Staff TeMerc Posted February 15, 2009 Staff ID:56791 Share Posted February 15, 2009 From support user, dev logMalwarebytes' Anti-Malware 1.34Database version: 1762Windows 5.1.2600 Service Pack 3 2/15/2009 1:23:16 PMmbam-log-2009-02-15 (13-23-16).txt Scan type: Quick ScanObjects scanned: 69430Time elapsed: 59 second(s) Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1 Memory Processes Infected:(No malicious items detected) Memory Modules Infected:(No malicious items detected) Registry Keys Infected:(No malicious items detected) Registry Values Infected:(No malicious items detected) Registry Data Items Infected:(No malicious items detected) Folders Infected:(No malicious items detected) Files Infected:\boot.ini (Trojan.Agent) -> Quarantined and deleted successfully. [385753513430616780808515747974] Link to post Share on other sites More sharing options...
gotbugs Posted February 15, 2009 ID:56860 Share Posted February 15, 2009 Just updated to 1.34 when this happened.Malwarebytes' Anti-Malware 1.34Database version: 1764Windows 5.1.2600 Service Pack 2 2/15/2009 5:14:31 PMmbam-log-2009-02-15 (developer).txt Scan type: Quick ScanObjects scanned: 49022Time elapsed: 1 minute(s), 35 second(s) Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1 Memory Processes Infected:(No malicious items detected) Memory Modules Infected:(No malicious items detected) Registry Keys Infected:(No malicious items detected) Registry Values Infected:(No malicious items detected) Registry Data Items Infected:(No malicious items detected) Folders Infected:(No malicious items detected) Files Infected:\boot.ini (Trojan.Agent) -> No action taken. [385753513430616780808515747974]This is the boot.ini file.--------------------------[boot loader]timeout=1default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS[operating systems]multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect Link to post Share on other sites More sharing options...
Root Admin RubbeR DuckY Posted February 15, 2009 Root Admin ID:56874 Share Posted February 15, 2009 Can you please click on Start, Run, and type in mbam.exe /debug. It will create a file, please attach it here. Link to post Share on other sites More sharing options...
Staff TeMerc Posted February 15, 2009 Author Staff ID:56875 Share Posted February 15, 2009 Can you please click on Start, Run, and type in mbam.exe /debug. It will create a file, please attach it here.Submitted and awaiting reply. Link to post Share on other sites More sharing options...
alshall0 Posted February 16, 2009 ID:56982 Share Posted February 16, 2009 Is this a false positive? I received a similar result with a scan on 12 February, and only now did it occur to me it might be false:Malwarebytes' Anti-Malware 1.34Database version: 1753Windows 5.1.2600 Service Pack 3 2/12/2009 10:57:33 AMmbam-log-2009-02-12 (10-57-29).txt Scan type: Quick ScanObjects scanned: 50251Time elapsed: 8 minute(s), 0 second(s) Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1 Memory Processes Infected:(No malicious items detected) Memory Modules Infected:(No malicious items detected) Registry Keys Infected:(No malicious items detected) Registry Values Infected:(No malicious items detected) Registry Data Items Infected:(No malicious items detected) Folders Infected:(No malicious items detected) Files Infected:\boot.ini (Trojan.Agent) -> No action taken.Would a log in developer mode still be of use to you at this late date? I can supply the following information:Machine is fully patched. AdAware 2008, SuperAntiSpyware, SpySweeper, SpybotS&D all installed, and none detected any problem. Full time AV is McAfee, ZoneAlarmPro firewall. McAfee turned up nothing, nor did Housecall.Further, full MBAM scan was run 11 Feb, and it detected nothing. Ran Windows Update 12 Feb, installed new patches, etc., ran MBAM quick scan. Nothing else installed in that time period.I hope that I posted this correctly. Thanks in advance for your help. Link to post Share on other sites More sharing options...
TonyKlein Posted February 16, 2009 ID:57077 Share Posted February 16, 2009 Same here:Malwarebytes' Anti-Malware 1.34Database version: 1765Windows 5.1.2600 Service Pack 316-2-2009 18:15:25mbam-log-2009-02-16 (18-15-22).txtScan type: Quick ScanObjects scanned: 48758Time elapsed: 4 minute(s), 3 second(s)Files Infected:\boot.ini (Trojan.Agent) -> No action taken.Funny thing is: I ran it a second time, and no detection. Running it a third time as we speak; will do a mbam.exe /debug afterwards Link to post Share on other sites More sharing options...
TonyKlein Posted February 16, 2009 ID:57078 Share Posted February 16, 2009 No detection third time round either, this is weird....Attaching mbam_info.txtmbam_info.txtmbam_info.txt Link to post Share on other sites More sharing options...
Mashiki Posted February 16, 2009 ID:57096 Share Posted February 16, 2009 Interesting, I am running a dualboot with Win7 right now.Malwarebytes' Anti-Malware 1.34Database version: 1766Windows 5.2.3790 Service Pack 2 2/16/2009 2:16:59 PMmbam-log-2009-02-16 (14-16-59).txt Scan type: Quick ScanObjects scanned: 58571Time elapsed: 2 minute(s), 11 second(s) Files Infected:\boot.ini (Trojan.Agent) -> No action taken.Copy of my boot.ini as well.;;Warning: Boot.ini is used on Windows XP and earlier operating systems.;Warning: Use BCDEDIT.exe to modify Windows Vista boot options.;[boot loader]timeout=30default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS[operating systems]multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Professional x64 Edition" /NOEXECUTE=OPTIN /FASTDETECTI found that after a reboot that this would pop up again, but repeated scans after an existing one it wouldn't. But not always, I have no idea what's triggering it. It's also not showing up on all of my machines. Just this one.mbam_info.txtmbam_info.txt Link to post Share on other sites More sharing options...
TonyKlein Posted February 16, 2009 ID:57097 Share Posted February 16, 2009 Copy of my boot.ini, just in case:[boot loader]timeout=20default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS[operating systems]multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /noexecute=optinmulti(0)disk(0)rdisk(0)partition(2)\WINDOWS="Safety" /noexecute=optin /fastdetectC:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons Link to post Share on other sites More sharing options...
Staff TeMerc Posted February 16, 2009 Author Staff ID:57112 Share Posted February 16, 2009 Can you please click on Start, Run, and type in mbam.exe /debug. It will create a file, please attach it here. Malwarebytes' Anti-Malware 1.34Database version: Executable location: C:\Program Files\Malwarebytes' Anti-MalwareDatabase location: C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.refUsername: Ron ScalzoWindows folder: C:\WINDOWSSystem folder: C:\WINDOWS\system32Root drive: C:Program Files: C:\Program FilesCommon Files: C:\Program Files\Common FilesC:\Documents and Settings\Administrator\DesktopDesktop: C:\Documents and Settings\All Users\DesktopDesktop: C:\Documents and Settings\Default User\DesktopDesktop: C:\Documents and Settings\LocalService\DesktopDesktop: C:\Documents and Settings\Ron Scalzo\DesktopC:\Documents and Settings\Administrator\Start MenuStart Menu: C:\Documents and Settings\All Users\Start MenuStart Menu: C:\Documents and Settings\Default User\Start MenuStart Menu: C:\Documents and Settings\LocalService\Start MenuStart Menu: C:\Documents and Settings\Ron Scalzo\Start MenuStart Menu: C:\Documents and Settings\All Users\Start MenuC:\Documents and Settings\AdministratorUser Root: C:\Documents and Settings\All UsersUser Root: C:\Documents and Settings\Default UserUser Root: C:\Documents and Settings\LocalServiceUser Root: C:\Documents and Settings\NetworkServiceUser Root: C:\Documents and Settings\Ron ScalzoC:\Documents and Settings\Administrator\FavoritesFavorite: C:\Documents and Settings\All Users\FavoritesFavorite: C:\Documents and Settings\Default User\FavoritesFavorite: C:\Documents and Settings\LocalService\FavoritesFavorite: C:\Documents and Settings\Ron Scalzo\FavoritesC:\Documents and Settings\Administrator\Application DataApplication Data: C:\Documents and Settings\All Users\Application DataApplication Data: C:\Documents and Settings\Default User\Application DataApplication Data: C:\Documents and Settings\LocalService\Application DataApplication Data: C:\Documents and Settings\NetworkService\Application DataApplication Data: C:\Documents and Settings\Ron Scalzo\Application DataApplication Data: C:\Documents and Settings\All Users\Application DataC:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Quick LaunchQuick Launch: C:\Documents and Settings\Ron Scalzo\Application Data\Microsoft\Internet Explorer\Quick LaunchTemporary Folder: C:\WINDOWS\Temp Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 20, 2009 Root Admin ID:58113 Share Posted February 20, 2009 Has this been confirmed, corrected now? Link to post Share on other sites More sharing options...
Root Admin RubbeR DuckY Posted February 20, 2009 Root Admin ID:58114 Share Posted February 20, 2009 Neither. I nor Bruce can reproduce it and I have no idea how this is happening. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 20, 2009 Root Admin ID:58116 Share Posted February 20, 2009 Okay thanks. Had a user that had removed it and had to rebuild boot.ini Link to post Share on other sites More sharing options...
TonyKlein Posted February 20, 2009 ID:58118 Share Posted February 20, 2009 I haven't been able to reproduce it either; meanwhile more reports are coming in:http://www.malwarebytes.org/forums/index.php?showtopic=11574http://www.malwarebytes.org/forums/index.p...c=11575&hl= Link to post Share on other sites More sharing options...
TonyKlein Posted February 20, 2009 ID:58120 Share Posted February 20, 2009 meanwhile more reports are coming in:http://www.malwarebytes.org/forums/index.php?showtopic=11574http://www.malwarebytes.org/forums/index.p...c=11575&hl=whoops, different threads, same poster... Link to post Share on other sites More sharing options...
HolyOne Posted February 21, 2009 ID:58425 Share Posted February 21, 2009 I'd like to report in that my MBAM has also detected boot.ini as a False Positive.Unfortunately, I was unable to recreate the FP in Developer Mode, so here is the original log:Malwarebytes' Anti-Malware 1.34Database version: 1783Windows 5.1.2600 Service Pack 2 2/21/2009 8:43:42 AMmbam-log-2009-02-21 (08-43-42).txt Scan type: Quick ScanObjects scanned: 49510Time elapsed: 19 minute(s), 43 second(s) Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1 Memory Processes Infected:(No malicious items detected) Memory Modules Infected:(No malicious items detected) Registry Keys Infected:(No malicious items detected) Registry Values Infected:(No malicious items detected) Registry Data Items Infected:(No malicious items detected) Folders Infected:(No malicious items detected) Files Infected:\boot.ini (Trojan.Agent) -> Quarantined and deleted successfully. Link to post Share on other sites More sharing options...
HolyOne Posted February 21, 2009 ID:58427 Share Posted February 21, 2009 When trying to run MBAM in developer mode, it tells me:Swissarmy failed to load; Error code: 0 or something to that effect. Link to post Share on other sites More sharing options...
nosirrah Posted February 22, 2009 ID:58756 Share Posted February 22, 2009 This is an odd glitch that I may have just fixed , please update and scan again if you were having this issue . Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now