Malware.Heuristic.1003.

[Doctor9fan]

I ran a full scan of MlawareBytes premium & it found 7 infections all under: C:\WINDOWS\INSTALLER\, I believe these are a false positive:

File: 7
Malware.Heuristic.1001, C:\WINDOWS\INSTALLER\12B11B2.MSI, Quarantined, 1000001, 0, 1.0.40009, 0000000000000000000003E9, dds, 01226420, 2E504E6E9EE2B5806E4A4812F9D1190D, A8CFFB0D2414D226AB920674724C0E174E6EBF62561C115C4F40350CA30FED34
Malware.Heuristic.1003, C:\WINDOWS\INSTALLER\18A1890.MSI, Quarantined, 1000001, 0, 1.0.40009, 0000000000000000000003EB, dds, 01226420, BAD462F14DC27EE5113C81F77618EEC1, DCA20787748D5FF7F688E08B74F6FBA3734BB1368FB17759AC4B4CA24B2C190C
Malware.Heuristic.1003, C:\WINDOWS\INSTALLER\18A18D7.MSI, Quarantined, 1000001, 0, 1.0.40009, 0000000000000000000003EB, dds, 01226420, 22B3E13F0B11F9DB0C40BE10778C696E, 924CF38B1B8FCCC877E50FA972BB56DEAD5C9904B2F857A9E68A029CD33E2F24
Malware.Heuristic.1003, C:\WINDOWS\INSTALLER\616B6E8.MSI, Quarantined, 1000001, 0, 1.0.40009, 0000000000000000000003EB, dds, 01226420, 8C37611C553CC2816A56EBA69EE6F4B5, 92BCFFEF5F31232DFFEE264728432021CF78D1416C75A2A830D500A054E01F63
Malware.Heuristic.1003, C:\WINDOWS\INSTALLER\616B6EE.MSI, Quarantined, 1000001, 0, 1.0.40009, 0000000000000000000003EB, dds, 01226420, 8D721DAC2C326AAD7307E189FD72929E, 8E2BEE262DA839961A7C0E8D59F999EBC5E34F2E8707C48234D9A873AA2888D5
Malware.Heuristic.1003, C:\WINDOWS\INSTALLER\616B6F1.MSI, Quarantined, 1000001, 0, 1.0.40009, 0000000000000000000003EB, dds, 01226420, 842C06C5277EB8FD73C90CBA11140481, 877EC8CE5D1E0D92568E06931EE810B6C5C3AC242FE93DF97D6C5945D9489A23
Malware.Heuristic.1003, C:\WINDOWS\INSTALLER\616B6F4.MSI, Quarantined, 1000001, 0, 1.0.40009, 0000000000000000000003EB, dds, 01226420, D1A2AF753FA5F1CE6C0FB72A9017911C, 7EFA8941D4F4F59C91DEC03493F73FB5A7A157A7F12AFC067AE9098662AD82AE

Yesterday I ran MB (quick scan) & the latest version of Norton 360 & nothing was found.

mb.txt

[Atribune]

Hi,

Could you please navigate to C:\ProgramData\Malwarebytes\MBAMService\LOGS and zip the contents of that directory. Once you've created the zip please upload the zip.

Thanks.

[Doctor9fan]

Unfortunately I had to recover using a system image last night (due to a (believed) problem after a Windows update) & am currently running a complete scan. Currently the list of suspect files is 27 & while I’m hoping many are pup/pua I’ll see what they are & report back.

[Doctor9fan]

All 30 detected infections were the same Malware.Heuristic.1003 most were from my Big Fish games extras which were screensavers. 

I've added the logs plus the new txt file.

 

LOGS.zip Malware.txt

[Porthos]

1 hour ago, Doctor9fan said:

All 30 detected infections were the same Malware.Heuristic.1003 most were from my Big Fish games extras which were screensavers. 

Hi,

Do you have "Use expert system algorithms to identify malicious files" enabled? It is located in Settings > Security> Scan option.

This since this is normally disabled by default.

[Doctor9fan]

Thanks, Porthos, yes, I have this enabled (I don't remember doing this but it's possible) I've now disabled this & will scan again.

[shadowwar]

Disabling that setting will stop these detections. If you can could you gather the files detected in a zip so i can analyzed and whitelisted them?

 

Thanks. 

[Doctor9fan]

I ran another scan after disabling that setting & nothing was found.

I'll include the zip here.

As one file is larger than the total size it wouldn't allow me to add it here so I've uploaded it to me Mediafire account.
MB.zip

[shadowwar]

Thanks. These files are whitelisted now. 

[Doctor9fan]

Thank you.