Installer file "wordweb6.exe" has been on my computer for months without being detected as a problem. Today after Malwarebytes signature update the auto scan quarantined the wordweb6 install file. I downloaded the latest version of wordweb (6.3) from download.cnet.com with similar results. I submited the zip version to virustotal.com with these results. The actual programme files do not flag. File name: wordweb63.zip Submission date: 2011-01-11 07:45:45 (UTC) Current status: finished Result: Antivirus Version Last update Result AhnLab-V3 2011.01.11.00 2011.01.10 - AntiVir 7.11.1.80 2011.01.10 - Antiy-AVL 2.0.3.7 2011.01.11 - Avast 4.8.1351.0 2011.01.10 - Avast5 5.0.677.0 2011.01.10 - AVG 9.0.0.851 2011.01.11 - BitDefender 7.2 2011.01.11 - CAT-QuickHeal 11.00 2011.01.11 - ClamAV 0.96.4.0 2011.01.11 - Command 5.2.11.5 2011.01.11 - Comodo 7358 2011.01.11 - DrWeb 5.0.2.03300 2011.01.11 - Emsisoft 5.1.0.1 2011.01.11 - eSafe 7.0.17.0 2011.01.10 - eTrust-Vet 36.1.8091 2011.01.10 - F-Prot 4.6.2.117 2011.01.10 - F-Secure 9.0.16160.0 2011.01.11 - Fortinet 4.2.254.0 2011.01.10 - GData 21 2011.01.11 - Ikarus T3.1.1.90.0 2011.01.11 - Jiangmin 13.0.900 2011.01.11 - K7AntiVirus 9.75.3497 2011.01.10 - Kaspersky 7.0.0.125 2011.01.11 - McAfee 5.400.0.1158 2011.01.11 - McAfee-GW-Edition 2010.1C 2011.01.10 - Microsoft 1.6402 2011.01.11 - NOD32 5776 2011.01.10 - Norman 6.06.12 2011.01.11 - nProtect 2011-01-10.01 2011.01.10 - Panda 10.0.2.7 2011.01.10 - PCTools 7.0.3.5 2011.01.11 - Prevx 3.0 2011.01.11 - Rising 22.82.01.01 2011.01.11 - Sophos 4.61.0 2011.01.11 - SUPERAntiSpyware 4.40.0.1006 2011.01.11 - Symantec 20101.3.0.103 2011.01.11 Suspicious.Cloud.5 TheHacker 6.7.0.1.113 2011.01.11 - TrendMicro 9.120.0.1004 2011.01.11 - TrendMicro-HouseCall 9.120.0.1004 2011.01.11 - VBA32 3.12.14.2 2011.01.11 - VIPRE 8027 2011.01.11 - ViRobot 2011.1.11.4247 2011.01.11 - VirusBuster 13.6.138.1 2011.01.10 - MD5: bc78a6d3eb24ab13482e14eb4c4d6224 SHA1: 964975d7477f917ca62c62034c0f7c795d932a2d SHA256: c48cfd43954a3597912b5fd0c014106e50c869563b51863f486cc92c4545b540 File size: 18669585 bytes Scan date: 2011-01-11 07:45:45 (UTC) Symantec indicated suspicious.cloud.5 - the rest nothing. MAlwarebytes scan log below. Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5502 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 11/01/2011 7:30:08 PM mbam-log-2011-01-11 (19-30-01).txt Scan type: Quick scan Objects scanned: 155821 Time elapsed: 19 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\Users\Ed\downloads\wordweb63.exe (Trojan.Downloader) -> No action taken. [f58948cd6d935da334f8db598580de22] The file size exceeds the 10mb limit.
