Potential False Positive on .TMP Files

[saltmountain]

Hello,

My nightly scan seems to have marked two .TMP files, from some sort of installer thats not immediately identifiable by the location path, as Malware.Sandbox.23.

Wanted to share and either get a confirmation that its a false positive and report it or get a recommendation to wipe my Windows Installation :)

MWB_Export.txt

[TwinHeadedEagle]

Yes, this is a False Positive. It is now whitelisted.

[saltmountain]

Thanks for the quick response @TwinHeadedEagle! I decided to run a full scan just before posting, but glad to have the validation! You guys rock!

[AdvancedSetup]

You might be able to run the following with PowerShell and check the sources to find where the software temp files came from (if it was related to an installation of software, which it may not be. It could be from running something else not related to installing software)

Open PowerShell with Admin rights. Then copy and paste the code below. Then press the Enter key to run it.

      $SW = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*") + (Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*")
      $SW | Select DisplayName, DisplayVersion, Publisher, InstallDate, InstallLocation, InstallSource | sort-object -Property DisplayName -Unique | Format-Table -AutoSize | Out-String -Width 8096

 

[saltmountain]

I ran those commands but the generated list from the second command doesn't show the directory path's that are included in the export from my first message.

[AdvancedSetup]

Okay, no problem. 50/50 chance of it finding a match.

Cheers