Possible false positive in C:\Program Files (x86)\SysInternals\ntfsinfo.exe

[BruceJ]

Detected today, last run full scan 2 mo ago. . Temp securing of file was to lock file in place and disable all read and execute, including admin, SYSTEM etc. OS: Windows 8.1/64bit.

Other info (why I think possible false positive):

• I don't run as admin unless changing config, to insert the OS itself would need to be compromised.
• Browsing is done with Noscript, Addblock
• Separate firewall at network entrance to house.
• ntfsinfo64.exe showed up clean
• Dates on ntfsinfo64.exe and ntfsinfo.exe are 3 minutes apart, matching pattern with other dates in SysInternals directory and date relations between 64bit executable and 32bit executable.
• Sizes are very similar between ntfsinfo64.exe and ntfsinfo.exe with the 64bit version being slightly larger, also matching relation between other 32bit and 64bit files in that directory.
• Recently updated database, previous database did not flag this file.

Bruce J.

Detection of Program Files(x86)-SysInternals-ntfsinfo.exe as Malware.txt ntfsinfo.zip

[shadowwar]

Is there a reason you are still running mbam 2? ITs eol and this is not detected with mbam 4. 

 

[shadowwar]

This will be fixed next update. You should really consider upgrading to mbam 4 as it can detect a lot more then mbam2 .