Bellzemos Posted July 17, 2009 ID:99918 Share Posted July 17, 2009 18.7.2009 1:41:17mbam-log-2009-07-18 (01-41-17).txtScan type: Full Scan (C:\|D:\|)Objects scanned: 132801Time elapsed: 11 minute(s), 23 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Files Infected:c:\program files\WinRAR\Default.SFX (Spyware.Banker) -> Quarantined and deleted successfully. Link to post Share on other sites More sharing options...
prairie dog Posted July 18, 2009 ID:99945 Share Posted July 18, 2009 I googled the file name and it looks like a false positive from what I saw. However, I would wait for an expert to reply in order to confirm any of this. This doesn't mean that your file wasn't infected. Hold tight, someone should be with you shortly! Link to post Share on other sites More sharing options...
zalmoxis Posted July 18, 2009 ID:99956 Share Posted July 18, 2009 I ran a scan today and got the same exact message. Same spyware and location Link to post Share on other sites More sharing options...
yardbird Posted July 18, 2009 ID:99960 Share Posted July 18, 2009 If its in Quarantine, please wait for instructions, you can't use a search engine to make a determination if its a F/P or a prob. or something the admins can fix...regards.. Link to post Share on other sites More sharing options...
prairie dog Posted July 18, 2009 ID:99964 Share Posted July 18, 2009 If its in Quarantine, please wait for instructions, you can't use a search engine to make a determination if its a F/P or a prob. or something the admins can fix...regards..Thats why i said wait for an expert Link to post Share on other sites More sharing options...
exile360 Posted July 18, 2009 ID:99969 Share Posted July 18, 2009 I also have WinRAR installed but am not getting this FP (just did a quick scan to check), but I can confirm the file name and location as being legit. To resolve the FP more quickly, one of you who is getting this FP please follow the instructions here and post the developer log in a reply to this post. Link to post Share on other sites More sharing options...
yardbird Posted July 18, 2009 ID:99974 Share Posted July 18, 2009 Thats why i said wait for an expert @ prairie dog I know, but we have the issue of multiple users under 1 title, each user should start a new topic!so we have Bellzemos and zalmoxis no prob... Link to post Share on other sites More sharing options...
nosirrah Posted July 18, 2009 ID:100012 Share Posted July 18, 2009 This should no longer be detected . Link to post Share on other sites More sharing options...
HH89 Posted July 18, 2009 ID:100022 Share Posted July 18, 2009 18.7.2009 1:41:17mbam-log-2009-07-18 (01-41-17).txtScan type: Full Scan (C:\|D:\|)Objects scanned: 132801Time elapsed: 11 minute(s), 23 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Files Infected:c:\program files\WinRAR\Default.SFX (Spyware.Banker) -> Quarantined and deleted successfully.Just got this exact same problem today after the latest update (I scanned about 5 hours ago, prior to making this post). FWIW I use Winrar on a daily basis, and scan my computer with Malwarebytes once every 2-3 days (update the program before each scan). I scanned earlier this week around July 14-15th and it didn't pick up anything. I ended up quarantining and deleting the file just in case. I do A LOT of online banking, so didn't want to take any chances.Anyways I just got home, and decided to try updating/scanning again to see if it would pick it up again. I went back on my computer and noticed that there were 2 new updates for Malwarebytes released in the last 5 hrs (one was released right after my initial scan, and the other was just now when I updated). Since I had already deleted the file on my main computer, I decided to update Malwarebytes on my laptop to see if it would still pick up Default.SFX as being infected with Spyware.Banker even after the latest couple of updates that were released. In short, it still does! The latest update Database version 2455, is still picking this file up as being infected with Spyware.Banker!Anyways, I decided to upload this file onto Jotti Scan - it comes up as clean.On virus total it comes up as being infected by 2/41 (comes up as being infected with "Win32 malware" by eSafe and McAfee-GW-Edition).Can anyone else confirm this problem?Is this indeed a F/P?Kind regards.- HH89 Link to post Share on other sites More sharing options...
exile360 Posted July 18, 2009 ID:100024 Share Posted July 18, 2009 Greetings HH89 .Please follow the instructions here and post back with the developer log.Thanks . Link to post Share on other sites More sharing options...
HH89 Posted July 18, 2009 ID:100025 Share Posted July 18, 2009 This should no longer be detected .ok, after making my initial post. I went back and updated Malwarebytes again. There was indeed another update from "Database version 2455 --> 2456".However, "default.SFX" is still coming up as being infected.Kind regards,- HH89 Link to post Share on other sites More sharing options...
HH89 Posted July 18, 2009 ID:100028 Share Posted July 18, 2009 Greetings HH89 .Please follow the instructions here and post back with the developer log.Thanks .Hey there Exile!Alright, gonna do this right now on my laptop, will post results once finished!Kind regards,- HH89 Link to post Share on other sites More sharing options...
HH89 Posted July 18, 2009 ID:100031 Share Posted July 18, 2009 Greetings HH89 .Please follow the instructions here and post back with the developer log.Thanks .Heres the developer log guys:Malwarebytes' Anti-Malware 1.39Database version: 2456Windows 5.1.2600 Service Pack 27/18/2009 2:57:44 AMDeveloperLog_mbam-log-2009-07-18 (02-57-31).txtScan type: Full Scan (A:\|C:\|D:\|E:\|)Objects scanned: 107532Time elapsed: 5 minute(s), 53 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:c:\program files\WinRAR\Default.SFX (Spyware.Banker) -> No action taken. [525351424740523025182317171301212222172136211821202122212321262136212221212136212417172219212221382118213721222121213621241717192224201917192224201917192224201717212421222221221721182220222022242139221921212018171721182220] Link to post Share on other sites More sharing options...
HH89 Posted July 18, 2009 ID:100033 Share Posted July 18, 2009 Hey guys, FWIW. I did scan my computer with MBAM on July 16th (prior to the latest updates that went out on the 17th - which is when MBAM first started to pick up default.SFX as being infected).Heres the log file for the scan I did 2 days ago:Malwarebytes' Anti-Malware 1.39Database version: 2441Windows 6.0.6001 Service Pack 17/16/2009 12:43:12 PMmbam-log-2009-07-16 (12-43-12).txtScan type: Full Scan (A:\|C:\|D:\|E:\|F:\|)Objects scanned: 367564Time elapsed: 1 hour(s), 2 minute(s), 35 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)As you can see everything comes up clean.Heres the log file for when MBAM started picking up the spyware (which came about after updating to "Database version: 2453 - and continues through even to Database version: 2456" which I did about 5-6 hours ago on my main computer):Malwarebytes' Anti-Malware 1.39Database version: 2453Windows 6.0.6001 Service Pack 17/17/2009 11:39:13 PMmbam-log-2009-07-17 (23-39-13).txtScan type: Full Scan (A:\|C:\|D:\|E:\|F:\|)Objects scanned: 369680Time elapsed: 59 minute(s), 44 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:c:\program files (x86)\WinRAR\Default.SFX (Spyware.Banker) -> Quarantined and deleted successfully.Hope this helps in solving the problem.Kind regards,- HH89 Link to post Share on other sites More sharing options...
nosirrah Posted July 18, 2009 ID:100066 Share Posted July 18, 2009 Database version: 2457If the scan is not done with this version or higher the scan is not valid .I need someone with up to date definitions to confirm that this is fixed . Link to post Share on other sites More sharing options...
dehumanizer Posted July 18, 2009 ID:100070 Share Posted July 18, 2009 I just had this scare the hell out of me. I'm assuming it's a false positive as well but I still want pure 100% confirmation by you admins.I have noticed that the only winrar it flags is version 3.71. I scanned it on multiple PC's and 3.71 was flagged to have spyware.banker each time. Newest build of winrar shows nothing.I'm still about to change every damn password and login info I have for my accounts but thought knowing 3.71 was throwing it might help fix the issue. Link to post Share on other sites More sharing options...
dehumanizer Posted July 18, 2009 ID:100072 Share Posted July 18, 2009 Database version: 2457If the scan is not done with this version or higher the scan is not valid .I need someone with up to date definitions to confirm that this is fixed .Where do we get 2457? Updating through the program doesn't show it. Link to post Share on other sites More sharing options...
dehumanizer Posted July 18, 2009 ID:100078 Share Posted July 18, 2009 Database version: 2457If the scan is not done with this version or higher the scan is not valid .I need someone with up to date definitions to confirm that this is fixed .2457 popped up now. Scanning Winrar 3.71 it still finds spyware.banker in the .SFX file. No fix. Link to post Share on other sites More sharing options...
dehumanizer Posted July 18, 2009 ID:100094 Share Posted July 18, 2009 Not trying to spam the forum or anything but to keep up to date:I see 2458 just came out as well. The file is still coming up with spyware.banker as well with this version. So is this a real infection or what? Link to post Share on other sites More sharing options...
HH89 Posted July 18, 2009 ID:100100 Share Posted July 18, 2009 Database version: 2457If the scan is not done with this version or higher the scan is not valid .I need someone with up to date definitions to confirm that this is fixed .Not fixed.I scanned with Database version: 2458And default.SFX is still coming up as being infected.I am using Winrar 3.71 for both computers. Link to post Share on other sites More sharing options...
HH89 Posted July 18, 2009 ID:100103 Share Posted July 18, 2009 I just had this scare the hell out of me. I'm assuming it's a false positive as well but I still want pure 100% confirmation by you admins.I have noticed that the only winrar it flags is version 3.71. I scanned it on multiple PC's and 3.71 was flagged to have spyware.banker each time. Newest build of winrar shows nothing.I'm still about to change every damn password and login info I have for my accounts but thought knowing 3.71 was throwing it might help fix the issue.This could very well be why Exile didn't pick up anything malicious on his scan, perhaps he's using the newest build of winrar?FWIW, i did some googling and found that spyware.banker is actually a trojan which monitors what you're doing and trys to steal account information and passwords, especially those pertaining to online banking. With that being said, before this file can actually be confirmed as 100% safe, I urge everyone to take extra precaution and to not log into any personal accounts that hold anything valuable. You can never be too safe these days =(. Link to post Share on other sites More sharing options...
HH89 Posted July 18, 2009 ID:100119 Share Posted July 18, 2009 Here is an updated Developers Log for Database version: 2458. Just in case you guys might need to take a look at it.Malwarebytes' Anti-Malware 1.39Database version: 2458Windows 5.1.2600 Service Pack 27/18/2009 10:18:20 AMDeveloperLog_DB2458_2009-07-18 (10-17-52).txtScan type: Full Scan (A:\|C:\|D:\|E:\|)Objects scanned: 107731Time elapsed: 12 minute(s), 31 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:c:\program files\WinRAR\Default.SFX (Spyware.Banker) -> No action taken. [525351424740523025182317171301212222172136211821202122212321262136212221212136212417172219212221382118213721222121213621241717192224201917192224201917192224201717212421222221221721182220222022242139221921212018171721182220] Link to post Share on other sites More sharing options...
nosirrah Posted July 18, 2009 ID:100125 Share Posted July 18, 2009 There may be a bug in whitelisting that you guys just helped me find .Either way this will be corrected in 2459 . Link to post Share on other sites More sharing options...
HH89 Posted July 18, 2009 ID:100127 Share Posted July 18, 2009 There may be a bug in whitelisting that you guys just helped me find .Either way this will be corrected in 2459 .Just glad we could help =).And, thank you for being so attentive. It is much appreciated.Kind regards,- HH89 Link to post Share on other sites More sharing options...
Bellzemos Posted July 18, 2009 Author ID:100150 Share Posted July 18, 2009 So, is this a false positive or not? Should I restore the file back in it's place? Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now