false positive Trojan.Corkow detections - started at 4:14 PM (-6 GMT)

[BrandonIT]

We began detecting "Trojan.Corkow" on a file "KMSVC.DLL" on many machines.  The detections are continuing over the last 3 hours.  I am checking update times on the definitions on the individual clients.

 

[thisisu]

Hello.

Got a log you can provide along with the file?

Guide on how to do so is here: 

 

Edited April 24, 2016 by thisisu

[thisisu]

I think we have found the offending file and definition without the log. Database version 2016.04.24.01 was released a couple of minutes ago which removed this detection. Let me know if all is good on your end. If the problem persists, please attach the file and log so we can ensure proper removal.

 

Thanks

Edited April 24, 2016 by thisisu

[BrandonIT]

Thank you Filipos!  I am logged into the Management Console and pushing the updated definition file to my clients.  I will let you know what happens from a machine with active detections.

 

Brandon Paulk
Senior Systems Engineer

[Mikebob]

I have 2016.04.24.01 definitions and still getting the detections on 32bit machines

[Fred_]

Hi

In my system, Malwarebytes (v2016.04.23.06 and v2016.04.23.07) detected Trojan.Corkow the registry keys:

HKLM\SOFTWARE\CLASSES\CLSID\{C1060E7E-7939-44A5-99C3-A6DCCD92AED0}

HKLM\SOFTWARE\CLASSES\INTERFACE\{C1060E7E-7939-44A5-99C3-A6DCCD92AED0}

Trojan.Corkow.txt
 

In v2016.04.24.01 update, there have been no detections in those registry keys.

False positives are ??

[Atribune]

Fred_,

Those do appear to be part of the mentioned FP.

 

Edited April 24, 2016 by Atribune

[Atribune]

Mikebob,

 

Please post the MBAM log.

[Fred_]

Atribune,

The registry key HKLM\SOFTWARE\CLASSES\INTERFACE\{C1060E7E-7939-44A5-99C3-A6DCCD92AED0}  refers to the file KMSVC.DLL.

 

[Atribune]

Yes that's correct Fred_ like I said it DOES appear to be part of the FP

 

[Fred_]

Thank you, Atribune.
Excuse me for bad English. 

[Atribune]

No problem Fred_ I did not notice an issue with your English.

[BrandonIT]

After updating to 2016.04.24-01 on my machines, the passive scans and two full scans have shown no recurrence of the Trojan.Crokow detections.

Thanks for your time and prompt attention in this matter!  It appears I can now stand down our response team.

[thisisu]

No problem. Thanks for reporting.

[shadowwar]

Would appreciate if someone can zip and upload a copy of the file that was detected. Thanks!

 

[shadowwar]

We were able to obtain the legit file. Added to filtering server to prevent this on this file again.

 

Thanks.