bowow Posted February 7, 2015 ID:937210 Share Posted February 7, 2015 MBAM has identified a Trojan.Agent.ED in Cyberlink Richvideo.exe file and registry. Online research suggests this is either a false positive or an infection. No other anti-virus scan that I've run is identfying this as an infection. Restored .exe file, which is attached. Please advise on Cyberlink file, reg value and key. Malwarebytes Anti-Malware 1.61.0.1400www.malwarebytes.orgDatabase version: v2015.02.05.11Windows 7 Service Pack 1 x64 NTFS2/5/2015 9:07:14 PMmbam-log-2015-02-05 (21-07-14).txtScan type: Full scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 550845Time elapsed: 1 hour(s), 47 minute(s), 39 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 1HKCR\TypeLib\{D37B5B2C-8D1B-4832-89E4-6FCE903B3A18} (Trojan.Agent.ED) -> Quarantined and deleted successfully.Registry Values Detected: 1HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\PROGRAM FILES (X86)\CYBERLINK\SHARED FILES\RICHVIDEO.EXE (Trojan.Agent.ED) -> Data: 3 -> Quarantined and deleted successfully.Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 1C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Trojan.Agent.ED) -> Quarantined and deleted successfully.(end)RichVideo.zip Link to post Share on other sites More sharing options...
nosirrah Posted February 7, 2015 ID:937213 Share Posted February 7, 2015 I believe that this was fixed earlier, please update and scan again. Link to post Share on other sites More sharing options...
daledoc1 Posted February 7, 2015 ID:937214 Share Posted February 7, 2015 Malwarebytes Anti-Malware 1.61.0.1400 If I may pop in: user might want to clean upgrade to the current program version (2.0.4.1028)?I think program version 1.61 was released in April 2012 and is no longer supported. Clean upgrade instructions are here: MBAM Clean Removal Process 2x <pardon my intrusion> Link to post Share on other sites More sharing options...
bowow Posted February 7, 2015 Author ID:937215 Share Posted February 7, 2015 Thanks for the reply, I updated this morning and scanned, same reuslt. Link to post Share on other sites More sharing options...
bowow Posted February 7, 2015 Author ID:937219 Share Posted February 7, 2015 If I may pop in: user might want to clean upgrade to the current program version (2.0.4.1028)?I think program version 1.61 was released in April 2012 and is no longer supported. Clean upgrade instructions are here: MBAM Clean Removal Process 2x <pardon my intrusion>Apprecite the input Link to post Share on other sites More sharing options...
Staff shadowwar Posted February 7, 2015 Staff ID:937299 Share Posted February 7, 2015 Checking this now. Thanks. Link to post Share on other sites More sharing options...
Staff shadowwar Posted February 7, 2015 Staff ID:937300 Share Posted February 7, 2015 This is showing clean on my end wth current database and malwarebytes. 2.04.1028. Can u please rescan and post that log here with mbam 2.x. Thanks. Link to post Share on other sites More sharing options...
bowow Posted February 8, 2015 Author ID:937613 Share Posted February 8, 2015 Thank you. Log is below. Scan with 2.00.4.1028 took less than a tenth the time of 1.61.0.1400. Has the scanning process changed that much or am I missing something? Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 2/8/2015Scan Time: 10:16:07 AMLogfile: MBAM Log 2-8-15.txtAdministrator: YesVersion: 2.00.4.1028Malware Database: v2015.02.08.04Rootkit Database: v2015.02.03.01License: FreeMalware Protection: DisabledMalicious Website Protection: DisabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSScan Type: Threat ScanResult: CompletedObjects Scanned: 359687Time Elapsed: 10 min, 56 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 0(No malicious items detected)Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 0(No malicious items detected)Files: 0(No malicious items detected)Physical Sectors: 0(No malicious items detected)(end) Link to post Share on other sites More sharing options...
Staff shadowwar Posted February 8, 2015 Staff ID:937617 Share Posted February 8, 2015 2.04 has a lot of engine improvements and scanning improvements over 1.6. Its very important to stay up to date with the latest release to have the best protection and detection. Each new version has engine revisions and the older version wont have nearly as good of detection. The engine was completely rewritten since 1.6 and was greatly speeded up. However i noticed that u ran a full scan with the first post. This would be equlivalent to a Custom scan in 2.x. Threat scan is all that is really needed 99% of the time to remove any malware that may be active. You can do a custom scan once in a while. Link to post Share on other sites More sharing options...
bowow Posted February 8, 2015 Author ID:937618 Share Posted February 8, 2015 Since you showed it as clean and the latest scan shows no infection, yes. Thanks for the assist. Link to post Share on other sites More sharing options...
Staff shadowwar Posted February 8, 2015 Staff ID:937619 Share Posted February 8, 2015 Sorry edited my previous post. Let me know if you do a custom scan and its still detected. Link to post Share on other sites More sharing options...
bowow Posted February 8, 2015 Author ID:937621 Share Posted February 8, 2015 Did that too, nothing. Link to post Share on other sites More sharing options...
bowow Posted February 8, 2015 Author ID:937622 Share Posted February 8, 2015 Amended, did that too on the Cyberlink file. Link to post Share on other sites More sharing options...
Staff shadowwar Posted February 8, 2015 Staff ID:937753 Share Posted February 8, 2015 Great thanks!!! Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now