Need help determining whether scan picked up a threat or a false positive

[MorbidCoffee]

So I just updated Malwarebytes to have Database version: v2012.12.05.01, and ran a scan that produced four threats found on my PC. Here's the log, with the issues highlighted in red:

Malwarebytes Anti-Malware 1.65.1.1000

www.malwarebytes.org

Database version: v2012.12.05.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Paul :: MORBIDCOFFEE [administrator]

12/4/2012 8:22:35 PM

mbam-log-2012-12-04 (21-07-57).txt

Scan type: Full scan (C:\|D:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 302449

Time elapsed: 19 minute(s), 53 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpeedFan (Trojan.Agent) -> No action taken.

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 3

C:\Program Files (x86)\SpeedFan\uninstall.exe (Trojan.Agent) -> No action taken.

C:\Users\Paul\AppData\Local\Temp\is1598539481\247017_Setup.DAT (Trojan.Agent) -> No action taken.

C:\Users\Paul\Downloads\installspeedfan447.exe (Trojan.Agent) -> No action taken.

(end)

The last time I've ran a scan in Malwarebytes was yesterday with no unwanted threats found. After today's scan, I'm also not given the option to quarantine these files. Microsoft Security Essentials also picks up nothing, and as far as I can tell I'm not having issues with my PC. Any help would be greatly appreciated.

[DarkSnakeKobra]

I'm pretty sure this is a false positive. A few members here use SpeedFan. You'll have to wait for a staff member to officially confirm this.

[MorbidCoffee]

I just updated the database to v2012.12.05.02 and all the results from my first post weren't found a second time. I'm going to assume that they were false results but better safe than sorry!

[DarkSnakeKobra]

Sounds like you are all good. Let us know if you need anything else.

[MorbidCoffee]

I'm in need of assistance again, and rather than clog up the forum with new threads I'll keep my issues to this thread. I ran another scan earlier today and didn't pick anything up, and an hour ago updated to Database version: v2013.01.28.01 and found 1 object. It seems a bit more serious than my last issue, but I'd still like to get some second opinions:

Malwarebytes Anti-Malware 1.70.0.1100

www.malwarebytes.org

Database version: v2013.01.28.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Paul :: MORBIDCOFFEE [administrator]

1/27/2013 10:14:07 PM

MBAM-log-2013-01-27 (23-28-16).txt

Scan type: Full scan (C:\|D:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 366804

Time elapsed: 1 hour(s), 13 minute(s), 47 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Replace.exe (Spyware.Zbot.ED) -> No action taken.

(end)

A few questions:

1) How serious is this issue, or is it a false positive again with the latest update? I assume it's a bit more serious this time.

2) Is it safe to remove the selected issue through malwarebytes without harming my PC?

3) If it's not safe to remove this issue, what can I do to remove it?

I'd appreciate it if I could get an answer ASAP. I'd rather not leave this issue on my computer overnight.

[MorbidCoffee]

I should also mention (since I can't seem to edit my previous post) that I also ran MSE concurrently with Malwarebytes after seeing that it found an issue, and MSE picked up nothing during the scan. Don't know if this helps or not.

[Paula27]

My regular weekly scan just ran tonight and my log is also showing that same file as an infected file.

[daledoc1]

Hello, MorbidCoffee and Paula27:

It's possible that this may be a FP.

First, please be sure you have the latest MBAM database (currently v.2013.01.28.02, as I type this).

Then, in order to expedite the review by the MBAM devs/engineers, please follow the instructions in this sticky topic: READ BEFORE REPORTING A FALSE POSITIVE!.

Then please post the requested information in a new post in the FP section >>HERE<<.

HTH,

daledoc1

[Paula27]

Hello daledoc1,

I tried to follow your instructions but when I typed mbam.exe/developer into the run box it says: Windows cannot find 'mbam.exe/developer'. Make sure you typed the name correctly and then try again. However, I did update to the latest database (v2013.01.28.07) and ran a regular full scan and it comes up clean so it appears that it was a FP that has been corrected in the new database. I'm not sure why I wasn't able to run the developer version though.

Paula

[daledoc1]

Hi, Paula27:

Hello daledoc1,

I tried to follow your instructions but when I typed mbam.exe/developer into the run box it says: Windows cannot find 'mbam.exe/developer'. Make sure you typed the name correctly and then try again.

That's because there needs to be a space before the slash -- mbam.exe /developer

(Color is added for emphasis.)

However, I did update to the latest database (v2013.01.28.07) and ran a regular full scan and it comes up clean so it appears that it was a FP that has been corrected in the new database.

Yep, it appears so.

I'm not sure why I wasn't able to run the developer version though.

See above.

Anyway, yep, it appears that it was a FP & it was fixed.

Thanks for reporting it.

Cheers,

daledoc1

[Paula27]

Ah! I missed that space so thanks for pointing that out. Everything appears to be fine now so I'll know for next time. Thanks for your help!

[shadowwar]

Yes this was a false positive. It has been fixed now.