False Positive Detection - Abrosoft FantaMorph

[Widi]

False Positive Detection -  Orginal Install file from     http://www.fantamorph.com/download/FantaMorphSetup.exe

 

 

 

Publisher Abrosoft Co.

Product Abrosoft FantaMorph 5

File version 5.0

Description Abrosoft FantaMorph 5 Setup

Comments This installation was built with Inno Setup.

[nosirrah]

This should be fixed in the next update

[NeedToKnow]

I am having the same problem with FantaMorph 4.1

 

I have had this program for years with no problems.

 

Is this a false positive?

[Widi]

Thank you for the quick update.

 

 

 Regards... !

[whatmeworry?]

According to an earlier message, this problem was supposedly fixed several weeks ago.  However, I just got back from a trip and ran a full scan of Malwarebytes Anti-Malware (PRO) 1.75.0.1300 using Database version: v2014.03.19.01.  Normally, MBAM scans find no problems, but this time it flagged five files, apparently related to Abrasoft FantaMorph 5.  Here's what the log file lists:

 

Files Detected: 5
C:\Windows\Downloaded Installations\{B49EDE9E-A498-49BD-A6B2-A37C549733DD}\Abrosoft FantaMorph 5.msi (Backdoor.Agent.PRN) -> No action taken.
C:\Windows\Installer\3210a01.msi (Backdoor.Agent.PRN) -> No action taken.
C:\Windows\Installer\{54600610-3D64-4B4B-A116-465A75CC5E84}\ARPPRODUCTICON.exe (Backdoor.Agent.PRN) -> No action taken.
C:\Windows\Installer\{54600610-3D64-4B4B-A116-465A75CC5E84}\FantaMorph.exe_B105F39FE9274038B4585E1AB21C48E9_2.exe (Backdoor.Agent.PRN) -> No action taken.
C:\Windows\Installer\{54600610-3D64-4B4B-A116-465A75CC5E84}\NewShortcut1_B105F39FE9274038B4585E1AB21C48E9_1.exe (Backdoor.Agent.PRN) -> No action taken.

 

I've had this program installed on my computer for a year and a half, and this is the first time it has been flagged.  My first thought was perhaps it was a false positive, so I thought I'd check here, and sure enough, I found this recent thread.  So is there a malware problem or not?  What should I do about the files?  Ignore?  Remove?  Please advise.

 

Thanks in advance.

[whatmeworry?]

I decided to update my database from v2014.03.19.01 to v2014.03.19.05--same date but different version.  I'm happy to report that when I re-ran a full scan, this time with the later database version, MBAM did not flag any files, even though I had told MBAM to ignore its earlier results (I assume that's what "ignore" means).  So even though today's earlier database version flagged the FantaMorph files, the later one did not.

[shadowwar]

Check the ignore tab and make sure you didnt add the files there. IF they are restore them and zip and attach a copy of the files here.

[whatmeworry?]

Wow.  It's been so long since I've had any malware that I apparently forgot the meaning of Ignore.  I've now deleted the possibly problematic files from the Ignore list and have zipped them and attached the zip file to this message. 

 

While I was trying to add the last file to the zip file, I received a warning message from MBAM that I hope I can show here (I've tried to select a thumbnail option, but I've never done that before and have no idea whether this will work):

 

The warning was triggered by my attempt to add this to the zip file:

 

I also went to the Quarantine section and found three items from today and one (also FantaMorph) that I had somehow not known about from March 1(the date of the first message in this thread):

 

I hope that clicking on these thumbnails will produce readable copies.

 

I have no idea whether there's a problem with the files or not.  MBAM clearly continues to think that there is.  Either way, many thanks for your help.

54600610-3D64-4B4B-A116-465A75CC5E84.zip

[shadowwar]

Thanks. Will be fixed in the next update.

[whatmeworry?]

Thanks very much, Rich! I'm happy to know that this was indeed a false positive.