Potential FP - dotnetfx.exe, wmfdist95.exe and wextract.exe

[Andy-FML]

I just installed Windows XP on a new system this morning. I ran MB and it found this.

Seems wextract.exe is a known FP.

Looks like dotnetfx.exe windows component of some sort. Is this a FP?

I have no idea what wmfdist95.exe is.

Malwarebytes' Anti-Malware 1.34Database version: 1820Windows 5.1.2600 Service Pack 3
3/5/2009 11:25:53 AMmbam-log-2009-03-05 (11-25-52).txt
Scan type: Quick ScanObjects scanned: 56747Time elapsed: 1 minute(s), 7 second(s)
Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 3
Memory Processes Infected:(No malicious items detected)
Memory Modules Infected:(No malicious items detected)
Registry Keys Infected:(No malicious items detected)
Registry Values Infected:(No malicious items detected)
Registry Data Items Infected:(No malicious items detected)
Folders Infected:(No malicious items detected)
Files Infected:C:\WINDOWS\system32\wextract.exe (Trojan.Vundo) -> No action taken.C:\Documents and Settings\FranBox\Local Settings\Temp\VSD165.tmp\dotnetfx\dotnetfx.exe (Trojan.Vundo) -> No action taken.C:\Documents and Settings\FranBox\Local Settings\Temp\NERO1002052\Redist\wmfdist95.exe (Trojan.Vundo) -> No action taken.

[Mikes88Stang]

Same issue here. When Avira did not find the issue, I submitted to Avira with the following results:

The file 'wmfdist95.exe' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'Ahead Nero Burning Rom 7.2.0.3b'.

The file 'wextract.exe' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of 'Microsoft Windows XP (SP3)'.

[Raid]

Hi All.

Sorry, this is a known FP and we have corrected it. Please update your database and scan again. Sorry for any trouble this caused.

[Andy-FML]

Hi All.

Sorry, this is a known FP and we have corrected it. Please update your database and scan again. Sorry for any trouble this caused.

Updated. Scanned. No more FP. Thanks for your great work!