Please share the outcome with the Community when it’s available? 

Thank you🙏

Flood🐳+🐋

[serval1959]

I did it months before … with no success … 😓

[Milan_29_11]

Even i’m facing the same issue since today morning 

[Schulte]

Please follow these instructions:

Link

 

[Kavarera]

this is happen since yesterday in the morning, kaspersky send me this warning when i have a online class, it doesnt bother me at first but my wifi suddenly doesnt have internet access. i called my internet service provider they said they will send me the techician(i’m still waiting).. i tried to restart my router and voila my wifi have internet access back, but this warning still showing until now. i need help and im so scared if it’s a spyware that can take my mobile bank pin and etc. 

here is the message from kaspersky report.

 

Event: Access denied
User: KAVARERA\User
User type: Active user
Application name: svchost.exe
Application path: C:\Windows\System32
Component: Web Anti-Virus
Result description: Blocked
Type: Malicious link
Name: http://wpad.domain.name/wpad.dat
Precision: Exactly
Threat level: High
Object type: Web page
Object name: wpad.dat
Object path: http://wpad.domain.name
Reason: Databases
Databases release date: Yesterday, 9/17/2021 3:23:00 PM

[Berny]

@Kavarera Welcome.

Please see this Topics :

Link

Link

 

[Hanz_Christ]

I had some problem with my Kaspersky Internet Security, It detects web anti-virus with every minutes and I already following with this instruction, But still cannot fix it. I already tried exclusion function with all protection but still get the notification.

Link

It happen just 1 day before I post this thread. Is this just false alarm/bugs from Kaspersky or it can do any harm with the computer? Because before yesterday, A long time a go my pc is just fine, didn’t had a problem. Please someone whoever read this thread give me a some advise/reply for this problem, I really appreciate it. Thanks

NB: If I connect with mobile hotspot from my android device it’s fine, but not with my router/wifi 

[Hanz_Christ]

Notes: the exclusion I make was like this

 

[Aroon]

i have same problem … is that  a virus?

 

[Hanz_Christ]

i have same problem … is that  a virus?

 

Yes just like that. I don’t know if it’s virus or just false alarm, because a long time a go it’s just fine. and it just happen until now from yesterday.
May I ask? since when you had this problem?  and how you fix it? or you just ignore it?

[Berny]

@Aroon @Hanz_Christ Please see pinned reply from @Danila T. above.

[ARGI]

Hello guys,
well recently I had this issue too but don’t worry I have got a solution for this freaky problem!

- First of all it’s about your router and its configuration, so we have to change it by manual.
- go to your router setting and get your “Router configurations” (is this situation I’ll just show stuffs in my version of router {DSL-2740U})

Click on “BackUp Setting” and then download your config.img file

- once you got finished with that open your config file with “Notepad++” or whatever you rather and then search for “domain.name” in the config file.
- after that, change “domain.name” to something like “domain.local” and save it.

- the only thing you have to do now is just update the setting of your router by following the option in your router (as you can see in the picture for me it is under the backup settings and I can choose the config.img file and update the settings by clicking on it)

- your router will reboot and update the settings.
- it should be done now, just check your windows network setting and check this:
 

as you can see my Primary DNS suffix has been changed to “domain.local”

 

- Hope that I could help, Best regards.

[Wesly.Zhang]

Hello,

There may be some network software that can cause this problem.

Link

Regards.

[Reight]

Has anyone identified a solution for this? this seems to be irritating. I tried all the options suggested by the team. But unfortunately, none of them worked. The notifications are still persisting.  My router is the one given by the ISP provider and hence, i contacted them to get this sorted out. They tried resetting, updating the firmware and finally also replaced the router with a new one. But the problem still persists! . don’t know what to do.  And also, why this  happens only to Kaspersky users?

I cannot find any forum related to this other than Kaspersky’s.. 

[Berny]

@Reight Welcome.

It looks like your replaced router doesn’t comply with above recommended protection specs.

[Reight]

@Berny what is the specifications?

[Berny]

@Reight Please see this pinned Topic from @Danila T. 

Link

“A lot of routers/modems are preset that DNS suffix. This isn't new, this has been used for 20 years now.

Using a DNS suffix like that means that it is theoretically possible for a mal-wisher to change the file at its location,

and eventually have it loaded into the user's system, thus setting up an unwanted proxy server, and intercept browsing data.”

 

[JodiW]

This problem is soooo annoying.

I followed Argi’s instructions and changed config file name to: “domain.local”, then I double checked in properties. All done.  (And I’m not a computer techy, just a nurse.)

YES. This works!

Thank you.