[ok now] Possible FP (not IP)

[Falkra]

Hi, I have a user on a forum who gets continuous Vundo.Variant detection. I looked and saw no Vundo remains on the machine.

Here is the dev log :

Malwarebytes' Anti-Malware 1.40

Version de la base de donn

[nosirrah]

I am unable to locate any instances where these were not deleted by forum helpers and/or attached to malware files .

It is likely that these keys were part of the "immunization" that another vendor was doing for a while .

To delete these please reset their permissions first and then run another scan , this will correct the issue .

[Falkra]

Ok, I'll do that (with RegAssassin). I'll tell the user (he thought he had Vundo but couldn't find it).

Thanks for your attention.

[nosirrah]

Ok, I'll do that (with RegAssassin). I'll tell the user (he thought he had Vundo but couldn't find it).

Thanks for your attention.

I don't think reg assassin will work here , there are DACL and ACL issues with the "immunization" . I was using subinacl to fix these before , we had quite a ot of them .

[Falkra]

I should have posted before : it worked perfectly with subinacl.