VirusTotal incorrectly reports Malwarebytes as not detecting SVHOST.exe

[Naki]

It is this one;

https://www.virustot...sis/1356787104/

Please contact VirusTotal about it, and/or do the steps required to fix this missing item.

This svhost.exe trojan sometimes also comes as main.exe.

Thanks for any comments!

[Naki]

Sorry, forgot to mention:

When I try to scan my system with with MalwareBytes AntiMalware, it detects and cleans this malware just fine.

[shadowwar]

can we see a copy of the log showing the detection?

Malwarebytes also hits files on heuristics which virustotal has no way of showing because it doesnt install the file.

[Naki]

Is there a way to add the file to the MalwareBytes proper definitions, so that it can catch it without any heuristics?

By the way, since my antivirus software - Microsoft Security Essentials - catches and removed this trojan, I have to disable it first, then test with MalwareBytes.

Do you want the file itself too?

It is a very dangerous trojan.

Malwarebytes Anti-Malware 1.70.0.1100

www.malwarebytes.org

Database version: v2012.12.29.06

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

[user name] :: xxxxx-PC [administrator]

29.12.2012 16:17:09

mbam-log-2012-12-29 (16-17-09).txt

Scan type: Custom scan (D:\Documents\Virus\svhost.exe|)

Scan options enabled: File System | Heuristics/Shuriken | PUP | PUM

Scan options disabled: Memory | Startup | Registry | Heuristics/Extra | P2P

Objects scanned: 1

Time elapsed: 3 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

D:\Documents\Virus\svhost.exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.

(end)

[Naki]

Why can I still not edit my posts? You said 10 posts will remove this limit.

Anyway, this trojan signature (plus possibly the Registry entries it creates on infecting a system) should be added to your definitions!

All of your major competitors detect and clean this trojan, with the sole exception of "Avast!".

[shadowwar]

I already added detection for the file. Also this file is over 2 months old and most likely not in the wild anymore except collections.

Also as long as it is detected one way or another that is what is important.

[daledoc1]

Why can I still not edit my posts?

Hi, Naki:

Ability to edit posts comes with Honorary Member status at 50 posts.

Sorry for any confusion,

daledoc1

[shadowwar]

I apologize. I thought it was 10.

[daledoc1]

I apologize. I thought it was 10.

[Naki]

No problem on the posts issue.

It just seems to be this makes MalwareByte look bad, because VirusTotal reports the virus/trojan as undetected by it.

Also, will MalwareBytes clear & stop the trojan completely? I mean stop any active EXEs, remove Registry entries/etc?

I am testing the svhost.exe removal with it being inactive, for obvious reasons (when it was active, the trojan maker started editing my files ).