False Positive - win32app_1

[matthewcox]

Seeing a reoccurring alert from MWB. Wondering if this is a false positive as I can't seem to locate the problem file.

MWB Support suggested I post on the forums.

 

Alert Time: 10/18/2016 9:38:36 AM
Server Hostname: (server)
Server Domain/Workgroup: (mydomain.local)
Server IP: (server ip)
Notification Catalog: Client
Description:
Malware threat detected, see details below:

10/18/2016 9:37:15 AM (PC name) (PC IP) Rootkit.ADS < No action taken > c:\Windows\system32:win32app_1

 

Thanks

[miekiemoes]

Hi,

This ( win32app_1) is actually an Alternate Data stream that is attached to the system32 folder here, hence why we detect.

See here for more information what ADS are: https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/

We have come across this win32app_1 once in a while and we aren't sure what program generates this one. We are still investigating, but this one doesn't look like a malicious alternate data stream, although it's very uncommon nowadays for adding alternate data streams to folders, especially the system32 folder, hence why we alert here.

You can safely ignore this detection - and in case you select to remove this anyway, malwarebytes will just remove the alternate datastream only, so it won't break anything.

[matthewcox]

Hi miekiemoes

 

Thanks for the prompt reply.

 

Is there anyway to make an exception? The "system32:win32app_1" format isn't accepted because it's not a valid UNC path.

[miekiemoes]

Ah yes, I'm sorry. I forgot about this - This can't be excluded unfortunately and you don't want to exclude the entire system32 folder either.

We will look into this if we can adjust our detection, so it won't find this one anymore.

[miekiemoes]

Hi Matthew,

Additional question, what database version are you running?

Because this shouldn't be detected anymore for a while already though. So unsure if you're running the latest database or a much older version.

[matthewcox]

Signature Database is v2016.10.18.09

Console Version is 1.7.0.3208

 

[matthewcox]

This may shed some light.

 

For whatever reason the machines that show this alert are running database v2013.03.01.01 !! I'll manually force the update and I'm sure this alert will disappear. Thanks for the assistance.

[miekiemoes]

Thanks - figured that machine was running an older database

Mystery solved