ServicePackFiles & ServicePackUninstall - wextract.exe (Trojan.Vundo)

[PixelPlay]

I've had this program for several months now and love it. I just recently joined the MBAM forum.

4:45 AM here and very tired I decided to do a routine scan with MBAM before I logged off only to find 3 instances of wextract.exe.

I went over the past couple threads finding out there was a false positive for C:\WINDOWS\system32\wextract.exe.

The other 2 instances are

C:\WINDOWS\ServicePackFiles\i386\wextract.exe (Trojan.Vundo)

C:\WINDOWS\$NtServicePackUninstall$\wextract.exe (Trojan.Vundo)

I haven't taken any action yet and I'm hoping this is related to the known false positive and can be considered as such.

I followed the pinned topic so here is my developer's log.

Malwarebytes' Anti-Malware 1.34

Database version: 1820

Windows 5.1.2600 Service Pack 3

3/5/2009 4:37:34 AM

mbam-log-2009-03-05 (04-37-28).txt

Scan type: Full Scan (C:\|D:\|J:\|K:\|)

Objects scanned: 125550

Time elapsed: 33 minute(s), 6 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\ServicePackFiles\i386\wextract.exe (Trojan.Vundo) -> No action taken. [5253514247403034173621171717182334393639392422172539391822352118181717171822373

61917251717363636363636363636362535393922222535383625182437173635181717171717172

4

22181725202437181717172422173425202437182139382422172120203617383518253939242218

2

13939242218173939242217363939242217253939202234173621171717183939182235361818171

7

171822373619]

C:\WINDOWS\system32\wextract.exe (Trojan.Vundo) -> No action taken. [5253514247403034173621171717182334393639392422172539391822352118181717171822373

61917251717363636363636363636362535393922222535383625182437173635181717171717172

4

22181725202437181717172422173425202437182139382422172120203617383518253939242218

2

13939242218173939242217363939242217253939202234173621171717183939182235361818171

7

171822373619]

C:\WINDOWS\$NtServicePackUninstall$\wextract.exe (Trojan.Vundo) -> No action taken. [5253514247403034173621171717182334393639392422172539391822352118181717171822373

61917251717363636363636363636362535393922222535383625182437173635181717171717172

4

22181725202437181717172422173425202437182139382422172120203617383518253939242218

2

13939242218173939242217363939242217253939202234173621171717183939182235361818171

7

171822373619]

Any help greatly appreciated [:

[Fatdcuk]

Confirmed as F/P.

Please add to your ignore list and or restore from quarantine.

This should be fixed shortly in defs update.

[PixelPlay]

Awesome thank you so much it's a great relief! Now I can peacefully go to sleep. ^-^