othertom2015 Posted September 18, 2015 ID:990817 Share Posted September 18, 2015 Hi can anyone here tell me if these files are false positives or not?Display - Copy.zip Link to post Share on other sites More sharing options...
Staff shadowwar Posted September 18, 2015 Staff ID:990818 Share Posted September 18, 2015 Do you have the log from this detection? Link to post Share on other sites More sharing options...
Staff shadowwar Posted September 18, 2015 Staff ID:990819 Share Posted September 18, 2015 Looking at this file it doesn't seem to be a false positive. Link to post Share on other sites More sharing options...
debra09 Posted October 3, 2015 ID:993420 Share Posted October 3, 2015 There are conflicting answers to the issue of whether Trojan Valtrak.ED is a false positive. June 23,2015 MBAM detected this trojan on my system and quarrantined 2 files.One is - shown in the attached screen shot - and another which was under MBAM program data files which I restored as per instructions in another post that this trojan is a FP. The file showing in the in screenshot will not restore from MBAM saying access is denied.MBAM Pro removed this file from a Windows 7 slave drive in my computer that now will no longer boot. In other posts here and the day of the Vawtrak detection we were told Vawtrak is a FP. Can I get a straight answer here as I am running Win 10 insider preview which has expired and wish to use the secondary win 7 hd to operate system as I have moved all data files there from the Win 10 hd.Thank you for your help in advance. Attached is screenshot of the Vawtrak quarantined file with a check mark next to it -- a very long Windows file name. Please advise. Thank you Link to post Share on other sites More sharing options...
debra09 Posted October 3, 2015 ID:993423 Share Posted October 3, 2015 Below is a copy of the scan log that originally detected the 2 quarantined files detected by MBAM as Vawtrak.Trojan.ED. I apologize for forgetting to post above. Please note log state running Win 8 but actualy running Win 10 Insider PreviewMalwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 6/23/2015Scan Time: 4:07 PMLogfile: vawtrak-detectionlog-06-23-2015.txtAdministrator: YesVersion: 2.01.6.1022Malware Database: v2015.06.23.07Rootkit Database: v2015.06.22.01License: PremiumMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: DisabledOS: Windows 8CPU: x64File System: NTFSUser: TesterScan Type: Custom ScanResult: CompletedObjects Scanned: 668837Time Elapsed: 27 min, 16 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 0(No malicious items detected)Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 0(No malicious items detected)Files: 3Trojan.Vawtrak.ED, G:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\usp10.dll-k.mbam, Quarantined, [5ec5dae48efc290ddd09c2b4f70bec14],Trojan.Vawtrak.ED, G:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\usp10.dll-u.mbam, Quarantined, [ba693f7f58326cca24c242342fd321df],Trojan.Vawtrak.ED, G:\Windows\winsxs\Backup\amd64_microsoft-windows-usp_31bf3856ad364e35_6.1.7601.17514_none_0b207e7d6f1bea6f_usp10.dll_8785b649, Quarantined, [1e052797f199a1958e583e389e64d729],Physical Sectors: 0(No malicious items detected)(end) Link to post Share on other sites More sharing options...
Staff blender Posted October 3, 2015 Staff ID:993445 Share Posted October 3, 2015 Hello, I do not see an attached screenshot..Is this screenshot from the recent detection or the one that was a f/p? The dll file that you attached is VawTrak.We have plenty of VawTrak detections - but back in June we had a detection that f/p & hit a Windows file. The file "8afc49b02429a - Copy" - I have no clue what that is... is this a copy of the file from MBAM quarantine? What is drive G:\ - the unbootable Windows7 Drive? (from the f/p back in June?) Link to post Share on other sites More sharing options...
debra09 Posted October 3, 2015 ID:993491 Share Posted October 3, 2015 Hi and thank you for answering!The screen shot was just to show the file name -- of no importance. Yes this is the log of the files that were quarantined on June 23, 2015. I restored one of these files last night, ran a scan and no issues. There was only one of the below files in quarantine last night.Trojan.Vawtrak.ED, G:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\usp10.dll-k.mbam, Quarantined, [5ec5dae48efc290ddd09c2b4f70bec14],Trojan.Vawtrak.ED, G:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\usp10.dll-u.mbam, Quarantined, [ba693f7f58326cca24c242342fd321df], ** Still in quarantine is this file which is my concern as it is a windows file and will not restore: Trojan.Vawtrak.ED, G:\Windows\winsxs\Backup\amd64_microsoft-windows-usp_31bf3856ad364e35_6.1.7601.17514_none_0b207e7d6f1bea6f_usp10.dll_8785b649, Quarantined, [1e052797f199a1958e583e389e64d729], Do not understand what you are referring to here - "The file "8afc49b02429a - Copy" - I have no clue what that is.." - as I do not see this in the log file I sent you.I am going to retest the Windows 7 drive for boot now.Thank you "What is drive G:\ - the unbootable Windows7 Drive? (from the f/p back in June?)"Yes this is the Win 7 unbootable drive from the fp back in June Link to post Share on other sites More sharing options...
Staff blender Posted October 4, 2015 Staff ID:993547 Share Posted October 4, 2015 Hello, This file:Trojan.Vawtrak.ED, G:\Windows\winsxs\Backup\amd64_microsoft-windows-usp_31bf3856ad364e35_6.1.7601.17514_none_0b207e7d6f1bea6f_usp10.dll_8785b649, Quarantined, [1e052797f199a1958e583e389e64d729], It is a backup copy of the file so is not critical for boot/OS operation.The reason for access denied is because of the permissions set on the directories under winsxs. TrusedInstaller owns it & only TrustedInstaller has full permissions to it. (Trusted is even higher than Admin)You can take ownership of that specific directory (grant to administrators) (not recommended to take ownership of the entire winsxs or backup dir), then grant administrators full permissions & the file should restore OK. If not - you may find a copy on your other Win7 machine you can get a copy of to put in place. Just make sure the version # matches. (well rather the file from exactly the same folder)How to take ownership..(Please be careful with this!)http://www.7tutorials.com/take-ownership-and-change-permissions-files-and-foldersIf you do not feel comfy doing it - it's OK - that file is not critical anyway as it is a backup. Not the one the OS uses to boot with. "Do not understand what you are referring to here - "The file "8afc49b02429a - Copy" - I have no clue what that is.." - as I do not see this in the log file I sent you."This file was not in the log you posted but was in the zip file you attached. Link to post Share on other sites More sharing options...
debra09 Posted October 4, 2015 ID:993549 Share Posted October 4, 2015 HiThank you so very much for your help on this issue. I understand all that you have posted and so appreciate your time and expertise.I am a computer reseller/tech and always install, recommend and use MBAM on new systems as well as repaired systems. I am impressed by the help I have received from you and will continue to use MBAM on all systems I sell or work on! Thanx again D Link to post Share on other sites More sharing options...
debra09 Posted October 4, 2015 ID:993550 Share Posted October 4, 2015 Oh yes please consider this issue resolved :-) Link to post Share on other sites More sharing options...
Staff blender Posted October 4, 2015 Staff ID:993645 Share Posted October 4, 2015 Thank you for the positive feedback! Always good to know when we are of help. Keep well & stay safe. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now