Trojan.Agent/Gen-Virut in Windows\installer.. misc.exe

[Mobli1]

Hi I have two computers - an HP desktop running WinXPSP3 and an HP laptop running Windows7 64bit. Both are protected by Norton Internet Security and I regularly run a full scan using Malwarebytes (normally once a week). I had some problems with a virus about 6 months ago but after full OS installs everything has been fine.

Last night Malwarebytes reported the same problem on both computers - Trojan.Agent/Gen-Virut detected in:

C:\WINDOWS\INSTALLER\{90110409-6000-11D3-8CFE-0150048383C9}\MISC.EXE

and

C:\WINDOWS\INSTALLER\{90A40409-6000-11D3-8CFE-0150048383C9}\MISC.EXE

I removed the threats and rebooted as instructed on the screen but I'm worried that my machines may have been, and may still be infected.

These files are related to MS Office 2003. Can anybody advise whether these is likely to be a false positives or is it too late now that I've removed the threats?

Any help much appreciated.

Thank you

Mike

[screen317]

Hi,

I believe they are false positives.

Please restore them from quarantine.

Zip up those files and attach them here.

Click Start --> Run, and enter this:

mbam.exe /developer

Run a Full Scan and post its log here.

[Mobli1]

Will do, many thanks for the quick response. I have a similar problem with a program I've created in Microsoft Visual Studio 2008. MBAM reports Backdoor.Bot.HPWGen for all versions of the EXE I've created, including those in the Recycle Bin.

I'll restore these files from quarantine too and post the log.

Thanks again,

Mike

[screen317]

Please do the same for any suspected false positives and we will analyze the files for you.

[Mobli1]

Hi, the files from Windows\Installer had alredy been deleted so I couldn't restore from Quarantine. However my EXE created with VS2008 is still reporting a problem. Could you plese take look....

Log file and zipped EXE attached.

Many thanks

Mike

[screen317]

Hi,

In the future, please do not use the Report button. Save that for an emergency..

It appears that you didn't run the command that was shown.. Please ensure that you run:

mbam.exe /developer

..before you run the scan.

[Mobli1]

Sorry, will run it again tonight and send you another log file.

[screen317]

Okay thank you for the update.

[Mobli1]

Hi, new files attached. Many thanks.

[screen317]

I've submitted it to our developers. Thank you!

[nosirrah]

Fixed in the next update.

[Mobli1]

Hi, thanks for confirming the FalsePositive. I did an update last night and it MBAM downloaded a new version of the product as well as the definitions file. Is this expected behaviour? Sorry if it's a daft question but I'm very suspicious of additional downloads at the moment.

Many thanks

Mike

[daledoc1]

I did an update last night and it MBAM downloaded a new version of the product as well as the definitions file. Is this expected behaviour?

Many thanks

Mike

Hi, Mike:

Popping in only to answer your question.

Yes, there was a program version update a couple of days ago. The current version is 1.62.0.1300.

Malwarebytes 1.62 Released

Cheers,

daledoc1