Mozilla updater.exe (Trojan.Agent)

[jkeegan]

This may be a false positive as well. On scanning another machine in my network we found this result:

 

 

C:\Program Files (x86)\Mozilla Firefox\updater.exe (Trojan.Agent) -> No action taken.

 

In doing research on it, it looks to be a false positive but I don't have a smoking gun to clear it at a false positive or nail it as a Trojan. 

 

Any help would be greatly appreciated. 

[shadowwar]

Can u please zip and attach that file here?

 

I am not showing it detected here. We might need a dev log. Instructions are stickied in this forum.

[jkeegan]

We have the barracuda version of the malware bytes tool, will that run in developer mode? I get an error saying can't find mbam.exe.

[shadowwar]

well lets start by just zipping and attaching that file here.

 

C:\Program Files (x86)\Mozilla Firefox\updater.exe

 

but mbam.exe = bmrt.exe

 

thats the name for the barracuda

one

so replace the command line with bmrt.exe instead of mbam.exe

[jkeegan]

That is what I thought as well but bmrt.exe /developer didn't work, so I added the full path with bmrt.exe and it didn't work either. Once I ran it from command line instead of the run line it worked....windows 7 "special" feature?

[shadowwar]

hmm interesting. i will ask around.

dont think bmrt is that different except branding.

 

Could be spaces in path too affecting.

 

I may have this fixed but would really appreciate the updater file to figure out why this happened.

[miekiemoes]

jkeegan, please see here:

https://forums.malwarebytes.org/index.php?showtopic=129414

I'm pretty sure you're still using an way outdated version of barracuda, which causes this misdetection. This old version is not supported anymore.

This is why I strongly recommend that barracuda gets an update, not only because to fix this detection, but also because newer versions will detect more malware because of improved features - and you will be better protected.

 

Thanks!