False Positive RiskWare.IFEOHijack in sdfiles.exe of Spybot Search & Destro

[DanE4367]

Since last program update of Malwarebytes, keep having Malwarebytes flag the file sdfiles.exe of Spybot Search & Destroy as malware.  Specifically, riskware.ifeohijack in Registry values and registry keys for sdfiles.exe and debugger.

 

RiskWare.IFEOHijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SDFILES.EXE, No Action By User, [6772], [249769],1.0.4588
RiskWare.IFEOHijack, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SDFILES.EXE, No Action By User, [6772], [249769],1.0.4588

Registry Value: 2
RiskWare.IFEOHijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SDFILES.EXE|DEBUGGER, No Action By User, [6772], [249769],1.0.4588
RiskWare.IFEOHijack, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SDFILES.EXE|DEBUGGER, No Action By User, [6772], [249769],1.0.4588

 

False Positive?  Don't like Spybot all of a sudden?  True infection?  Every time I quarantine or quarantine and remove, it comes back at a later date.  Any help would be appreciated!

 

[shadowwar]

Would it be possible for you to export this registry key?

HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SDFILES.EXE

 

This definitions has been in for at least 2 years so weird it would be false positving now.

 

Edited April 2, 2018 by shadowwar

[shadowwar]

I installed Spybot here and i dont see that key being created at all. Would really need an export of that registry key to go further. If you need instructions just let me know.

[DanE4367]

Shadowwar,

Thank you,  I could use instructions on how to export the registry key.  I believe it was quarantined by Malwarebytes.

[shadowwar]

Ok first you would have to restore the key from the quarantine tab in Malwarebytes. After restored you can use this link at kaspersky.

 

https://support.kaspersky.com/us/common/diagnostics/8576#block1

 

They attach the file here. You may have to zip it first.

[DanE4367]

Attached Registry Key.

SDFiles_reg_key.zip

[shadowwar]

Ok this is from avast's management of startup programs. You can safely add this detection to the exclusion list in malwarebytes. Or simply reenable spybot in avast.

 

C:\\Program Files (x86)\\AVAST Software\\Avast Cleanup\\autoreactivator.exe\