Trojan.Dorkbot.ED Malware?

[KD21]

Hi

 

 

I did a scan with MBAM and it detected 8 files as a Trojan.Dorkbot.ED

 

 

Files Detected: 8

C:\Program Files\Synaptics\SynTP\SynZMetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

C:\SwSetup\Drivers\Touchpad\WinWDF\x64\SynZMetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

C:\SwSetup\Drivers\Touchpad\WinWDF\x86\SynZMetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

C:\SwSetup\sp49522\WinWDF\x64\SynZMetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

C:\SwSetup\sp49522\WinWDF\x86\SynZMetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

c:\windows\system32\driverstore\filerepository\synpd.inf_amd64_neutral_70364bb2f0f827e0\synzmetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

c:\windows\system32\driverstore\filerepository\synpd.inf_amd64_neutral_703ad70e03ca80ab\synzmetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

c:\windows\system32\driverstore\filerepository\synpd.inf_amd64_neutral_c7be43ec68176fed\synzmetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

 

The files are in quarantine right now and I'm not sure if they are bad or not

[KD21]

Here is the log file

 

 

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

 

Database version: v2013.12.18.08

 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16476

Chocomuffins :: CHOCOMUFFINS-PC [administrator]

 

12/18/2013 11:35:42 AM

mbam-log-2013-12-18 (11-35-42).txt

 

Scan type: Full scan (C:\|D:\|E:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P

Scan options disabled: 

Objects scanned: 508481

Time elapsed: 2 hour(s), 36 minute(s), 24 second(s)

 

Memory Processes Detected: 0

(No malicious items detected)

 

Memory Modules Detected: 0

(No malicious items detected)

 

Registry Keys Detected: 0

(No malicious items detected)

 

Registry Values Detected: 0

(No malicious items detected)

 

Registry Data Items Detected: 0

(No malicious items detected)

 

Folders Detected: 0

(No malicious items detected)

 

Files Detected: 8

C:\Program Files\Synaptics\SynTP\SynZMetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

C:\SwSetup\Drivers\Touchpad\WinWDF\x64\SynZMetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

C:\SwSetup\Drivers\Touchpad\WinWDF\x86\SynZMetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

C:\SwSetup\sp49522\WinWDF\x64\SynZMetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

C:\SwSetup\sp49522\WinWDF\x86\SynZMetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

c:\windows\system32\driverstore\filerepository\synpd.inf_amd64_neutral_70364bb2f0f827e0\synzmetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

c:\windows\system32\driverstore\filerepository\synpd.inf_amd64_neutral_703ad70e03ca80ab\synzmetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

c:\windows\system32\driverstore\filerepository\synpd.inf_amd64_neutral_c7be43ec68176fed\synzmetr.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.

 

(end)

[kevinf80]

They appear to be legit files, maybe a good idea to open a thread here: https://forums.malwarebytes.org/index.php?showforum=42

[KD21]

So I have re-scanned 5 of the files and they came back with nothing.  So they were legit.

I just can't restore 3 of the files

 

c:\windows\system32\driverstore\filerepository\synpd.inf_amd64_neutral_70364bb2f0f827e0\synzmetr.exe

c:\windows\system32\driverstore\filerepository\synpd.inf_amd64_neutral_703ad70e03ca80ab\synzmetr.exe

c:\windows\system32\driverstore\filerepository\synpd.inf_amd64_neutral_c7be43ec68176fed\synzmetr.exe

 

Should I post about it in another section of the forum?

[kevinf80]

Yes is not a malware issue, post to the FP forum...

[KD21]

Okay

[kevinf80]

You`re very welcome....

[AdvancedSetup]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.