Possible false positive in Malwarebytes tmp folder?

[Porridge340]

Apologies if this is in the wrong place - Malwarebytes is picking up Spyware.PasswordStealer from the following files in the MalwareBytes folder:   "C:\\PROGRAMDATA\\MALWAREBYTES\\MBAMSERVICE\\TMP\\VSIXAUTOUPDATE.EXE-K.MBAM"  and also  "C:\\ProgramData\\Malwarebytes\\MBAMService\\tmp\\VSIXAUTOUPDATE.EXE-U.MBAM". Also ran a scan with AdwCleaner and it came up clean.

I noticed that these files only seem to show up when Malwarebytes is actively scanning the file system - could these be false positives? Any idea what's going on here? Please let me know if you need more information.

[Porridge340]

After scanning again it seems like these files aren't being flagged as spyware anymore. Should I be worried?

[miekiemoes]

Hi, you shouldn't be worried as this might have been an FP which we have fixed already.

[DMorris]

I had a similar experience and resultant concern.  The same "password stealer" was flagged at the same disk location (C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\TMP\VSIXAUTOUPDATE.EXE-U.MBAM).  This was with an manual scan; it had not been picked up automatically.  Then on quarantining the file, a reboot was required.  After the reboot, a manual scan did not note the "password stealer."  But on the next manual scan, the "password stealer" was back.  I have done this a few times with no variation.  Obviously, with a quarantine that causes a reboot, and subsequently still seeing the problem, there is little that I can do to remedy this.  Do you have suggestions?

 

[Porthos]

6 minutes ago, DMorris said:

Do you have suggestions?

Can you please collect and upload as an attachment the diagnostic data using our MBST?

• Download and run the Malwarebytes Support Tool
• Accept the EULA and click Advanced tab on the left (not Start Repair)
• Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply

[DMorris]

Thanks for the quick reply!  Here is the zip file, just now created.

mbst-grab-results.zip

[Porthos]

Quote

Scan Rootkit: ON

Do have the same detection with rootkit scanning off?

[DMorris]

Aha!  With rootkit scanning off, I don't get the detection.  This is a new phenomenon as I have had MWB on many computers for years with rootkit scanning on with no such detection, which I assume to be an error.

Thanks very much for your detective work.  Do have a suggestion for going forward?