Sunbelt VIPRE is playing dirty.

[Morbeus]

I am new to this forum and not sure just where this should be posted.

This is what popped up while I was just browsing around my downloaded programs drive. This is a report on the installer not the application in "Program Files (X86)" foder. I am quoting the popup from VIPRE, however I did highlight some things.

Active Protection Event Details

Event Type Notify

Timeout 0(s)

Monitor Source On File Access

Monitor Type File

Recommend System Scan No

Event Actor Enum Object

Application Information

File Path C:\Windows\Explorer.EXE

Process ID 4412

File Size 3080704(

CRC8 0000000000000000

Application Rating Unknown

Added To Always Allow List No

Company Microsoft Corporation

File Version 6.0.6000.16386 (vista_rtm.061101-2205)

Product Name Microsoft

[GT500]

The proper path for MBAM is as follows:

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

Not only should the file name not be Malwarebytes.exe but it should never be in the root of the drive like that.

[lordpake]

@GT:

This is what popped up while I was just browsing around my downloaded programs drive. This is a report on the installer not the application in

[GT500]

Yea, great job on my part reading the entire post.

Anyway, why is the installer named Malwarebytes.exe?

[exile360]

The installer by default is named mbam-setup.exe, so either the file is the installer for a rogue app, or it has been renamed for some reason.

[Morbeus]

Yea, great job on my part reading the entire post.

Anyway, why is the installer named Malwarebytes.exe?

Sorry it took so long to reply back. Anyhow the installer is correctly named "mbam-setup.exe" but oddly VIPRE shows it as "malwarebytes.exe" I am attaching a screen capture so you can see what I see and a copy of the log file. Drive letter "H:\" is a thumb drive with a copy of mbam-setup.exe also. My virus defs were last updated on 2/16/2009 defs build #2570.

VIPRElog.txt

VIPRElog.txt

[exile360]

Very interesting. Have you contacted Sunbelt to make them aware of the FP? I'm sure they aren't doing this intentionally (although I could see the advantage from a business standpoint ).

[GT500]

although I could see the advantage from a business standpoint

Yes, but it puts you at a disadvantage when your customers realize that you are falsely targeting legitimate software. The longer it takes a company to fix a problem like that, the more of a public relations nightmare it causes.