is goopdateres_hr.dll safe

[AnxiousGuy]

Apologies if this is the incorrect place to forward this concern but recently I did a full scan and this was the only file picked up so I had a few questions. For some background: I know I don't peruse very many corners of the internet, in addition I scan fairly frequently, so when I even saw one thing get detected I was already raising an eyebrow. The weird thing was that I didn't immediately quarantine but instead decided to go to the source of the file in my computer and scan it manually, to which it then said it was clean. So then I figured, "Alright, guess that was a either a false positive or a mistake." so I decided to try one more full scan, but again when I tried custom full scan insisted it was malware. This time I decided I'd quarantine the item until after I'd come here and gotten a second opinion.

Main concerns I just wanted answered if possible are
1. Was the first scan probably a false positive?
2. Is it safe to restore the file?
3. Is my computer/information safe?

Thanks for your time & apologies again if this is the wrong area to post this.

[bcuzinverted]

We just saw about 15 machines get flagged for this same file. Thinking its possibly a false positive from a recent database update?

[Atribune]

Hi,

I've moved this to the False Positive section of the forum.

Could you please attach the file or the malwarebytes scan log?

Thank you.

Edited December 13, 2018 by Atribune

[AnxiousGuy]

https://www.processlibrary.com/en/directory/files/goopdateres_hr/597/

Should be this file right here. I'm unable to actually provide the actual file or scan log but I hope this is sufficient. If this isn't enough though, I don't think I'll be much help beyond this point, sorry.

[bcuzinverted]

<?xml version="1.0" encoding="UTF-16" ?>
<!DOCTYPE mbam-log SYSTEM "mbam-log.dtd">
<mbam-log>
<header>
<version>1.80.2.1012</version>
<database>v2018.12.13.07</database>
<windows>Windows 7 Service Pack 1</windows>
<arch>x64</arch>
<filesys>NTFS</filesys>
<msie>Internet Explorer 11.0.9600.19180</msie>
<username>SYSTEM</username>
<cpuname>XXXXXXX</cpuname>
<date>Thu, 13 Dec 2018 17:00:05 GMT</date>
<log>mbam-log-2018-12-13 (12-00-05).xml</log>
<summary>
<type>quick</type>
<objects>279327</objects>
<time>201</time>
<processes>0</processes>
<modules>0</modules>
<keys>0</keys>
<values>0</values>
<datas>0</datas>
<folders>0</folders>
<files>2</files>
</summary>
</header>
<items>
<file><path>C:\Users\XXXXX\AppData\Local\Temp\{110EEDC3-7506-49FA-BF85-4D2290D26C94}\goopdateres_hr.dll</path><vendor>Trojan.MalPack</vendor><action>success</action></file>
<file><path>C:\Users\XXXXX\AppData\Local\Temp\{7BFE31DB-E297-4A4F-8CC2-AD2E5B86477F}\goopdateres_hr.dll</path><vendor>Trojan.MalPack</vendor><action>success</action></file>
</items>
</mbam-log>

[Atribune]

Hey Guys, this indeed is a false positive, it will be fixed shortly. I will reply here again once the fix is live.