Trojan.Carberp.ED in UserData.exe a false positive?

[Drumerero]

Hello,

 

Malewarebytes today detected Trojan.Carberp.ED in UserData.exe. I was shocked because it seems to be a very aggressive Trojan. But Avira, Virustotal and Metascan do not detect the Trojan in the file.

 

See:

 

Virustotal scan:

https://www.virustotal.com/de/file/ccf883a001a8836472a4e40643542106631c11c32606ab10b8d9dfc80fa103db/analysis/1420974003/

 

Metascan online scan:

https://www.metascan-online.com/de/scanresult/file/c2ed9762450e414b9a351259c9d2da62

 

So, is this a false positive or do I have to worry?

 

Malewarebytes scan file and Avira system file scans are attached.

 

 

mbam log 11012015.txt

AVSCAN-20150111-123724-D7ACBB6E.LOG

AVSCAN-20150111-120951-17B5C2B2.LOG

[shadowwar]

This is a false positive and should be fixed in db 07 and later.

[Drumerero]

I have run another Malwarebytes scan and it does not detect it anymore. Although Virustotal still says it does.

 

Virustotal:

https://www.virustotal.com/de/file/ccf883a001a8836472a4e40643542106631c11c32606ab10b8d9dfc80fa103db/analysis/1420987519/

 

Is Virustotal maybe not up to date with the newest database of MBAM? Anyway, the scanner does not detect the trojan so I think this is resolved, is it?

 

I attached the (clean) log file to the post.

 

Thanks for your help.

 

 

 

 

mbam log 110120152.txt

[shadowwar]

Virustotal usually lags behind up to a couple hours before it gets the new database.

[Drumerero]

There is still something strange going on. After I rebooted my system the file (UserData.exe) is simply gone. I can not find it anymore. And I restored it from Quarantine this morning.

[Drumerero]

So I don't know whether the system is clean or not or if this is now just a false positive or not. Can anybody help me with this?

[shadowwar]

This was a false positive. Mbam deletes files on reboot so if you didn't reboot when prompted and restored first it could of still been deleted possibly.

[shadowwar]

I can attach the file if u still need it

[Drumerero]

This was a false positive. Mbam deletes files on reboot so if you didn't reboot when prompted and restored first it could of still been deleted possibly.

 

There was no notification to reboot at all and I did not delete anything. When I restored the file from quarantine it was there where it has been before (C:/Programme (x86)/Smart Panel) but now it is gone. I was yet wondering why the reboot seemed to stuck a bit and I had an all black screen at first for a few seconds. I'm sorry for seeming to be a nuisance but I was worried about this whole thing.

[Drumerero]

I can attach the file if u still need it

 

Honestly I don't know what UserData.exe from Smart Panel was doing on my computer or what it is good for actually. But if it helps to stabilize the system to have it, it nice if you could attach the file.

[shadowwar]

attached.

 

userdata.zip

[Drumerero]

Thanks a lot! Now I can sleep tight again.

[shadowwar]

np. Glad its all worked out.