False Positive? qvpse3lo.dll (Backdoor.Bredavi)

[windymiller]

Late last night, MBAM detected Backdoor.Bredavi in C:\Program Files\Quick View Plus\Program\en\qvpse3lo.dll

Subsequent Quick Scan & Flash Scan were clean, but Full Scan found two further instances in restore files. Is this a newly-discovered threat in old files, or a False Positive?

I deleted the quarantined file (is there any way to restore it, other than via my backups?), so can't attach it. But now see that the same threat has been detected in a file with the same name in a different folder:

C:\Program Files\Quick View Plus\Program\c\qvpse3lo.dll

This file is attached.

I've also attached the developer-mode Full Scan log file.

Please can you tell me whether this is a False Positive or a real infection?

Many thanks.

mbam-log-2011-11-29 (11-05-06).txt

qvpse3lo.zip

[sUBs]

We had a false positive with Backdoor.Bredavi. If you have mbam update itself, it shouldn't be detected anymore.

I deleted the quarantined file (is there any way to restore it, other than via my backups?)

Please restore it from your backups.

Alternately, re-installing the Quick View Plus program should do the trick. You should be able to download the latest version from here:

http://download.cnet.com/Quick-View-Plus-Standard-Edition/3000-10743_4-10045750.html

[whatmeworry?]

We had a false positive with Backdoor.Bredavi. If you have mbam update itself, it shouldn't be detected anymore.

MBAM detected the Backdoor.Bredavi on my computer today, too. It was supposedly in C:\program files (x86)\Yahoo!\yahoo! desktop search\msgtable.dll . I quarantined the file, came to the forum to see whether there were reports of false positives, found that there were, updated MBAM, restored the supposed malware, and MBAM no longer detected a problem. I really appreciate the speed with which this matter was dealt with.

[BrentP]

MBAM detected the Backdoor.Bredavi on my computer today, too. It was supposedly in C:\program files (x86)\Yahoo!\yahoo! desktop search\msgtable.dll . I quarantined the file, came to the forum to see whether there were reports of false positives, found that there were, updated MBAM, restored the supposed malware, and MBAM no longer detected a problem. I really appreciate the speed with which this matter was dealt with.

I had the same problem this morning, but in a Microsoft Office directory. As per the first reply, I un-quarantined the file and updated the WBAM database. No problem now.

Thanks Malwarebytes for the fast resolution of the problem. Keep up the good work.