John A Posted June 7, 2009 ID:87458 Share Posted June 7, 2009 See attached log filembam_log_2009_06_07__12_19_27_.txtmbam_log_2009_06_07__12_19_27_.txt Link to post Share on other sites More sharing options...
leofelix Posted June 7, 2009 ID:87460 Share Posted June 7, 2009 See attached log fileHi I got same problem in my desktop PC with XP Pro SP 3. (32 bit)SUPERAntiSpyware free found no malwarePREVX 3.0 found no malware tooNo malware detected in laptop with my Vista Home Premium SP 1 (32 bit), instead.I think is a f.p too. Link to post Share on other sites More sharing options...
secret365 Posted June 7, 2009 ID:87461 Share Posted June 7, 2009 Same problem here. My daily scan detected Tojan.Banker after the latest update (All previous daily scans were clean). Link to post Share on other sites More sharing options...
secret365 Posted June 7, 2009 ID:87462 Share Posted June 7, 2009 Registry Values Infected:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\W2KLpk (Trojan.Banker) -> No action taken. Link to post Share on other sites More sharing options...
ky331 Posted June 7, 2009 ID:87463 Share Posted June 7, 2009 Registry Values Infected:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\W2KLpk (Trojan.Banker) -> No action taken.same here... the one thing i can add is that this detection was part of the extra/heuristics scanning. Link to post Share on other sites More sharing options...
secret365 Posted June 7, 2009 ID:87465 Share Posted June 7, 2009 same here... the one thing i can add is that this detection was part of the extra/heuristics scanning.It is likely to be a false positive.I rarely use Internet Explorer except for monthly Windows Updates. Link to post Share on other sites More sharing options...
nosirrah Posted June 7, 2009 ID:87473 Share Posted June 7, 2009 This should be fixed . Link to post Share on other sites More sharing options...
Blue452 Posted June 7, 2009 ID:87480 Share Posted June 7, 2009 I got same entry when I scanned a few minutes ago and hit the removal button. My log says . . . Quarantined and deleted successfully.I have a question: If this is a false positive, what did Malwarebytes delete and quarantine? Blue452XP SP3IE6 Link to post Share on other sites More sharing options...
secret365 Posted June 7, 2009 ID:87481 Share Posted June 7, 2009 This should be fixed .Yes, it is fixed.I did another scan after updating to Database version: 2241, this time round no Trojan.Banker was detected. Link to post Share on other sites More sharing options...
secret365 Posted June 7, 2009 ID:87483 Share Posted June 7, 2009 I got same entry when I scanned a few minutes ago and hit the removal button. My log says . . . Quarantined and deleted successfully.I have a question: If this is a false positive, what did Malwarebytes delete and quarantine? Blue452XP SP3IE6I am also running XP SP3.Do you still have this entry in the registry?HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\W2KLpk Link to post Share on other sites More sharing options...
John A Posted June 7, 2009 Author ID:87484 Share Posted June 7, 2009 Confirmed - impressive service!This should be fixed . Link to post Share on other sites More sharing options...
Blue452 Posted June 7, 2009 ID:87486 Share Posted June 7, 2009 Rel to Post #10.Thank you for answering my post. I'm not a computer expert and I have no experience in the registry.Should I just restore this item and rerun the scan. Link to post Share on other sites More sharing options...
Blue452 Posted June 7, 2009 ID:87509 Share Posted June 7, 2009 Please ignore my above post (#12).After my thinking cleared a bit, I decided to do a "restore" since all the posts above indicated this was likely a false positive. And then I rescanned and this time, nothing was detected. Link to post Share on other sites More sharing options...
TonyKlein Posted June 7, 2009 ID:87510 Share Posted June 7, 2009 I have a question: If this is a false positive, what did Malwarebytes delete and quarantine?It's a registry value, the default value data of which determine whether the installation of Language Packs is allowed or prohibited.Certain malware does set a restriction there, but that needn't be the case here.You can simply have MBAM restore that quarantined item. Link to post Share on other sites More sharing options...
hulabird1 Posted June 7, 2009 ID:87574 Share Posted June 7, 2009 It's a registry value, the default value data of which determine whether the installation of Language Packs is allowed or prohibited.Certain malware does set a restriction there, but that needn't be the case here.You can simply have MBAM restore that quarantined item.Is it also ok if you leave it deleted? I have no clue about registry stuff, so when this was detected on my system I deleted it thinking it WAS a virus and just wanted to get rid of it, but is it something I should not have deleted?Thank You. Link to post Share on other sites More sharing options...
R1863 Posted June 7, 2009 ID:87599 Share Posted June 7, 2009 I had the same thing. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\International\W2KLpkI restored the key, updated Malwarebytes and reran the scan. All is well now. It's an FP. Link to post Share on other sites More sharing options...
TonyKlein Posted June 8, 2009 ID:87693 Share Posted June 8, 2009 Is it also ok if you leave it deleted? I have no clue about registry stuff, so when this was detected on my system I deleted it thinking it WAS a virus and just wanted to get rid of it, but is it something I should not have deleted?The "W2KLpk" DWORD value isn't always there by default. If it IS present, value data of "00000000" prevents language pack installation, and "00000001" enables it.My guess is that, if the value is absent altogether, Language Pack installation is automatically allowed without promptI'd have MBAM restore the item from quarantine, then check the Registry to make sure that LP installation is prohibited. This because there was a known Language Pack Installation vulnerability in IE (prolly fixed by now, but nevertheless...)Alternatively (obviously only if MBAM did quarantine this item on your system), you could merge the following regfile (for XP and Vista):Copy the text inside the 'Code' box to Notepad, and save in a location of your choice as Fix.reg (make sure you save as type: 'all files')Windows Registry Editor Version 5.00[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\International]"W2KLpk"=dword:00000000Doubleclick Fix.reg, and answer yes when prompted to add its contents to the RegistryEditing the regfile by changing dword:00000000 to dword:00000001 re-enables LP Installation Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now