possible false positive: 9EA5.tmp flagged as Trojan.Agent.VT

[JohnnySokko]

MBAM is detecting a file on my computer as malicious, classifying it as a Trojan.Agent.VT. The name of the file is 9EA5.tmp and the file path is: C:\Users\DannyLion\AppData\Local\Temp\Low\9EA5.tmp

 

I uploaded it to VirusTotal a couple of hours ago. The detection ratio was 13/57. (See here: http://bit.ly/1DUQnUd.) With MBAM's positive detection being the exception, most of the vendors that I trust are currently detecting it as safe, so I am hoping that someone can look at the file and verify whether or not it is indeed malicious.

 

Thanks!

MBAM scan log - file 9EA5.tmp being detected as Trojan.Agent.VT.txt

9EA5.zip

[shadowwar]

This is a correct detection and is a malware dll.

On the sandbox it dropped a random file and autorun key here:

 

C:\Documents and Settings\All Users\Application Data\LevfEyfas\JobeJbuq.kcu

 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

 

https://malwr.com/analysis/NDcxMTg2NmY4NDU2NGNjOWI0MGRiODdhNjA2ODlhN2Q/

[JohnnySokko]

Thanks for the confirmation. I appreciate it. Also, great job in being one of the first vendors to detect it.

 

If possible, I would like to ask a follow-up question . . .

 

After reading your confirmation, I decided to go ahead and run another MBAM scan so I could quarantine the file this time around. Before doing so, however, I decided to run a scan with HitmanPro. Yesterday, HitmanPro was not detecting the file, so my curiosity got the best of me. I just couldn't resist seeing whether or not it would do so today. It did, or at least the Kaspersky-half of it did (Bitdefender still is not detecting it).

 

Anyway, after it made the detection, a report of the file was made available, providing many additional details. That's what I would like to ask about. Specifically, the report indicates that several other files are associated with the infection, in what HitmanPro refers to as a "forensic cluster."

 

A copy of the full report is attached, but in brief, the report lists the primary detection (i.e., 9EA5.tmp) along with the associated files as follows:

 

C:\Users\DannyLion\AppData\Local\Temp\Low\9EA5.tmp

 

C:\Users\DannyLion\AppData\Roaming\Microsoft\Windows\Cookies\Low\2NH2HU5K.txt

 

C:\Users\DannyLion\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ARJKQDTC\favicon[5].ico

 

C:\Windows\Prefetch\REGSVR32.EXE-D5170E12.pf

 

What I would like to know is this: If I use MBAM to clean this infection, will MBAM also remove these additional files that are associated with the infection as well?

 

Thank you.

 

HitmanPro - detection of 9EA5.tmp.log

[shadowwar]

We dont target those files as they are non executable and harmless files/

 

An icon (.ico) cant cause any issues.

 

A txt file cant either.

 

The pf files means it used regsvr32 to launch being its a dll. Again not harmful. A pf file is just a placeholder and only dropped when something runs in windows.

 

We rather concentrate on stuff that can do damage to infect your system.

[JohnnySokko]

Thank you for taking the time to explain.

[shadowwar]

Not a problem.