Trojan.Agent.ED. False Positive?

[lulusol]

As explained here: https://forums.malwarebytes.org/index.php?/topic/158253-trojanagented-false-positive/#entry886319

 

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 10/3/2014

Scan Time: 10:31:20 PM

Logfile: mbam 3-10-14.txt

Administrator: Yes

 

Version: 2.00.2.1012

Malware Database: v2014.10.04.05

Rootkit Database: v2014.09.19.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

 

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Lisa

 

Scan Type: Custom Scan

Result: Completed

Objects Scanned: 468230

Time Elapsed: 1 hr, 52 min, 2 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 2

Trojan.Agent.ED, C:\eSupport\eDriver\Software\ASUS\ATKPackage\data\ATKPI.CAB, Quarantined, [2f5624cb0f6cdc5addb68644cf3245bb], 

Trojan.Agent.ED, C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AspScal.exe, Quarantined, [c0c5f3fc403b15217d161dada85933cd], 

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

[David H. Lipman]

Please attach the files being flagged as per the following.. Please read before reporting a false positive

 

• Take the files and put them in a ZIP or RAR archive file.
• Create a new post.
• Choose "More Reply Options" on the bottom Right of the Web Form
• Now choose "Attach Files" on the bottom Left of the Web Form.
• Browse and find your ZIP or RAR file.
• Choose "Add Reply" and there's your post with your attachment(s)

[lulusol]

Okay. I can only get it in as a compressed .zip folder. Hope this helps.

 

I also restored the two detections but they came back again as infected with Trojan.Agent.ED. 

 

Does that mean they're infected for real?

mbam3-10-14.zip

[miekiemoes]

Hi,

 

You zipped and attached your detection log instead.

Please restore those 2 files from quarantine again and when Malwarebytes detect them, do not take any actions to quarantine, because these indeed look like false positives.

 

Then zip and attach the following files:

 

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AspScal.exe

C:\eSupport\eDriver\Software\ASUS\ATKPackage\data\ATKPI.CAB

 

In case the attachement is too big, only the AspScal.exe file will be enough.

 

Thanks!

[lulusol]

Here you go.

AspScal.zip

[miekiemoes]

Thanks,

 

THis is a false positive indeed and will get fixed in next database update.

Thanks for reporting!!!

[lulusol]

So it's safe for them to be restored? 

[miekiemoes]

yes

[lulusol]

Whew. Thanks. 

 

I was scared for a moment after restoring.