terrypayne Posted August 14, 2014 ID:866371 Share Posted August 14, 2014 Hi. I think these may be false positives, but wanted to get your feedback. I have had Malwarebytes Anti-Malware (Premium) 2.0.2.1012 and NetGear (wireless router) product R6300 for some time. After a system scan tonight Malwarebytes is detecting potential threats and preventing me from accessing Genie. I'm attaching the scan log information for your review. Thank you for your assistance. ------------- Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 8/14/2014Scan Time: 12:49:20 AMLogfile: netgear.txtAdministrator: Yes Version: 2.00.2.1012Malware Database: v2014.08.14.03Rootkit Database: v2014.08.04.01License: PremiumMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: Disabled OS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: REMOVEDScan Type: Threat ScanResult: CompletedObjects Scanned: 354098Time Elapsed: 29 min, 25 sec Memory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledHeuristics: EnabledPUP: WarnPUM: EnabledProcesses: 0(No malicious items detected) Modules: 19Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\Genie.dll, , [770401c56a110b2b2a585259ae5331cf],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\SvtNetworkTool.dll, , [f9820db9611a6fc7ef938d1e05fcef11],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Airprint.dll, , [1d5e02c4ef8c88ae790900ab679a41bf],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Internet.dll, , [7dfee9dd9fdcf145344ecbe0946ded13],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Map.dll, , [4c2f6f5715662016166c4269d92848b8],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\QRCode.dll, , [d4a723a36b1083b3473b09a23cc5ce32],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll, , [ff7c487eb5c6c670671b5d4e2ed31de3],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\DragonNetTool.dll, , [4c2fdbebee8d88ae6d15cfdc15ece719],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll, , [14674d79007b2d0962208724ab565da3],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Resource.dll, , [95e651751368c175fe842c7fe71ae31d],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Resource.dll, , [95e651751368c175fe842c7fe71ae31d],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll, , [710a36906d0ea492364c664523de956b],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Statistics.dll, , [9dded7ef3f3cae8872101f8c4ab71ee2],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Ui.dll, , [c6b5903657241620e39fdfcce021de22],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Wireless.dll, , [e39835916318aa8cc7bb9a11778a867a],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\DiagnosePlugin.dll, , [b2c9c7ff3c3fe551f88a377423de6898],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_Update.dll, , [0b70dee83d3e43f319693972010041bf],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_WirelessExport.dll, , [5f1c18aec5b60e289be74269f110b54b],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\WSetupApiPlugin.dll, , [6912a521ff7c55e18ff3e0cb5aa724dc],Registry Keys: 0(No malicious items detected) Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected) Folders: 0(No malicious items detected)Files: 19Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\Genie.dll, , [770401c56a110b2b2a585259ae5331cf],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\SvtNetworkTool.dll, , [f9820db9611a6fc7ef938d1e05fcef11],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Airprint.dll, , [1d5e02c4ef8c88ae790900ab679a41bf],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Internet.dll, , [7dfee9dd9fdcf145344ecbe0946ded13],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Map.dll, , [4c2f6f5715662016166c4269d92848b8],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\QRCode.dll, , [d4a723a36b1083b3473b09a23cc5ce32],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll, , [ff7c487eb5c6c670671b5d4e2ed31de3],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\DragonNetTool.dll, , [4c2fdbebee8d88ae6d15cfdc15ece719],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll, , [14674d79007b2d0962208724ab565da3],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Resource.dll, , [95e651751368c175fe842c7fe71ae31d],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll, , [710a36906d0ea492364c664523de956b],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Statistics.dll, , [9dded7ef3f3cae8872101f8c4ab71ee2],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Ui.dll, , [c6b5903657241620e39fdfcce021de22],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Wireless.dll, , [e39835916318aa8cc7bb9a11778a867a],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\DiagnosePlugin.dll, , [b2c9c7ff3c3fe551f88a377423de6898],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_Update.dll, , [0b70dee83d3e43f319693972010041bf],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_WirelessExport.dll, , [5f1c18aec5b60e289be74269f110b54b],Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\WSetupApiPlugin.dll, , [6912a521ff7c55e18ff3e0cb5aa724dc],Trojan.Crypt.ED, C:\Users\Terry\AppData\Local\NETGEARGenie\update_temp\NETGEARGenie-install.exe, , [cead6e583c3fd85e7909d8d33dc4dd23], Physical Sectors: 0(No malicious items detected) (end) Link to post Share on other sites More sharing options...
Staff miekiemoes Posted August 14, 2014 Staff ID:866379 Share Posted August 14, 2014 Hi, Can you please zip and attach at least 1 of the actual files being detected? This so it makes it easier for us to fix this.Thanks! Edit.. It's OK, I could find a copy of these already, so this will get fixed in next database update.Thanks for reporting!!! Link to post Share on other sites More sharing options...
terrypayne Posted August 14, 2014 Author ID:866382 Share Posted August 14, 2014 Thank you for your reply. I'm attaching the first two files.Genie.zipSvtNetworkTool.zip Link to post Share on other sites More sharing options...
jf257 Posted August 14, 2014 ID:866384 Share Posted August 14, 2014 Not to hijack, but to confirm that this is not an isolated case, I am getting the same hits on Netgear Genie: Malwarebytes Anti-Malwarewww.malwarebytes.org Scan Date: 8/13/2014Scan Time: 11:52:35 PMLogfile: Netgear Genie MWB files.txtAdministrator: Yes Version: 2.00.2.1012Malware Database: v2014.08.14.03Rootkit Database: v2014.08.04.01License: PremiumMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: Disabled OS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: (XXXX) Scan Type: Custom ScanResult: CompletedObjects Scanned: 542021Time Elapsed: 30 min, 2 sec Memory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledHeuristics: EnabledPUP: EnabledPUM: Enabled Processes: 0(No malicious items detected) Modules: 16Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\Genie.dll, , [3f3c477f6b10d165a4dee5c66f924ab6], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\SvtNetworkTool.dll, , [d4a7a224a6d57bbbc1c1a209a85922de], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Airprint.dll, , [ee8dbd09e59638fed1b1e0cbc73ae51b], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Internet.dll, , [57246561532869cd1c664b601be63cc4], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Map.dll, , [2e4d73538dee5adc275b0c9f51b0b34d], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\QRCode.dll, , [5f1cf6d0493268cecdb5fcaff50c649c], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll, , [077408bed1aae056651d0f9c649d16ea], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\DragonNetTool.dll, , [502b4b7be299979faed4a209a75a9c64], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll, , [46355373d4a71a1cfd854566b34eb749], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Resource.dll, , [88f3cdf963182c0ac6bcb9f2e21f26da], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Resource.dll, , [88f3cdf963182c0ac6bcb9f2e21f26da], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll, , [dc9f5373daa14de9c1c18f1c15ec827e], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Statistics.dll, , [e497cbfb710a7cbaafd3179450b153ad], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Ui.dll, , [7dfebc0ab0cbd264bac87239d82946ba], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Wireless.dll, , [215a2e98364590a6453d8c1f6e93c33d], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\DiagnosePlugin.dll, , [bfbc5b6bc6b565d190f2a605c53c7b85], Registry Keys: 0(No malicious items detected) Registry Values: 0(No malicious items detected) Registry Data: 0(No malicious items detected) Folders: 0(No malicious items detected) Files: 16Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\Genie.dll, , [3f3c477f6b10d165a4dee5c66f924ab6], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\SvtNetworkTool.dll, , [d4a7a224a6d57bbbc1c1a209a85922de], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Airprint.dll, , [ee8dbd09e59638fed1b1e0cbc73ae51b], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Internet.dll, , [57246561532869cd1c664b601be63cc4], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Map.dll, , [2e4d73538dee5adc275b0c9f51b0b34d], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\QRCode.dll, , [5f1cf6d0493268cecdb5fcaff50c649c], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll, , [077408bed1aae056651d0f9c649d16ea], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\DragonNetTool.dll, , [502b4b7be299979faed4a209a75a9c64], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll, , [46355373d4a71a1cfd854566b34eb749], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Resource.dll, , [88f3cdf963182c0ac6bcb9f2e21f26da], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll, , [dc9f5373daa14de9c1c18f1c15ec827e], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Statistics.dll, , [e497cbfb710a7cbaafd3179450b153ad], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Ui.dll, , [7dfebc0ab0cbd264bac87239d82946ba], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Wireless.dll, , [215a2e98364590a6453d8c1f6e93c33d], Trojan.Crypt.ED, C:\Program Files (x86)\NETGEAR Genie\bin\DiagnosePlugin.dll, , [bfbc5b6bc6b565d190f2a605c53c7b85], Trojan.Crypt.ED, C:\Users\(XXXX)\AppData\Local\NETGEARGenie\update_temp\NETGEARGenie-install.exe, , [04777650c0bb4beb483a1794818051af], False positive? Link to post Share on other sites More sharing options...
Seattlebaby Posted August 14, 2014 ID:866385 Share Posted August 14, 2014 Same here getting the False Positives for Netgear Genie Link to post Share on other sites More sharing options...
David H. Lipman Posted August 14, 2014 ID:866418 Share Posted August 14, 2014 jf257 and Seattlebaby: "Me too" type reply posts and confirmations are not needed and are actually not allowed as a reply post in the False Positive sub-forums. Please reference: Please read before reporting a false positive Post #2If you are not a member of Staff or Experts group please do not reply to other users posts in either the File or Web Blocking forums. Thank you for understanding. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 14, 2014 Root Admin ID:866577 Share Posted August 14, 2014 This has been corrected. You can restore the files if they were removed or reinstall the Genie software.Please update MBAM and it will no longer be detected. Thank you Link to post Share on other sites More sharing options...
Recommended Posts