Windows/system32/AdvUninstCPL.cpl

[Tabvla]

.

Product  :  MBAM Premium 2.0.2.1012  db 2014.6.3.3

 

Suspect File  :  Windows/system32/AdvUninstCPL.cpl

 

MBAM has identified the above file as a Trojan and has quarantined the file.  Is this a false-positive?  Please note the following: -

 

1. The file was last changed on 7 March 2014

2. Another AV product scaned the file but did not find any problem

3. MBAM has scanned this file approximately 100 times since 7 March and has not flagged it as a Trojan

 

MBAM advises that the file will be "completely removed" the next time the system is Restarted.  I thought that "Quarantine" simply made the file "inactive" but did not completely remove a file.  I am not very happy about this.

 

Any thoughts on how to resolve this?

 

Thanks

 

T.

[David H. Lipman]

There is a separate thread in the file based False Positive detection sub-forum.

AdvUninstCPL.cpl detected as infected
 
If you could disable MBAM, extract the file quarantine and place it in a ZIP or RAR container then create a new post in File Detections based upon the directions in; Please read before reporting a false positive you may be able to help sort this one out.

[pondus]

First submission 2009-05-10 02:50:33 UTC ( 5 years ago )

I think this was the one scanned in the False Positive detection sub-forum.

https://www.virustotal.com/en/analisis//file/87a8a796288450a39406a97690413cfd812de298a51d12371564acd62e51a2b8/analysis/

[Firefox]

Hi,
 
This is a false positive indeed and will be fixed in next database update. Ideal would be if you attach the sample being detected, so we have actual files to work with.
Thanks!

[Tabvla]

.

Thanks for the feedback.

 

The last message from MBAM was that ".... the file will be completely removed on the next restart ...."

 

I don't want that to happen.  Currently the file is sitting in Quarantine.  I assume that if I click the box next to the filename and then click Restore that the file will be restored.  Is that correct?

 

I don't want to screw something up so I would prefer if someone who has more knowledge of of the workdings of MBAM will please confirm that this is the correct action to take.

 

Thanks

 

T.

 

[Firefox]

Yes you are correct, if you click on the Restore button the file will be restored.

[Tabvla]

.

Thanks Firefox..... much appreciated..

 

And a note for non-technical Members...  you must login as the Administrator in order to restore the file.

 

T.