Chameleon folder shows virus

[rsa98]

I am running Zone Alarm Extreme Security and run a nightly virus scan. Last night (05/16/12) the scan tagged 10 files in the Chameleon folder as being infected with "heur trojan downloader win32 generic". No other infections found, PC is running fine, and my nightly Malwarebytes scan is clean. Anybody know what is going on? Thanks for any help.

[daledoc1]

Hi, rsa98:

If I understand you correctly, ZA is detecting files in the MBAM chameleon folder as malware?

These sound like a false positive detection by ZA.

However, we'll need to wait for one of the MBAM staff or more expert folks to weigh in.

Cheers,

daledoc1

[David H. Lipman]

Zone Alarm Extreme Security is NOT detecting the Chameleon folder as a virus, it is falsely detecting it as a trojan as noted by the name you provided "heur trojan downloader win32 generic".

It is a False Positive (aka; False Detection) made by Zone Alarm Extreme Security.

Have your Zone Alarm Extreme Security software EXCLUDE or make an EXCEPTION of "C:\Program Files\Malwarebytes' Anti-Malware\Chameleon" and all files below it.

[mfn]

Zone Alarm Extreme Security is NOT detecting the Chameleon folder as a virus, it is falsely detecting it as a trojan as noted by the name you provided "heur trojan downloader win32 generic".

It is a False Positive (aka; False Detection) made by Zone Alarm Extreme Security.

Have your Zone Alarm Extreme Security software EXCLUDE or make an EXCEPTION of "C:\Program Files\Malwarebytes' Anti-Malware\Chameleon" and all files below it.

Hi....My first post here is to confirm a false positive as similar to the OP happened on my computer with Kaspersky.

There are a couple of posters in the K forum who had similar(1 in virus section and 1 in normal forum)

I thought this was initially down to Kaspersky but seeing the OP had Zone Alarm its probably down to an MBAM update imho.

Also i have MBAM and KIS in each others exclusions zones as advised by AdvancedSetup and that made no difference on my rig.

Apologies if i am wrong on that.

[rsa98]

Thanks for the quick response. I will tell ZA to ignore this detection and also notify ZA Technical support of the false positive reading.

[Firefox]

@ mfn

Hello and

Yes these are a false positive in your antivirus as well. Please exclude that folder in your antivirus program.

[mfn]

@ mfn

Hello and

Yes these are a false positive in your antivirus as well. Please exclude that folder in your antivirus program.

Hi.....I have put the mbam-chameleon.exe folder in exclusions as you suggested.

Does that folder include the Firefox.exe and Svchost.exe that that were also quarantined along with it?

Also there is a mbam-chameleon.com there as you can see...is that included in the mbam-chameleon.exe folder?

[LDTate]

Open C:\Program Files\Malwarebytes' Anti-Malware\Chameleon and you'll see what's there.

[David H. Lipman]

Hi.....I have put the mbam-chameleon.exe folder in exclusions as you suggested.

Does that folder include the Firefox.exe and Svchost.exe that that were also quarantined along with it?

Also there is a mbam-chameleon.com there as you can see...is that included in the mbam-chameleon.exe folder?

"C:\Program Files\Malwarebytes' Anti-Malware\Chameleon" is the folder.

mbam-chameleon.exe is a file within said folder.

Files that were quarantined were removed from that folder and thus no longer present precluding them from further scans and possible use.

[mfn]

"C:\Program Files\Malwarebytes' Anti-Malware\Chameleon" is the folder.

mbam-chameleon.exe is a file within said folder.

Files that were quarantined were removed from that folder and thus no longer present precluding them from further scans and possible use.

Hi,OK that cleared up that for me nicely thankyou as opposed to the previous post (open it and see whats in it).

Regarding the files that were quarantined and removed from the folder....Well Kaspersky popped up after a couple of hours or so to say it was

a false positive and suggested they be returned from where they came but by then i had reinstalled MBAM and all was well.

Thankyou for your explanation and help.

[David H. Lipman]