Spyware.Zeus FP?

[jayyjay]

Possible FP on a file from the game Chivalry: Medieval Warfare on Steam? If I remove the file and update the game through Steam, the file is redownloaded which me believe this is likely just a FP, however I would appreciate any input.

Thanks.

Malwarebytes Anti-Malware 1.70.0.1100

www.malwarebytes.org

Database version: v2013.01.08.12

Windows 7 x64 NTFS

Internet Explorer 8.0.7600.16385

Jake :: JAKE-PC [administrator]

08/01/2013 2:49:03 PM

MBAM-log-2013-01-08 (14-49-09).txt

Scan type: Custom scan (D:\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win32\TestShellEx.exe|)

Scan options enabled: File System | Heuristics/Shuriken | PUP | PUM

Scan options disabled: Memory | Startup | Registry | Heuristics/Extra | P2P

Objects scanned: 1

Time elapsed: 1 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

D:\Steam\steamapps\common\chivalrymedievalwarfare\Binaries\Win32\TestShellEx.exe (Spyware.Zeus) -> No action taken.

(end)

TestShellEx.rar

[Fatdcuk]

Hi jayyjay and thankyou for the report.

Confirmed this is a F/P and will be fixed on the next update cycle.

[Luckbad]

This was just quarantined on my system. Is it safe to remove it from quarantine? Thanks!

[Fatdcuk]

Hi Luckbad,

This is an old F/P that has been fixed.

Please can you attach the log from either the Protection module logging(If it was quarantined by the MBAM realtime protection module) or the scan output log if it was detected via a scan.

[Luckbad]

Odd, I just noticed that the date on the quarantine was 01/09/2013 even though I just got the notification right before my post. Derp. Sorry for the false positive false positive.