AdvUninstCPL.cpl detected as infected

[Stang777]

Hi,

 

Malwarebytes suddenly detected the file AdvUninstCPL.cpl as a trojan (trojan.banker.cplgen) even though it had not been modified in months according to the modified date. It has also peacefully coexisted with Malwarebytes since November when the program, Advanced Uninstaller put it on.

 

I would submit it for evaluation but I cannot zip it and according to the sticky on uploading files, it must be sipped. I tried to do it with WinZip but for some reason, I cannot.

 

I uploaded it to Virus Total and out of about 50 virus scanners the only one that identified as a problem is Malwarebytes.

 

Can anyone give me any assistance with this?

 

I cannot give a creation date or modified date on it as I initially quarantined it and upon restoring it, it gave it todays date on both, but I do recall that when I first looked it the creation date was in November and it had not been modified in months. The size is 42kb

 

I really doubt this is an infected file but would like to know for sure, is there any way to do that without uploading it. Is it ok to attach it to a post without zipping it?

 

Thank you for any and help with this matter

[miekiemoes]

Hi,

 

Please attach the file so we can analyse and adjust/fix detection. You do need to zip the file in order to attach, because otherwise it won't work to attach it.

 

Thanks!

[emiko]

Hello, I am having the exactly the same problem.

I was not even running the scanning.

MalwareBytes pops up all of a sudden and I got exactly the same virus waring message.

I have been using Advanced Uninstaller for some years and I belive it is a false positive.

I hope you can fix this as soon as possible.

[miekiemoes]

Hi,

 

This is a false positive indeed and will be fixed in next database update. Ideal would be if you attach the sample being detected, so we have actual files to work with.

Thanks!

[emiko]

Here is the file in question.AdvUninstCPL.zip

[miekiemoes]

emiko, thanks for the file. Mind to give the password for the archive? Because the standard password "infected" doesn't work here.

Thanks!

[emiko]

Sorry, I did not meant to use password encryption.

Here's the zip file without password.

AdvUninstCPL.zip

[miekiemoes]

Thanks. This has been fixed by now. Please update your database and let me know if it's also fixed on your end (not detected anymore)

[emiko]

Thanks for your quick action!

I've just updated my virus database and run a scan.

There was no more false positive .

[Stang777]

Hi,

 

Thank you for your quick response, I didn't expect that. I am sorry I didn't reply as quickly. Since I didn't expect such a quick reply, I posted my question and then went to bed.

 

I see that this has already been resolved so there is no need for me to upload the file.

 

Thank you so very much for taking care of this, especially so quickly.

 

Like Emiko, I wasn't running a scan, just got the little pop up from Malwarebytes saying it was infected.

 

Emiko, thank you for submitting the file.