Trueborn Posted September 17, 2009 ID:128446 Share Posted September 17, 2009 Hi. A scan this morning picked an item - spyware.banker. I saw a topic in the general Malwarebytes forum indicating the same item came up for someone else as a false positive. So I'm wondering... should I delete this or ignore it? It's never popped up on previous scans.Here's the results of my scan. When I did the scan for the log posting, I quit as soon as it found this infection.Note: my other virus/spyware software isn't picking this upwarebytes' Anti-Malware 1.41Database version: 2815Windows 5.1.2600 Service Pack 29/17/2009 9:37:44 AMmbam-log-2009-09-17 (09-37-36).txtScan type: Quick ScanObjects scanned: 28713Time elapsed: 4 minute(s), 23 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\Documents and Settings\Owner.YOUR-752979A960\Local Settings\Temp\SPR5C.EXE (Spyware.Banker) -> No action taken. [5253514247405230528190886683701535667976708313011713012137223422171717171917171717171717211717173917173939393917171717352517171717171717171717171717172117171718341717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171817171717353418171717173818393521172636371918352517182136363719182617261722212325232624201917241724192339232424192318233719172337242224202421191723192322191724192422233819172422233823212322241919172224232623382020201917371734192120241717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717221721221717171721361718172517171826223821191934171717171717171717171717171717173817171725382518173517181719182617173232171817171717323217171717171717171717171732323232171817171717181717171717171732321718171717171717323232321717181717171717171717191717171732321717171717171717171717171717172117171717171717171717171717171717323232321717171717211717171717171717171717171719171717171717171717173232171717172117171717171717171718171717171718171717171717171717171717171817171717171717171717171717171717171717171717171717323217181717323232321717171717173232323217171717323217171717171717171717171717171717171717171717171717171717171717171717171717173232323217173232323217171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171732323232171718251717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717172120213921212122171717171717171732323232171817171717181717171717171732321718171717171721171717171717171717171717171717171717171717171717171717171917171717172317212121182221211817171717171717173232323217171717171732321718171717173232171717171717323217181717171717171717171717171717171717171717171717171717211717171717361721192220222017171717171717171717323232321717171717173232171817171717171717171717171732321718171717171717171717171717171717171717171717171717171717171717171736171938232623212318242123181717171732323232171717171717323217181717171732321717171717173232171817171717171717171717171717171717171717171717171717172117171717173617193824212336242017171717171717171736171717171717171732321718171717171717171717171717323217181717171717171717171717171717171717171717171717171717171717171717361719382419232123182421231817171717182517171717171717173232323217171717171917171717171732321718171717171717171717171717171717171717171717171717171721171717171722171938241923222336233923201717171732323232171717171717323232321717171732321717171717173232171817171717171717171717171717171717171717171717171717172117171717172217193824192420241923201717171717171717323217171717171732323232171717173232171717171717323217181717171717171717171717171717171717171717171717171717211717171717221717171717171717171717171717171717171717171717171717173232323217171717171717171717171732323232171717171717171717171717171717171717171717171717171721171717171722171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717172118173232323217341723222024212419232623382324222513014755] Link to post Share on other sites More sharing options...
nosirrah Posted September 17, 2009 ID:128449 Share Posted September 17, 2009 Its in your temp folder so its not critical either way . Its hard to say what this actually is as the file name has no hits on google .If you can , zip and attach a copy of this file to your next post . Link to post Share on other sites More sharing options...
Trueborn Posted September 17, 2009 Author ID:128496 Share Posted September 17, 2009 Didn't realize until after I posted the log that it was in temp files.I'm inclined to think it's a FP. None of my other malware apps flagged it (including the one I use for real-time protection), and I dumped cookies/temp files/etc. on all of my browsers, thinking that would possibly delete it. Not an expert, so I could be wrong about that. Still showed up in the same location, so I quarantined/deleted it. Reran a full MBAM scan afterward, as well as a Trend Mcro scan. Everything seems clean now.Didn't want to wait and fool around with this. It could be coincidence, but one of our banks called yesterday to inform us they were deactivating our credit card with them after a suspicious internet charge that we didn't make (they'll issue a replacement card with a new number, of course). Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now