File detecion for wordpad.

[JustinJNB]

Did a full scan and it showed that wordpad.exe.mui was coming up as a Trojan.Ransom.HT found in c:\program files (x86\Windows NT\Accessories\en-US\wordpad.exe.mui

 

 

I've never noticed this before and this file isn't new on my PC.

 

Possibly a false postive?

 

[shadowwar]

It could be but need more information.

 

Can you please post the scan log and please zip the file detected and attach them both here so i can look at this?

 

Thanks.

[JustinJNB]

Thanks for the reply.  I'm new to this forum so I'm not sure if I am uploading the correct info. How do I attach a file?

[David H. Lipman]

Please reference:  Please read before reporting a false positive

• Take the files and put them in a ZIP or RAR archive file.
• Create a new post.
• Choose "More Reply Options" on the bottom Right of the Web Form
• Now choose "Attach Files" on the bottom Left of the Web Form.
• Browse and find your ZIP or RAR file and the MBAM Log.
• Choose "Add Reply" and there's your post with your attachment(s)

[JustinJNB]

Edit - I figured out how and I believe these are what you are asking for.

wordpad.txt

wordpad.rar

[shadowwar]

This should be fixed in db 02 18 01. If you update it should no longer be detected.

 

Thanks for reporting.

[thrall]

I came here to post the exact same thing!  MBAM is detecting Wordpad.exe.MUI as a trojan.  To test, I copied a copy of wordpad.exe.mui over from a Windows 8 virtual machine that I have, installed it in to my host directory, ran it, and got the same error.

[JustinJNB]

Thank you guys very very much for this.

 

Also, there was 3 other files as well that was detected that was also from wordpad that was located in the Windows folder. I already deleted them from the history and can't restore them to show you since I thought it was a serious threat but I'm sure that is was also a false positive.

 

I never downloaded anything nor installed anything new so I was worried about it since it was coming up as wordpad.

 

Thanks again!

[shadowwar]

You should never delete from Quarantine right away. Files in there are encrypted and cant cause any harm. If they turn out to be a false positive you can still restore them. If they were all the same vendor name then you can copy the one you posted to those locations if need.

[JustinJNB]

Thanks for the info. I thought you had to delete them for them not work. Lucky wordpad still works just fine even after the deletion.

 

Thanks again!

[David H. Lipman]

thrall:
 
This is JustinJNB's thread.   If you have an issue, please start your own thread.

Please reference: Please read before reporting a false positive
 
Post #2

If you are not a member of Staff or Experts group please do not reply to other users posts in either the File or Web Blocking forums.

 
Thank you for understanding.