Possible FP - HP Webcam Driver

[jweigang]

RStone.exe (within sp36409.exe) flagged as Trojan.Dorkbot.ED

 

The driver exe comes from here:

 

   hxxp://h10025.www1.hp.com/ewfrf/wc/softwareDownloadIndex?cc=us&lc=en&softwareitem=ob-52194-1

 

 

[shadowwar]

I was unable to duplicate this here but made some adjustments. Can u let me know if this is fixed in at least 15 mins with database 06 30 10 ?

[jweigang]

Well, that did change something. Now there is no false positive for the sp36409.exe files, but it still claims that Dorkbot lives inside .zip files containing sp36409.exe, and it still identifies RStone.exe (the core problem within sp36409.exe) as being infected.

 

My temp5 directory contains the following:

 

 Directory of C:\Temp506/30/2014  06:58 PM    <DIR>          .06/30/2014  06:58 PM    <DIR>          ..06/30/2014  12:34 PM         8,698,288 Copy of sp36409.zip06/30/2014  06:58 PM                 0 dir.txt06/30/2014  06:58 PM            49,152 RStone.exe06/30/2014  12:31 PM             1,112 scanlog.txt06/30/2014  06:57 PM             1,284 scanlog_6-30-10.txt06/30/2014  12:15 PM         8,939,824 sp36409.exe06/30/2014  12:34 PM         8,698,288 sp36409.zip06/30/2014  12:15 PM         8,939,824 sp36409b.exe               8 File(s)     35,327,772 bytes

(with those zip files being what was attached to the original post--just sp36409.exe and scanlog.txt).

The log of a scan of this directory, using database 6 30 10, follows.

 

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 6/30/2014

Scan Time: 6:56:06 PM

Logfile: scanlog_6-30-10.txt

Administrator: Yes

 

Version: 2.00.2.1012

Malware Database: v2014.06.30.10

Rootkit Database: v2014.06.30.01

License: Premium

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

 

OS: Windows XP Service Pack 3

CPU: x86

File System: NTFS

User: User

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 6

Time Elapsed: 1 min, 10 sec

 

Memory: Disabled

Startup: Disabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 3

Trojan.Dorkbot.ED, C:\Temp5\Copy of sp36409.zip, , [c6dc85f97407290d7c43036132cf26da], 

Trojan.Dorkbot.ED, C:\Temp5\RStone.exe, , [c0e2a2dcb8c394a227988dd7d42d8d73], 

Trojan.Dorkbot.ED, C:\Temp5\sp36409.zip, , [bce6ec92a6d5d264922dc79d837e1ee2], 

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

[shadowwar]

ok updating shortly to fix the rstone.exe file. This should be fixed in 06 30 12. 

 

Thanks for reporting and the helpful information!

[jweigang]

Thanks, that fixed it.