False Positive: Trojan.Agent.ED (Realtek)

[Iknabi]

Hi

today  i did a regular scan with malwarebytes free just to find that a file named RTInstaller32.dat in C:\Program Files (x86)\Realtek\NICDRV_8169 is infected with Trojan.Agent.ED. This file is about 3 years old. I did about 30 scans with malwarebytes since then and it was never detected. Its also actually signed by Realtek.

Scanning with virustotal it is only detected by mbam (https://www.virustotal.com/de/file/651d47881cb400ea163cd4a800cf77e440f47b3dbd1ed8383d59c460c954b171/analysis/1386762110/). However the file information reveals the the "certificate was explicitly revoked by its issuer". Maybe thats the problem?

But i think this is a false positive due to the virustotal results.

Thanks in advance!

RTInstaller32.zip

[miekiemoes]

Hi,

 

This is indeed a false positive and will be fixed in next database update.

[Iknabi]

Thank you very much!

[mardangga]

Hi, I've the same issue. My RTInstaller32.dat file is detected as Trojan.Agent. But this file is located at C:\Windows\
Is this a false positive too?? Cause I've use avast for scan the file and no threat detected. I've add link to dropbox for the file.

 

https://www.dropbox.com/s/xdpomrphjwu41fv/RTInstaller32.zip?dl=0

 

Thanks in advance!

[miekiemoes]

Hi,

 

I can't reproduce detection for this file.

Are you using the latest database? If so and it's still being detected, please zip and attach the Malwarebytes log to your reply where this detection is listed.

 

Thanks!

[mardangga]

Yes, I'm using the latest database. Cause I've update my Malwarebytes a few hours ago.

 

Here is my scan log:

 

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 8/4/2015
Scan Time: 5:00 PM
Logfile: Scan Log.txt
Administrator: Yes

Version: 2.1.8.1057
Malware Database: v2015.08.04.02
Rootkit Database: v2015.08.03.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: ASUS

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 347431
Time Elapsed: 20 min, 48 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
Trojan.Agent, C:\Windows\RTInstaller32.dat, No Action By User, [fad8838186050333532d08b242c1827e],

Physical Sectors: 0
(No malicious items detected)


(end)

 

And here the link for the zip log file: https://www.dropbox.com/s/eywvwet6im1o5a3/Scan%20Log.zip?dl=0

[miekiemoes]

Thanks!

This helps to get more information about this detection. This looks like a false positive indeed and will get fixed in next database update.

Thanks for reporting!!

[mardangga]

U'r welcome. And thanks for quick reply too.