arleetel Posted April 17, 2021 ID:1451867 Share Posted April 17, 2021 This was found a moment ago. Can it also be a false positive ? Thanks. Link to post Share on other sites More sharing options...
Porthos Posted April 17, 2021 ID:1451872 Share Posted April 17, 2021 (edited) 34 minutes ago, arleetel said: Can it also be a false positive ? Since it is an "Malware AI" It will probably fix itself. Do not quarantine it. Please provide the actual log of the detection. Staff may want the actual files zipped and attached here as well. But get the log first. Edited April 17, 2021 by Porthos Link to post Share on other sites More sharing options...
arleetel Posted April 17, 2021 Author ID:1451877 Share Posted April 17, 2021 Thanks for your reply. I added the actual log and the zipped msi files. In the log files it's mentioned as quarantined but I did put them back. log file detection.txt 1530470410_msifiles.zip 1 Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 17, 2021 Staff ID:1451879 Share Posted April 17, 2021 This is strange. i am not getting any detections here with expert system algorithms on. Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 17, 2021 Staff ID:1451880 Share Posted April 17, 2021 can you rescan those files and see if they still hit. the system may have learned them already. Link to post Share on other sites More sharing options...
Porthos Posted April 17, 2021 ID:1451881 Share Posted April 17, 2021 (edited) 6 minutes ago, shadowwar said: This is strange. i am not getting any detections here with expert system algorithms on. Rich, I have the same detection's just now on the OP's files and I do not have expert system algorithms on. Even Dumped the hubble cache. Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 4/17/21 Scan Time: 12:09 PM Log File: bae15320-9f9f-11eb-b264-001a7dda7102.json -Software Information- Version: 4.3.0.98 Components Version: 1.0.1273 Update Package Version: 1.0.39499 License: Premium -System Information- OS: Windows 10 (Build 19042.928) CPU: x64 File System: NTFS User: I7-PC\SAPC -Scan Summary- Scan Type: Custom Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 3 Threats Detected: 3 Threats Quarantined: 0 Time Elapsed: 0 min, 10 sec -Scan Options- Memory: Disabled Startup: Disabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 3 Malware.Heuristic.1003, C:\MALWARE TEST\1530470410_MSIFILES\97096A.MSI, No Action By User, 1000001, 0, 1.0.39499, 0000000000000000000003EB, dds, 01206020, 908F06D6FD86C99A8CE291268A959F75, F0AB20BA8D816653D9373D3F00FD449993F22323CDCB90F9CA6616A9EC5077C0 Malware.Heuristic.1003, C:\MALWARE TEST\1530470410_MSIFILES\970957.MSI, No Action By User, 1000001, 0, 1.0.39499, 0000000000000000000003EB, dds, 01206020, 488CE49E172025026C790C1BC36EE569, 3D054A4648E2396F05E517A8B0570AF4AFDC8E973201C8A16DDB7B94D313C40C Malware.Heuristic.1003, C:\MALWARE TEST\1530470410_MSIFILES\970964.MSI, No Action By User, 1000001, 0, 1.0.39499, 0000000000000000000003EB, dds, 01206020, 6F3C82150DB7916ADABBDBB467607608, E558AC680F5CE85F185248F504821FA26B896CC76F544E7061B301FD16C4E00C Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) Edited April 17, 2021 by Porthos Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 17, 2021 Staff ID:1451883 Share Posted April 17, 2021 (edited) would you mind doing me a favor porthos? unzip the msis to folders with 7zip and scan those folders. i need to figure out which file inside the msi is causing this. I cant seem to duplicate it here. Edited April 17, 2021 by shadowwar Link to post Share on other sites More sharing options...
Porthos Posted April 17, 2021 ID:1451884 Share Posted April 17, 2021 Just now, shadowwar said: unzip the msis to folders with 7zip and scan those folders. I did unzip them,I always do. Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 17, 2021 Staff ID:1451885 Share Posted April 17, 2021 i meant the msi files themselves. its the archive scanning that is trigging on a file inside the msi. I have the msi themselves whitelisted. but it has to be a file packaged inside the msi. Link to post Share on other sites More sharing options...
Porthos Posted April 17, 2021 ID:1451886 Share Posted April 17, 2021 Just now, shadowwar said: its the archive scanning that is trigging on a file inside the msi. I have the msi themselves whitelisted. but it has to be a file packaged inside the msi. I did that one one and no detection. Link to post Share on other sites More sharing options...
Porthos Posted April 17, 2021 ID:1451887 Share Posted April 17, 2021 1 minute ago, Porthos said: I did that one one and no detection. Of course the ONE of 3 I checked had no detection's but the other 2 did. Link to post Share on other sites More sharing options...
Porthos Posted April 17, 2021 ID:1451888 Share Posted April 17, 2021 Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 4/17/21 Scan Time: 12:22 PM Log File: 8202d2c0-9fa1-11eb-9c42-001a7dda7102.json -Software Information- Version: 4.3.0.98 Components Version: 1.0.1273 Update Package Version: 1.0.39501 License: Premium -System Information- OS: Windows 10 (Build 19042.928) CPU: x64 File System: NTFS User: I7-PC\SAPC -Scan Summary- Scan Type: Custom Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 147 Threats Detected: 2 Threats Quarantined: 0 Time Elapsed: 0 min, 21 sec -Scan Options- Memory: Disabled Startup: Disabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 2 Malware.Heuristic.1003, C:\MALWARE TEST\1530470410_MSIFILES\970964\BINARY.ISSETUP.DLL, No Action By User, 1000001, 0, 1.0.39501, 0000000000000000000003EB, dds, 01206261, 189F5F9F348D3CE9CEA0458946FE6C94, F933A96702042CC9902DC70EB803E4DB6D1BB9481B50FBF9C64F7E759123DA2D Malware.Heuristic.1003, C:\MALWARE TEST\1530470410_MSIFILES\970957\BINARY.ISSETUP.DLL, No Action By User, 1000001, 0, 1.0.39501, 0000000000000000000003EB, dds, 01206261, B1755348210B7F6E037C0A2D48D68027, 3E4D149C771907E679F5EB8568C8536D4EAFB522D5999116923CCAC35F1D9D81 Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 17, 2021 Staff ID:1451889 Share Posted April 17, 2021 Link to post Share on other sites More sharing options...
Porthos Posted April 17, 2021 ID:1451890 Share Posted April 17, 2021 Redoing scan now. Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 17, 2021 Staff ID:1451891 Share Posted April 17, 2021 Thanks porthos. Thats what i needed. I have whitelisted in the cloud the two files reported. @arleetel give it a few minutes and rescan. Link to post Share on other sites More sharing options...
Porthos Posted April 17, 2021 ID:1451892 Share Posted April 17, 2021 1 minute ago, shadowwar said: Thanks porthos. Thats what i needed. Mine is clear now on those extracted folders. But one MSI is still flagged. File: 1 Malware.Heuristic.1003, C:\MALWARE TEST\1530470410_MSIFILES\97096A.MSI, No Action By User, 1000001, 0, 1.0.39501, 0000000000000000000003EB, dds, 01206261, 908F06D6FD86C99A8CE291268A959F75, F0AB20BA8D816653D9373D3F00FD449993F22323CDCB90F9CA6616A9EC5077C0 Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 17, 2021 Staff ID:1451893 Share Posted April 17, 2021 i cant seem to extract that msi for some reason. seems corrupt Link to post Share on other sites More sharing options...
Porthos Posted April 17, 2021 ID:1451894 Share Posted April 17, 2021 1 minute ago, shadowwar said: i cant seem to extract that msi for some reason. seems corrupt Seems to be an packaged install for COREL TW CORP. https://www.virustotal.com/gui/file/f0ab20ba8d816653d9373d3f00fd449993f22323cdcb90f9ca6616a9ec5077c0/details Link to post Share on other sites More sharing options...
Porthos Posted April 17, 2021 ID:1451895 Share Posted April 17, 2021 All 3 are related to Corel. Link to post Share on other sites More sharing options...
arleetel Posted April 18, 2021 Author ID:1451933 Share Posted April 18, 2021 (edited) @shadowwar: thanks, I rescanned and I still have one detection, as mentioned by Porthos : 97096A.MSI. I have Corel Paint Shop Pro X5 on the computer, since I bought it end 2019. I have the same program on another computer, installed more than 6 years ago, did a scan with malwarebytes, same settings, and there was no detection. Sorry for the late reaction : I live in Europe. Edited April 18, 2021 by arleetel Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 18, 2021 Staff ID:1451951 Share Posted April 18, 2021 They only thing you can do is exclude it. The msi is corrupt and wont unpack so i cant figure out which file inside is triggering. I hunted around this morning and couldnt find anything similiar. Link to post Share on other sites More sharing options...
arleetel Posted April 18, 2021 Author ID:1451953 Share Posted April 18, 2021 @shadowwar : thank you for your reply. I can exclude it now that I know it's not a real infection, maybe re-install the software ? Link to post Share on other sites More sharing options...
Staff shadowwar Posted April 19, 2021 Staff ID:1452080 Share Posted April 19, 2021 you could try if want. then reattach the msis here and i can take another look. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now