CPD Posted July 25, 2009 ID:102401 Share Posted July 25, 2009 On an Acer laptop I have a detection similar to one for ActiveToolBand.dll in September 2008 that was subsequently corrected in MB. <http://www.malwarebytes.org/forums/index.php?showtopic=6284&hl=activetoolband.dll> In both cases the HiTrust file versions and created/modified dates are identical. If this too is a FP are all affected registry key/value infection flags invalid as well? Please advise. Thanks,CPDLog file:Malwarebytes' Anti-Malware 1.39Database version: 2498Windows 5.1.2600 Service Pack 27/25/2009 9:20:27 AMmbam-log-2009-07-25 (09-19-19).txtScan type: Quick ScanObjects scanned: 87122Time elapsed: 4 minute(s), 53 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 4Registry Values Infected: 4Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_CLASSES_ROOT\Interface\{95b92d92-8b7d-4a19-a3f1-43113b4dbcaf} (Adware.DoubleD) -> No action taken. [40544237309222192624702617221418697167142166266814262524181466217126227169222526212294]HKEY_CLASSES_ROOT\Typelib\{5297e905-1dfb-4a9c-9871-a4f95fd58945} (Adware.DoubleD) -> No action taken. [40544237309222192624702617221418697167142166266814262524181466217126227169222526212294]HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [40544237309222192624702617221418697167142166266814262524181466217126227169222526212294]HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [40544237309222192624702617221418697167142166266814262524181466217126227169222526212294]Registry Values Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\ToolBand.dll (Adware.DoubleD) -> No action taken. [40544237309222192624702617221418697167142166266814262524181466217126227169222526212294]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [40544237309222192624702617221418697167142166266814262524181466217126227169222526212294]HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [40544237309222192624702617221418697167142166266814262524181466217126227169222526212294]HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [40544237309222192624702617221418697167142166266814262524181466217126227169222526212294]Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\WINDOWS\system32\ToolBand.dll (Adware.DoubleD) -> No action taken. [40544237309222192624702617221418697167142166266814262524181466217126227169222526212294] Link to post Share on other sites More sharing options...
nosirrah Posted July 25, 2009 ID:102409 Share Posted July 25, 2009 Please zip and attach a copy of that file to your next post so I can look at it .C:\WINDOWS\system32\ToolBand.dll Link to post Share on other sites More sharing options...
nosirrah Posted July 25, 2009 ID:102412 Share Posted July 25, 2009 Actually never mind , I think I see the problem . Link to post Share on other sites More sharing options...
CPD Posted July 25, 2009 Author ID:102414 Share Posted July 25, 2009 Actually never mind , I think I see the problem .Thanks, Bruce. Let me know what you determine. It tested clean on VirusTotal a few minutes ago:http://www.virustotal.com/analisis/bfef817...3360-1248535461CPD Link to post Share on other sites More sharing options...
nosirrah Posted July 25, 2009 ID:102423 Share Posted July 25, 2009 Update and check again please . Link to post Share on other sites More sharing options...
CPD Posted July 25, 2009 Author ID:102440 Share Posted July 25, 2009 Update and check again please .All clear on database version: 2500. Thanks for the prompt assistance.CPD Link to post Share on other sites More sharing options...
CPD Posted December 6, 2009 Author ID:167246 Share Posted December 6, 2009 With program version 1.42 update today I have a repeat detection on an Acer laptop similar to one for ActiveToolBand.dll in September 2008 that was subsequently corrected in MB. <http://www.malwarebytes.org/forums/index.php?showtopic=6284&hl=activetoolband.dll> and an identical detection noted in this post last July. In all cases the HiTrust file versions and created/modified dates are identical. It tested clean again on VirusTotal <http://www.virustotal.com/analisis/bfef8170f7432db06da8e31de7e17fb6ba3b131f99b8177dddcef93550a33360-1260123003>. If it is a FP are all affected registry key/value infection flags invalid as well? Please advise. Thanks,CPDMalwarebytes' Anti-Malware 1.42Database version: 3289Windows 5.1.2600 Service Pack 2Internet Explorer 7.0.5730.1112/6/2009 11:56:58 AMmbam-log-2009-12-06 (11-56-43).txtScan type: Quick ScanObjects scanned: 103403Time elapsed: 6 minute(s), 4 second(s)€Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 4Registry Values Infected: 4Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_CLASSES_ROOT\Interface\{95b92d92-8b7d-4a19-a3f1-43113b4dbcaf} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]HKEY_CLASSES_ROOT\Typelib\{5297e905-1dfb-4a9c-9871-a4f95fd58945} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]Registry Values Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\ToolBand.dll (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\WINDOWS\system32\ToolBand.dll (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B] Link to post Share on other sites More sharing options...
Staff TeMerc Posted December 6, 2009 Staff ID:167256 Share Posted December 6, 2009 Please update the database, you're way behind, then rescan. Link to post Share on other sites More sharing options...
CPD Posted December 6, 2009 Author ID:167266 Share Posted December 6, 2009 Sorry. The program update didn't include or prompt for a new database, but same detection results on 3340:Malwarebytes' Anti-Malware 1.42Database version: 3304Windows 5.1.2600 Service Pack 2Internet Explorer 7.0.5730.1112/6/2009 12:53:18 PMmbam-log-2009-12-06 (12-53-08).txtScan type: Quick ScanObjects scanned: 103831Time elapsed: 5 minute(s), 54 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 4Registry Values Infected: 4Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_CLASSES_ROOT\Interface\{95b92d92-8b7d-4a19-a3f1-43113b4dbcaf} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]HKEY_CLASSES_ROOT\Typelib\{5297e905-1dfb-4a9c-9871-a4f95fd58945} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]Registry Values Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\ToolBand.dll (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0e1230f8-ea50-42a9-983c-d22abc2eed3b} (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B]Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\WINDOWS\system32\ToolBand.dll (Adware.DoubleD) -> No action taken. [3582A04968901768A6EC9E4926D2F59B] Link to post Share on other sites More sharing options...
CPD Posted December 6, 2009 Author ID:167270 Share Posted December 6, 2009 Correction: database #3304 Link to post Share on other sites More sharing options...
nosirrah Posted December 6, 2009 ID:167282 Share Posted December 6, 2009 Fixed in the next update Link to post Share on other sites More sharing options...
CPD Posted December 7, 2009 Author ID:167430 Share Posted December 7, 2009 Cleared on database version: 3307. Thanks again. Link to post Share on other sites More sharing options...
CPD Posted June 27, 2010 Author ID:275545 Share Posted June 27, 2010 With program version 1.42 update today I have a repeat detection on an Acer laptop similar to one for ActiveToolBand.dll in September 2008 that was subsequently corrected in MB. <http://www.malwarebytes.org/forums/index.php?showtopic=6284&hl=activetoolband.dll> and an identical detection noted in this post last July. In all cases the HiTrust file versions and created/modified dates are identical. It tested clean again on VirusTotal <http://www.virustotal.com/analisis/bfef8170f7432db06da8e31de7e17fb6ba3b131f99b8177dddcef93550a33360-1260123003>. If it is a FP are all affected registry key/value infection flags invalid as well? Please advise. Thanks,CPDMalwarebytes' Anti-Malware 1.42Database version: 3289Windows 5.1.2600 Service Pack 2Internet Explorer 7.0.5730.1112/6/2009 11:56:58 AMmbam-log-2009-12-06 (11-56-43).txtScan type: Quick ScanObjects scanned: 103403Time elapsed: 6 minute(s), 4 second(s) Link to post Share on other sites More sharing options...
nosirrah Posted June 27, 2010 ID:275603 Share Posted June 27, 2010 {5297e905-1dfb-4a9c-9871-a4f95fd58945} <- this is the cause here and taking a quick look on google I am not getting the impression that it is either common or legit.Please zip and attach ToolBand.dll to your next post so I can take a look at it. Link to post Share on other sites More sharing options...
CPD Posted June 27, 2010 Author ID:275629 Share Posted June 27, 2010 {5297e905-1dfb-4a9c-9871-a4f95fd58945} <- this is the cause here and taking a quick look on google I am not getting the impression that it is either common or legit.Please zip and attach ToolBand.dll to your next post so I can take a look at it.Bruce,File attached and VirusTotal scan results test clean here. The file modified date 10/19/2005 (same as in screen capture of 9/2009 above) predates original purchase of the laptop in 1/2006. Nothing has changed since then.Let me know,CPDToolBand.zip. Link to post Share on other sites More sharing options...
nosirrah Posted June 28, 2010 ID:275631 Share Posted June 28, 2010 I just wanted to double check, thanks for the file. I am trying to figure out what exactly the issues are here and I think I finally have all of them. I am fixing this and making a special note on the conflict here (legit and malware have some identical components). Link to post Share on other sites More sharing options...
CPD Posted June 28, 2010 Author ID:276070 Share Posted June 28, 2010 Cleared on database version: 4251. Thanks again. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now