Trojan.Spatet found in HP Solution Centre file

[Taffy1812]

I have a possible False Positive to report. MWB found this Trojan in an HP Solution Centre file for my HP Deskjet F2280. The Solution Centre had just been updated by HP but all this happened around the same time last week that Microsft found big security holes in Internet Explorer.

I followed the instructions in “READ BEFORE REPORTING” etc but when I ran the scan it found nothing – presumably because the (possible) Trojan has now been quarantined.

So here is a copy of the original log – is it enough for you to check it out please?

I’ve no idea how to save as Zip or RAR. Sorry!

Malwarebytes Anti-Malware 1.65.0.1400

www.malwarebytes.org

Database version: v2012.09.23.05

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

User :: USER-137D63F698 [administrator]

23/09/2012 18:40:43

mbam-log-2012-09-23 (18-40-43).txt

Scan type: Full scan (C:\|D:\|E:\|K:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 581134

Time elapsed: 2 hour(s), 4 minute(s), 57 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\PROGRAM FILES\HP\DIGITAL IMAGING\HELP\PLAYER\FLASHPLA.EXE (Trojan.Spatet) -> Data: 3 -> Quarantined and deleted successfully.

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

C:\Program Files\HP\Digital Imaging\help\player\FlashPla.exe (Trojan.Spatet) -> Quarantined and deleted successfully.

(end)

[sUBs]

Hello, please dequarantine the file and then have mbam update itself. If it's still being detected, kindly let us know.

[Taffy1812]

did as you suggested, ran MWB again and now all clear. Thank you.

[aquarabbit]

This reappeared for me on database version 2012.09.26.13

Is it safe to just ignore these since they keep popping up?

[sUBs]

Hello, each detection may be different for each file. It would be good if we start a fresh thread for this. Kindly follow the instructs from here: http://forums.malwarebytes.org/index.php?showtopic=3228

[DarkSnakeKobra]

I started another topic a few days ago that was fixed, but then started appearing again.

http://forums.malwarebytes.org/index.php?showtopic=116189