Company software marked as trojan.backdoor

[rgrayling]

Hi,

Our software, TMP.exe, which has been around for years is suddenly appearing as trojan.backdoor. (Earliest version was deployed Oct 2008!)

Appreciate it if you could have a look asap.

Richard

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org

Database version: v2012.05.16.04

Windows Vista Service Pack 2 x64 NTFS

Internet Explorer 9.0.8112.16421

rgrayling :: RG_VISTA2 [administrator]

16/05/2012 15:44:31

mbam-log-2012-05-16 (15-54-40).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 293661

Time elapsed: 9 minute(s), 31 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 1

HKLM\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki (PUP.Funmoods) -> No action taken. [3262745908546fc73c4890ac04009070]

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

C:\Program Files (x86)\TMP\TMP.exe (Trojan.Backdoor) -> No action taken. [7d171fae322ab97d1efa7e7107fcec14]

(end)

mbam-log-2012-05-16 (15-54-40).zip

[miekiemoes]

Hi,

Can you zip & submit/attach the file C:\Program Files (x86)\TMP\TMP.exe please?

[rgrayling]

Zipped copy attached.

Many thanks for your speedy reply. Am trying to resolve the problem before we get inundated with client calls! :-)

Thanks

Richard

TMP.zip

[miekiemoes]

Thanks for the file. This is indeed a false positive (heuristic detection) and will be fixed in next update.

[rgrayling]

Many thanks Mieke,

That was FAST!

*Apologies for first post - I misread it as 'attach the log file to your posting' - not the offending .exe :-(

Again, thanks - that was the kind of service you don't always expect to receive in the IT Industry...

Richard

[miekiemoes]

Attaching the logfile was OK though - and is the correct approach. But in this case, I needed to take a look at the file itself again as well, so that's why I asked for it