Probably a couple of FP's

[JohnLogan]

All F/P's in the .RAR archive.

Contents :

super_pi_mod.exe (MD5 = CA977A1CD46B170DDEA7ADC4E19BD6BA)

meta4.exe (MD5 = FCE9E5F5C7CE6D7B1EC49B5CE07070C9)

RockXP4.exe (MD5 = 8C3C4EAD89BBCD4A441C627963A514D1)

Link (Size = 931kB) : Rapidshare

[MAM]

...please follow this instructions, http://www.malwarebytes.org/forums/index.php?showtopic=3228.

[MAM]

Nothing to found this the newst update, from Malwarebytes Anti-Malware, i think that Fil is clean now.

02.09.2009 19:49:09

mbam-log-2009-09-02 (19-49-09).txt

Scan-Methode: Quick-Scan

Durchsuchte Objekte: 1

Laufzeit: 4 second(s)

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschl

[JohnLogan]

Here's the log.

mbam_log_2009_09_02__20_24_43_.txt

[MAM]

Please update your Malwarebytes' Anti-Malware again, and make a scan over the complete System, under this instruction http://www.malwarebytes.org/forums/index.php?showtopic=3228 and post your Log here again.

MAM

[MAM]

That is verry strange by me, Malwarebytes' Anti-Malware found nothing by me i scannd with your Files too, the Report:

Malwarebytes' Anti-Malware 1.40

Datenbank Version: 2731

Windows 5.1.2600 Service Pack 3

02.09.2009 21:36:32

mbam-log-2009-09-02 (21-36-32).txt

Scan-Methode: Vollst

[MAM]

That was a scan in the developer mod

MAM

[MAM]

...nothing to found, nothing to hide

MAM

[nosirrah]

One was a FP for sure and was fixed , one is malware for sure and will not be fixed . The third one is an odd case as it seems not to be malware yet the author has chosen to pack his code with a packer only used on malware .

I will deal with this last one tonight .

[MAM]

Well, that can I not understang, he post a Log this Malware, iam download the same File and run a scan with the newest update from Malwarebytes' Ant-Malware in the developer Mod, and nothing to found. That can i not understanding !?

MAM

[JohnLogan]

Using the latest Database 2732.

mbam_log_2009_09_02__22_05_01_.txt

[MAM]

IMHO, that is Malware, put this crap in your signutures

MAM

[JohnLogan]

Using the latest Database 2732.

Oops, the database was 2731, It was updated right after I finished this scan.

[MAM]

@ JohnLogan

Wich version you used the "payversion" of Malwarebytes' Anti-Antimalware, or the Free version of it ?

MAM

[MAM]

Oops, the database was 2731, It was updated right after I finished this scan.

Make a update again, and srtart now here, ----> http://www.malwarebytes.org/forums/index.php?showtopic=3228

And post your Log here too.

MAM

[MAM]

@ JohnLogan

Have you reading, my posting #6 in this Tread ?

MAM

[MAM]

Malwarebytes' Anti-Malware 1.40

Database version: 2731

Windows 5.1.2600 Service Pack 3

2/09/2009 22:05:05

mbam-log-2009-09-02 (22-05-01).txt

Scan type: Full Scan (C:\|Q:\|)

Objects scanned: 209302

Time elapsed: 24 minute(s), 37 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\System Volume Information\_restore{FDFF0764-DF4B-4F99-9D23-B781E35BA17F}\RP1147\A0430176.exe (Malware.Packer.Krunchy) -> No action taken. [5253514247405230171301213722342323231824192319241923182422242023202325221721221

71717172136]

C:\Program Files\Super Pi\super_pi_mod.exe (Malware.Packer.Krunchy) -> No action taken. [5253514247405230171301213722342323231824192319241923182422242023202325221721221

71717172136]

Q:\K-drive(backup)\RockXP4.exe (Spyware.Passwords) -> No action taken. [41345241302568206821706669252667676869216621211868231924262320662218216918]

Sorry i have not this Log, ican

[MAM]

I can

[extremeboy]

@MAM

http://www.malwarebytes.org/forums/index.p...mp;#entry119324

If there's something you forget to add in your previous reply, you can always post again to add in what you need to say.

With Regards,

Extremeboy

[MAM]

My Head is so blind, ican

[JohnLogan]

Scanned using v2732

@MAM, I really don't understand what you're trying to say, sorry.

mbam_log_2009_09_02__23_56_38_.txt

[JohnLogan]

Damn, no EDIT button sucks.

You could as well make the board add something like Last edited by xxx on xxxxxx ..h..m..sec (Edited x times in total

Just would like to ask, I forget where I got RockXP4.exe but AFAIK it's only for showing you your XP serial installed, and according to ThreatExpert, it doesn't do anything malicious, So I really don't know your logic behind what exactly is Spyware.

[JohnLogan]

No edit, thus another post.

Here's what ThreatExpert has to say about the packed

C:\Program Files\Super Pi\super_pi_mod.exe (Malware.Packer.Krunchy) -> No action taken. [5253514247405230171301213722342323231824192319241923182422242023202325221721221

71717172136]

Link : ThreatExpert Report