jmachats Posted December 9, 2013 ID:762399 Share Posted December 9, 2013 Malwarebytes flagged two of these Trojans on my laptop. However, they were deemed false positives 3 years ago in another Forum post Link to post Share on other sites More sharing options...
project_mercy Posted December 9, 2013 ID:762403 Share Posted December 9, 2013 Same issue. See the thread he references here. Link to post Share on other sites More sharing options...
Staff shadowwar Posted December 9, 2013 Staff ID:762458 Share Posted December 9, 2013 Please attach a scan log and the files being detected in a zip here. That thread is over 3 years old and the files could of possibly changed somewhat from that post. Link to post Share on other sites More sharing options...
jmachats Posted December 9, 2013 Author ID:762560 Share Posted December 9, 2013 Here is the log. New to the forums, not sure if sending it the correct way mbam-log-2013-12-09 (03-35-08).txt Link to post Share on other sites More sharing options...
Staff shadowwar Posted December 10, 2013 Staff ID:762576 Share Posted December 10, 2013 this should already be fixed. please update and recheck. Link to post Share on other sites More sharing options...
jmachats Posted December 10, 2013 Author ID:762600 Share Posted December 10, 2013 what do you mean by "recheck"? The files have already been quarantined. Do you mean release them from quarantine, update and re-scan? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 10, 2013 Root Admin ID:762609 Share Posted December 10, 2013 Yes please. Then let us know if all is okay for you now. Thank you Link to post Share on other sites More sharing options...
jmachats Posted December 10, 2013 Author ID:762617 Share Posted December 10, 2013 I tried to restore both files - it would only restore one. I tried multiple times, it would not restore the other I'm scanning now for the one file Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 10, 2013 Root Admin ID:762619 Share Posted December 10, 2013 The location where it is stored is the issue. Only the TrustedInstaller account has rights to replace the file there. Try the DVD program out and scan for infection again and let me know if you continue to have any issues or errors. If needed we may need to address replacing the one file manually but let me know. Thanks Link to post Share on other sites More sharing options...
jmachats Posted December 10, 2013 Author ID:762624 Share Posted December 10, 2013 It must be an old program I once installed on there because that DVD player is not the one I currently use. I can't try it because I don't use it However I did scan for the one I was able to restore. MB did not flag it Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 10, 2013 Root Admin ID:762627 Share Posted December 10, 2013 Okay, thank you for the update. If you no longer use it then you may want to consider doing an actual uninstall of the program simply for general maintenance. If there is anything else please let us know. Thank you Link to post Share on other sites More sharing options...
J_Meyer Posted December 10, 2013 ID:762637 Share Posted December 10, 2013 Can I ask two follow-up questions on this topic?(Apologies in advance for not being very tech-savvy)I have the exact same 'DVD Maker trojan.FakeMS' issue with a log file nearly identical to jmachats above. The 2 files were noted as quarantined and deleted successfully. I re-ran MB after removal and it now shows no malicious items detected.ref - my mbam log:"Files Detected: 2C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui (Trojan.FakeMS) -> Quarantined and deleted successfully.C:\Windows\winsxs\amd64_microsoft-windows-o..sc-wizard.resources_31bf3856ad364e35_6.1.7600.16385_en-us_102a16b698e56faf\DVDMaker.exe.mui (Trojan.FakeMS) -> Quarantined and deleted successfully."My first question is, by false-positive, does that mean there was nothing wrong to begin with? My cpu usage started spiking continuously with no programs running - which is how I knew something was wrong in the first place. It happened three times in a row - about an hour after restarting and is now functioning normally after running MB.My second question is, is this all that needs to be done? According to countless articles online including MB topics, they consistently recommend numerous detection/cleaning downloads with detailed steps that must be taken to ensure your system is free of a trojan.FakeMS infection... including a complete re-install of the OS in some cases because this infection is said to be brutal.It would be great if I've already handled the problem (thanks to Malwarebytes) but after everything I've read about it, this just seems too easy and I am still concerned about security issues. Is there any reason at all to D/L & run ComboFix, AdwCleaner, a Junkware Removal Tool or a TDSSKiller to be sure no rootkits are involved?Thank you for your help and for your indispensable program. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 10, 2013 Root Admin ID:762639 Share Posted December 10, 2013 Yes, a "False Positive" means that some object was detected as an infection when in fact it was not an infection. No, if this is/was you're only detection then you should be just fine. If you do use this program and it's no longer working then you can elect to try a restore from the quarantine folder or try reinstalling the program. If you need further assistance please let us know. Thanks Link to post Share on other sites More sharing options...
J_Meyer Posted December 10, 2013 ID:762646 Share Posted December 10, 2013 Thank you for your help. In your experience, do you have any knowledge on what would have caused the cpu spike(s) if there was never any infection, and once the files were deleted, the cpu spikes stopped? This is what doesn't make any sense to me and it still has me concerned about my computer's security. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 10, 2013 Root Admin ID:762652 Share Posted December 10, 2013 Difficult to say without doing some scans of your system but you'd need to do so in another sub forum as we're now getting off topic for this discussion. If you like we can have one of the Experts help you examine your system. I would suggest following the advice from the topic here Available Assistance for Possibly Infected Computers and having one of the Experts assist you with looking into your issue.I will go ahead and close this topic now but if you want to go ahead and follow the directions above if for nothing else a piece of mind. Thanks Link to post Share on other sites More sharing options...
Recommended Posts