possible false positive, audiodg.exe?

[Hiyuko]

i detected a trojan.fakems while doing a scan with malwarebytes in C:\Windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_6.1.7600.16385_none_d294b5cdfe50c681\audiodg.exe. saw that someone else had one in windows\system32\audiodg.exe and his turned off his sound yet he says he got his by looking at a website. so do i have a false positive?? or do i have an actual virus? cause i really don't want my sound to go off.

[samcloveralex]

same problem here :/ and it started today. 

[pondus]

upload audiodg.exe to www.virustotal.com   if tested before, click new scan ..... post link to scan result here

[samcloveralex]

upload audiodg.exe to www.virustotal.com   if tested before, click new scan ..... post link to scan result here

https://www.virustotal.com/ru/file/daf0f3e96b5b24f0d6651f98cccb8ecc576c2b6345b72ee103164d19bd64a95f/analysis/1401985885/

[AdvancedSetup]

Please post your actual scan log from MBAM.

 

Click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

 

 

 

[QriQ]

 

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Database version: v2014.06.05.08

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.17107

name1 :: name2 [administrator]

2014.06.05 16:51:58

mbam-log-2014-06-05 (16-51-58).txt

Scan type: Full scan (C:\|D:\|E:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P

Scan options disabled:

Objects scanned: 1010865

Time elapsed: 3 hour(s), 23 minute(s), 36 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

C:\Windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_6.1.7600.16385_none_d294b5cdfe50c681\audiodg.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.

(end)

 

Same find today. Looked up over google, people say if you have audiodg.exe in your windows\winsxs folder - it's a virus. The real one resides in windows\system32 folder.

So I impulsively quarantined it

Can't say I've installed any software since last scan, so not sure where that might've came from.

[AdvancedSetup]

Yes there was a false positive that was quickly fixed. Please update your database.  Current version is: DB version 2014.06.05.11

 

With the updated database this file will no longer be detected.

 

Thank you

[QriQ]

Also, not able to restore the quarantined item. Clicking the restore button does nothing. I still have my sound, so I suppose no biggie?

[Firefox]

Depending on your account, you may need to run Malwarebytes as an Admin to restore the files.

[AdvancedSetup]

If needed you should be able to run the following to restore the file:  How to Repair Windows 7 System Files with System File Checker

 

If you need additional help please let us know.

 

Thank you