highstream Posted July 20, 2020 ID:1395722 Share Posted July 20, 2020 MBAM Premium 4.1.2.73, 1.0.27103, 1.0.979 Scan this morning identified Matroska Splitter executable as a Spyware Password Stealer. This codec is part of Zoom Player's install and has been on my computer since March 2017. So why today? Test file attached. Spyware.PasswordStealer, C:\PROGRAMDATA\ZOOM PLAYER\CACHE\MATROSKASPLITTER.1.13.138.14.EXE, No Action By User, 555, 841891, 1.0.27103, , ame, MastrokaSplitter as spyware.txt Link to post Share on other sites More sharing options...
highstream Posted July 20, 2020 Author ID:1395726 Share Posted July 20, 2020 updated to 1.0.27105 if that makes a difference Link to post Share on other sites More sharing options...
highstream Posted July 20, 2020 Author ID:1395734 Share Posted July 20, 2020 it didn't Link to post Share on other sites More sharing options...
Staff shadowwar Posted July 20, 2020 Staff ID:1395754 Share Posted July 20, 2020 Could you please zip and attach the file detected here please? Link to post Share on other sites More sharing options...
highstream Posted July 20, 2020 Author ID:1395774 Share Posted July 20, 2020 Done MastrokaSplitter as spyware.zip Link to post Share on other sites More sharing options...
Staff shadowwar Posted July 20, 2020 Staff ID:1395779 Share Posted July 20, 2020 (edited) That is the scan log. I need the actual file executable zipped and attached here. Edited July 20, 2020 by shadowwar Link to post Share on other sites More sharing options...
highstream Posted July 20, 2020 Author ID:1395793 Share Posted July 20, 2020 Attached. Btw, The email link sent out for your reply goes to a "Sorry, there is a problem. We could not locate the item you are trying to view. Error code: 2S136/C." I've seen this at another forum that I think was based on the same software (Invision?). I typically either have to do a search or get it from the Message button. MatroskaSplitter.1.13.138.14.exe.zip Link to post Share on other sites More sharing options...
Staff shadowwar Posted July 20, 2020 Staff ID:1395796 Share Posted July 20, 2020 Hmm maybe cause i edited the post. This should no longer be detected. Link to post Share on other sites More sharing options...
highstream Posted July 20, 2020 Author ID:1395800 Share Posted July 20, 2020 If you mean the "Sorry,...", no, that's the nature of the software from what I can tell. With this and at least one other forum, it happens whether or not I'm the OP or just subscribed. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now