JoleFindsTheRogues

This is a game trainer released by the group UNLEASHED for the game Silverfall , i've been using it before and it doesn't do anything malicious , it's detection could be due to the packer used (FSG). Anyways... Log : Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Database version: 3947 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 4/3/2010 1:52:34 PM mbam-log-2010-04-03 (13-52-34).txt Scan type: Quick scan Objects scanned: 1 Time elapsed: 7 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\Users\administrator\Desktop\trainer.exe (Trojan.Downloader) -> Not selected for removal. [12F8A77581F16A8E12EE2D69165EA45C] VT Scan : http://www.virustotal.com/analisis/cbdd6c70616d8602cf4816ab66b8c0aaca5292d96e88dec9991186849cf7672b-1270295633 File is attached. By the way , i'm finally done with school stuff and i will continue postin rogues and malware samples trainer.rar

It's the infamous Merjin. Welcome and congratulations , i know you will do good

2.5 billion!? wow! Congratulations MBAM!

Well that was fast , downloading the new version as we speak , thanks again guys

Ye that happens to me too , system restore backs up the .exes .

fontinst.exe is being detected as Worm.Archive.. I think it's not a worm because it's used to install specific fonts in the fonts folder in system32 LOG : Malwarebytes' Anti-Malware 1.41 Database version: 2900 Windows 6.1.7600 10/3/2009 21:49:02 mbam-log-2009-10-03 (21-49-01).txt Scan type: Quick Scan Objects scanned: 98753 Time elapsed: 1 minute(s), 36 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Windows\Fonts\fontinst.exe (Worm.Archive) -> No action taken. [3857535134305680837815348368737487701301065642473742510661398079858461111570 8970] also the file has been attached pass is false fontinst.rar

RegFromApp worked perfectly for me ! Thanks mate , also i have found a tool that can track the files created by an executable

Is there an application/program that can log what files and registry entries an .exe creates ? Thanks

http://hosts-file.net/?s=213.186.33.87&view=matches 213.186.33.xxx = 41 Malicious Sites

Lol it's fast even without the database optimization Malwarebytes is the best malware protection application in the world

Awesome news RubbeR DuckY . Can't wait to test the IP Blocking module

Seems like to be fixed with the new update Malwarebytes' Anti-Malware 1.39Database version: 2550 Windows 5.1.2600 Service Pack 3 8/3/2009 5:57:03 PM mbam-log-2009-08-03 (17-57-03).txt Scan type: Quick Scan Objects scanned: 92108 Time elapsed: 5 minute(s), 34 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

I really think this is a false positive this is a legal executable of 7Zip Console Here's the developers log : Malwarebytes' Anti-Malware 1.39Database version: 2549Windows 5.1.2600 Service Pack 3 8/3/2009 12:03:19 PMmbam-log-2009-08-03 (12-03-17).txt Scan type: Quick ScanObjects scanned: 92174Time elapsed: 5 minute(s), 23 second(s) Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1 Memory Processes Infected:(No malicious items detected) Memory Modules Infected:(No malicious items detected) Registry Keys Infected:(No malicious items detected) Registry Values Infected:(No malicious items detected) Registry Data Items Infected:(No malicious items detected) Folders Infected:(No malicious items detected) Files Infected:C:\WINDOWS\system32\7z.exe (Trojan.Agent) -> No action taken. [3857535134303627615642473748565261849084857078201961249115708970]and here's the executable if you need it : http://rapidshare.com/files/263182353/7z.exe

I really don't think those are F/P . Pictures and music are not executable files and urls. Wait for an response from an Admin or Moderator

Restore that registry entry and Please update Malwarebytes' Anti-Malware and rescan your computer.

Send me the file in a PM

Hello mbrowning87 and welcome to the forums!. If you are talking about about:blank then it's not malware about:blank is a blank home page . Can you please tell me more about the "other malware"? Thank You.

Hello serwar . thank you for sending me the samples . They are False Positives . Try updating Malwarebytes and running a scan. Report back when you are finished.

Happy Birthday lurkingatu2.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!1 Infections Detected : 1 C:\Program Files\lurkingatu2\cake.exe (Trojan.FakeCake) Dude where's the real cake?

SpyClean is rogue software. I don't think these are F/P . Any Expert wanna take a look at this?

Please send me a sample of that file by doing this : Rar the file and a add a password like mbam or infected then send it to me in a pm (Private Message).w

As far as i know these files are malware : C:\WINDOWS\SYSTEM32\L

Need a Serbian Translator? I am available if you want .

Avira + MBAM = Total Security.

It's called FileASSASSIN that means it deletes only files for a reason, that is if they would enable directories to be deleted too , then somebody could by accident delete the whole system32 folder. Sorry for bad english xP