dugrn Posted October 8, 2018 ID:1274171 Share Posted October 8, 2018 I purchased MWBp on 10/4 because i did and offline defender scan that said "potential harmful threats found" or something like that. Within windows defender no threats were logged. My first scan with MWBp detected the following (report) Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 10/4/18 Scan Time: 1:16 PM Log File: 9d9d9a94-c801-11e8-ab55-a08cfd2bda7c.json -Software Information- Version: 3.6.1.2711 Components Version: 1.0.463 Update Package Version: 1.0.7185 License: Trial -System Information- OS: Windows 10 (Build 17134.285) CPU: x64 File System: NTFS User: LAPTOP-Q0H0G4LM\Doug -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 349452 Threats Detected: 4 Threats Quarantined: 4 Time Elapsed: 10 min, 7 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 4 Trojan.Kovter, C:\USERS\A***\APPDATA\ROAMING\Microsoft\Windows\Recent\firefox-update.lnk, Quarantined, [6261], [447252],1.0.7185 Trojan.Kovter, C:\USERS\D***\DOWNLOADS\FIREFOX-UPDATE.JS, Quarantined, [6261], [447252],1.0.7185 Trojan.Kovter, C:\USERS\A***\APPDATA\ROAMING\Microsoft\Windows\Recent\firefox-patch.lnk, Quarantined, [6261], [444098],1.0.7185 Trojan.Kovter, C:\USERS\D***\DOWNLOADS\FIREFOX-PATCH.JS, Quarantined, [6261], [444098],1.0.7185 Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) These were quarantined and deleted. All scans clear since. I've been using MWB Anti-rootkit BETA as well and its been clean. I created a custom scan to include rootkits on 10/7. As the log below will show it took 8hrs to complete and when i woke up this morning it showed 2- Trojan.passwordstealer detected. I ofcourse for got to check "quarantine" when i setup this scan. Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 10/7/18 Scan Time: 8:48 PM Log File: 3e33327e-ca9c-11e8-bad0-a08cfd2bda7c.json -Software Information- Version: 3.6.1.2711 Components Version: 1.0.463 Update Package Version: 1.0.7237 License: Premium -System Information- OS: Windows 10 (Build 17134.285) CPU: x64 File System: NTFS User: System -Scan Summary- Scan Type: Custom Scan Scan Initiated By: Scheduler Result: Completed Objects Scanned: 494379 Threats Detected: 2 Threats Quarantined: 0 Time Elapsed: 8 hr, 26 min, 2 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 2 Trojan.PasswordStealer, C:\WINDOWS\SYSTEM32\TCPSVCS.EXE, No Action By User, [3569], [578625],1.0.7237 Trojan.PasswordStealer, C:\WINDOWS\SYSWOW64\TCPSVCS.EXE, No Action By User, [3569], [578625],1.0.7237 Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) My followup scan was clean. My question is... were these "passwordstealer" removed? Is it safe for me to use this computer for logging in to sensitive accounts that I have for work? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 8, 2018 Root Admin ID:1274190 Share Posted October 8, 2018 Hello @dugrn and I'm sorry, this was a false positive. The files in question are not infected. Please restore them from Quarantine. If you run into any issues please let us know Thank you Ron Link to post Share on other sites More sharing options...
dugrn Posted October 8, 2018 Author ID:1274216 Share Posted October 8, 2018 Just so i understand... The false positive is the 2 Trojan.passwordstealer threats MWB found? They never went to quarantine. The 4 trojan.kotver did go to quarantine and i deleted them already Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 8, 2018 Root Admin ID:1274220 Share Posted October 8, 2018 Oh, okay. Then you should be okay @dugrn Link to post Share on other sites More sharing options...
dugrn Posted October 8, 2018 Author ID:1274225 Share Posted October 8, 2018 Sorry to keep bothering you.. I just saw the other thread where the trojan.passwordstealer was a false positive. Since mine didn't go to quarantine do i have anything to worry about? I saw in that thread that someone deleted the quarantined and then had to go back and run some sort of CMD to fix. Does this apply to me? Or am i good to go? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 8, 2018 Root Admin ID:1274268 Share Posted October 8, 2018 You are ok @dugrn Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 7, 2018 Root Admin ID:1279757 Share Posted November 7, 2018 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts