False Positive Trojan.Crypt.ED in T-Mobile DLL

[SuburbanHomeboy]

Hi

 

I've just joined this forum, but have been using Malwarebytes for a few years. I have two laptops - one purely for work and one for social media and other stuff. I have T-Mobile broadband installed on both computers from when I have to connect when away from home, but I have not used it for a couple of months. I ran a full custom scan on Saturday and it came up clean on both laptops.

 

I downloaded the latest Malwarebytes database this afternoon and, during the same full custom scan, got a positive on my work-only laptop:

 

Trojan.Crypt.ED

File

C:\Program Files\T-Mobile Internet Manager\StopNetBiosService.dll

 

Rather stressed, I then downloaded the latest Malwarebytes database on my social laptop and exactly the same file was detected on that laptop. If it is malware that I downloaded, then I am at a loss to know why it has appeared on both laptops at the same time as there are no common websites that I visit, which makes me think it might be a false positive.

 

I will be putting this file into quarantine on both laptops; it must be a new addition to the database, as I haven't touched T-Mobile for a few weeks now, but is it more likely that new detection algorithms are flagging this up as a false positive, or is this a threat I'll need to deal with beyond quarantine.

 

Many thanks in advance for any assistance, and keep up the great work!

 

Rob Warner

[shadowwar]

Please reboot and then restore it from quarantine. Then navigate to the file, zip it and attach it here so i can take a look at it. This does sound like a false positive especially with the location.

[SuburbanHomeboy]

I will do - should I wait for the full scan to complete first? It might be an hour or so.

[shadowwar]

I was able to find a copy of the file. This will no longer be detected on next update of database.

[SuburbanHomeboy]

Brilliant!

 

Many thanks.

 

Rob

[Mahhn]

I have recived several false positives for Trojan.Crypt.ED over the last couple days. Fininacial software install files (2010 to 2012) cab and exe, as well as , PRINTERDLL.DLL on several systems.

[Mahhn]

I have recived several false positives for Trojan.Crypt.ED over the last couple days. Fininacial software install files (2010 to 2012) cab and exe, as well as , PRINTERDLL.DLL on several systems.

I should add that the printerdll.dll is from our software that was from the files in the .cab - these files are years old.

[David H. Lipman]

Mahhn:
 
This is SuburbanHomeboy's thread.  If you have an issue start you own thread.
 
Please reference: Please read before reporting a false positive
 
Post #2

If you are not a member of Staff or Experts group please do not reply to other users posts in either the File or Web Blocking forums.

 
Thank you for understanding.