Afellowinneed Posted March 5, 2014 ID:799584 Share Posted March 5, 2014 Getting these two files to pop up on two seperate pc's as infected, scanned with a couple of other scanners and also virustotal, only malwarebytes came back with anything. Hoping this is just a false positive because if both are infected I may have a big problem on my hands.Malwarebytes Anti-Malware 1.75.0.1300www.malwarebytes.orgDatabase version: v2014.03.05.04Windows XP Service Pack 3 x86 NTFSInternet Explorer 8.0.6001.18702pc2 :: PC2-B709060FB47 [administrator]3/5/2014 4:21:25 AMMBAM-log-2014-03-05 (04-40-48).txtScan type: Full scan (C:\|)Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 287973Time elapsed: 16 minute(s), 22 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 2C:\WINDOWS\$NtServicePackUninstall$\accwiz.exe (Trojan.FakeMS) -> No action taken. [74348a755228b3832caf366d1ce5c63a]C:\WINDOWS\$NtServicePackUninstall$\ctfmon.exe (Trojan.FakeMS) -> No action taken. [02a6bd42a7d35fd7f5e7376c4bb659a7](end)files.zipMBAM-log-2014-03-05 (04-40-48).txt Link to post Share on other sites More sharing options...
sUBs Posted March 5, 2014 ID:799609 Share Posted March 5, 2014 Thank you for reporting this. It shall be fixed in our next update. Link to post Share on other sites More sharing options...
candylovergirl Posted March 5, 2014 ID:799612 Share Posted March 5, 2014 Oh my, that means I will report more FP!! XD Camelia Link to post Share on other sites More sharing options...
Melliflu Posted March 5, 2014 ID:799652 Share Posted March 5, 2014 I had the same 2 files detected this morning in the same servicepack uninstall folder as reported above: accwiz.exe and ctfmon.exe. But my MD5 hashes are different than the ones shown in the original post above. Perhaps I have a different file version. But I guess since it's the same 2 filenames and location, that it is likely being detected for the same reason. Link to post Share on other sites More sharing options...
Staff shadowwar Posted March 5, 2014 Staff ID:799753 Share Posted March 5, 2014 The md5 hashes are not for the files themselves. It helps us located what definition is hitting and what version. These should no longer be detected though. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now