Possible false positive - Nanocore CCME_ASYM.DLL and CCME_BASE.DLL

[DavidJames]

Hi,

I found this on two PCs, is it a false positive ?

Thank you for your help !

 

David

nanocore.txt

[DavidJames]

additional information, see attached (ccme_asym.dll and ccme_base.dll)

False positive.7z

[cli]

I was not able to reproduce your detection and see that you're not on the latest update. Can you update and scan again? Thanks.

[DavidJames]

The update was done but I can redo the scan.

I restored the files before running the new scan.

 

I need to understand this result to know if I should format my PCs and change all my passwords >_< (NanoCore is a Remote Access Trojan)

[DavidJames]

Problem still present with my second PC.

Update ok.

second scan.txt

[Porthos]

Quote

NanoCore.Backdoor, C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA76301B744CAF070E41400\15.7.20033\CCME_ASYM.DLL, Aucune action de l'utilisateur, 1000002, 0, 1.0.32498, 5FAFCF7D7EC1BB24C69AA8B4, dds, 00971610, 219D56D4B66DAED4169318C45E7792B3, E5CE2FE10F69F82B108B657F3D75D308FBE118FA58E149DE9C142BA954C3E8C0

Aucune action de l'utilisateur, Means you took no action. You need to quarantine them. Vous devez les mettre en quarantaine.

[Porthos]

46 minutes ago, DavidJames said:

I need to understand this result to know if I should format my PCs and change all my passwords >_< (NanoCore is a Remote Access Trojan)

if you want to be certain that the system is clean, we do offer free assistance by trained and vetted malware removal specialists.  If you wish they can analyze your system for you and guide you in removing any threats that might be present as well as help to troubleshoot the issues you're experiencing.  To work with them, simply read and follow the instructions in this topic, skipping any steps you are unable to complete, then creating a new topic in our malware removal area by clicking here and one of our malware removal specialists will assist you as soon as one is available.

[cli]

Thanks for rescanning, those files are not malware and shouldn't be detected. Please collect additional logs by following the directions in Upload Malwarebytes Support Tool logs offline and attach them here.

[Eps]

Hi.
Malwarebytes found on my Lenovo at 06.11.2020 and 07.11.2020 those threats in atachament.

Is this overreacted by Malwarebytes or this is serious?

[DavidJames]

I don’t know. 
In doubt i formatted my PCs and changed all my passwords.

[JREEOTW]

Hey guys. 

 

I had the same thing after not even using my device since the last full scan. 

Time line as follows:

Full scan using malwarebytes and other scanners, no detections. 

Had to leave without using device after full scans so turned off PC. Event viewer confirmed device not accessed until I returned a few days later. 

Downloaded definition updates, disconnected PC and rescanned everything in full (i do a full scan every 3 or 4 days regardless of usage) 

Now I had these detections like you, though PC remained unused since last full clear scan. No detections on any other AV. 

 

CLI seemed to confirm false positive above. 

 

So far no issues with my PC usage, though would be nice to hear more from Malwarebytes team. 

[cli]

@JREEOTWYes, this was a false positive and should have been fixed by now. Can you attach the logs generated by the instructions in Upload Malwarebytes Support Tool logs offline? Thanks.

[Eps]

Hi Cli.

As you can see above, I put my screenshots of the positive threat full scan which I did couple of times durig the weekend 😕
I put in the attachament my file after I used Upload Malwarebytes Support Tool Logs.

I hope you can say more about our Issue is it real serious or not?

Best regards,
Eps

mbst-grab-results.zip

[cli]

@Eps This was a false positive, so the file is not a threat. If you unquarantine/restore the file and scan it again, there should no longer be a detection.

Edited November 9, 2020 by cli

[Eps]

@cli
Thank you for a very quick answer that it was a false threat of trojan.

In the weekend I made a couple of scans and later on it found that there was another two files in quarantine from the Brother printer. 
I put the printscreen of the all files which I have in my quaranteen to check and to be sure it wasn't a malware threat. 

Could you check it once again and let me know?  

[cli]

@Eps I see that it has been whitelisted already. 

Edited November 9, 2020 by cli

[Eps]

55 minutes ago, cli said:

@Eps I see that it has been whitelisted already. 

@cliOk, so it’s safe to restore all of those files from quarantine?

[cli]

@Eps Yes.

[Eps]

12 minutes ago, cli said:

@Eps Yes.

@cli

Thank you for fast reply and for your assistance.
 

Best regards,

Eps

[JREEOTW]

I can confirm it is no longer being detected for me. 

 

Thank you!