Is this a FP?

[joemcgin]

I get the following on my machine but no other scanner picks it up. If I right click the file and scan it it comes up clean. But when I do a full scan it finds it doing the "performing extra and heuristics scan" The file is cm.dll. I tried renaming the file but when I rebooted I got an error about a file missing from csrss.exe.

Malwarebytes' Anti-Malware 1.38

Database version: 2325

Windows 5.1.2600 Service Pack 3

6/25/2009 1:42:57 PM

mbam-log-2009-06-25 (13-42-46).txt

Scan type: Full Scan (C:\|)

Objects scanned: 255494

Time elapsed: 1 hour(s), 36 minute(s), 31 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

C:\WINDOWS\system32\cm.dll (Rootkit.Haxdor) -> No action taken. [3857535134303627615642473748565261849084857078201961687815697777]

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\cm.dll (Rootkit.Haxdor) -> No action taken. [3857535134303627615642473748565261849084857078201961687815697777]

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0) -> No action taken. [5138494534363830414438586436545151384753645452385161524839535634513861498077746

87470846146746883808480718561427985708379708501388981778083708361368079858380770

1

49667970779341807870816672703018130117]

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\cm.dll (Rootkit.Haxdor) -> No action taken. [3857535134303627618874796980888461849084857078201961364615697777]

[nosirrah]

Please zip and attach a copy of :

cm.dll

to you next post please so I can have a look at it .

[joemcgin]

Here you go, thanks for taking a look!

cm.zip

cm.zip

[nosirrah]

Thanks

[joemcgin]

Bruce, did you get a chance to look at the file? Is it an actual false positive?

Thanks

[nosirrah]

Yes , this should have been corrected in one of the last fe updates .