Popeye Posted April 11, 2012 ID:541789 Share Posted April 11, 2012 Is this a FP?mbam-log-2012-04-11 (14-21-17).txt Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 11, 2012 Staff ID:541825 Share Posted April 11, 2012 I am looking into this now.Thanks. Link to post Share on other sites More sharing options...
Madeline Posted April 11, 2012 ID:541886 Share Posted April 11, 2012 I have the same things showing after doing a scan with MBAM database v2012.04.11.06. The items are currently quarantined and hadn't shown up yesterday.Another alleged Worm.Agent was pmmig.exe which I uploaded to Jotti's malware scan; none of the 20 programs there found anything,so I've restored the file.I'll be interested to know your findings!Madeline Link to post Share on other sites More sharing options...
satrow Posted April 12, 2012 ID:541936 Share Posted April 12, 2012 Same here, no file just the reg. entries "worm". I posted the regfile here yesterday. Link to post Share on other sites More sharing options...
ShyWriter Posted April 12, 2012 ID:541947 Share Posted April 12, 2012 [...]Another alleged Worm.Agent was pmmig.exe which I uploaded to Jotti's malware scan; none of the 20 programs there found anything,so I've restored the file.[...]Madeline@Hi Madeline; Rich had been working on the pmmig.exe hit with me and it should no longer show up as a worm.agent when the newer definition updates comes out. It's part of the Pale Moon Browser product.Virus Totalhttps://www.virustotal.com/file/b0e18cf70a7f22343d4b5998722a8edd8b7899e974e87f1cb09b3d41c4bfb301/analysis/1334112365/SHA256:b0e18cf70a7f22343d4b5998722a8edd8b7899e974e87f1cb09b3d41c4bfb301 File name: pmmig.exe Detection ratio: 0 / 42 Analysis date: 2012-04-11 02:46:05 UTC@ALL: I had the registration 'worm" entries as well and just deleted ("quarantined") them temporally until someone comes up with an answer one way or another as to their safety.RE: My original post # http://forums.malwarebytes.org/index.php?showtopic=108449&view=findpost&p=541456http://forums.malwarebytes.org/index.php?showtopic=108449&view=findpost&p=541456Steve Link to post Share on other sites More sharing options...
Rompin Raider Posted April 12, 2012 ID:541956 Share Posted April 12, 2012 Is this a FP?Add one more exactly as this...detected yesterday. Thanks RR Link to post Share on other sites More sharing options...
Popeye Posted April 12, 2012 Author ID:541963 Share Posted April 12, 2012 Just did a "Full Scan" and the results: CLEAN. Thanks for the fix. Link to post Share on other sites More sharing options...
ShyWriter Posted April 12, 2012 ID:541966 Share Posted April 12, 2012 Just did a "Full Scan" and the results: CLEAN. Thanks for the fix.DId the reg entries passed OK too Pop? (If so, I'm UN-quarantining them on mine. )Steve Link to post Share on other sites More sharing options...
Popeye Posted April 12, 2012 Author ID:541968 Share Posted April 12, 2012 DId the reg entries passed OK too Pop? (If so, I'm UN-quarantining them on mine. )SteveBoth of my reg entries passed ok. Link to post Share on other sites More sharing options...
Rompin Raider Posted April 12, 2012 ID:541969 Share Posted April 12, 2012 Same here...all is well! Thanks!!! Link to post Share on other sites More sharing options...
satrow Posted April 12, 2012 ID:541974 Share Posted April 12, 2012 Scanning with the latest defs. now comes up clean. I guess the FP is now fixed, thanks all Link to post Share on other sites More sharing options...
Madeline Posted April 12, 2012 ID:542177 Share Posted April 12, 2012 I've updated, unquarantined the registry entries and done another scan. Nothing was found and many thanks for the fix.Madeline Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 12, 2012 Staff ID:542203 Share Posted April 12, 2012 Yup It was actually a reg def that was detecting and linking back to whatever file.This is fixed now. Link to post Share on other sites More sharing options...
Madeline Posted April 13, 2012 ID:542437 Share Posted April 13, 2012 It's good to know that it's fixed now, thanks for all your efforts on our behalf.Madeline Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now