Malware.AI.2996531189 Infection or a False Positive

[RRamdeo]

Hello,

Last month I posted a thread concerning a malware detection that ended up being classified as a false positive.

Name: "Malware.AI.2996531189" from file "C:\SWSETUP\DRV\NETWORK\RALINK\RALINKBT\9.2.10.4\SRC\X86\BLUESO~1. CAB.

That infected file was created on and last modified on 7/30/2012.

As mentioned in the linked previous topic, this computer is over a decade old and is mostly used for some slight tasks like for printing and editing word files. The computer wasn't used since the last "infection" so I'm assuming this is another false positive, but I thought i would post here again for any feedback.

The file in question has not been quarantined yet since after checking it, I think it deals with the WIFI bluetooth component of the computer. I will quarantine it if told to do so. Also, I'm just wondering if this computer being over a decade old could be triggering these false positives, if this is indeed another one, and if I would be better off replacing the computer and removing it.

In any case, thank you in advance for any help.

Have A Great Day. 

[Porthos]

4 hours ago, RRamdeo said:

Name: "Malware.AI.2996531189" from file "C:\SWSETUP\DRV\NETWORK\RALINK\RALINKBT\9.2.10.4\SRC\X86\BLUESO~1. CAB.

Please post the detection log for this detection.

You can find Scan and Protection logs within the Malwarebytes 4 program in the following location

 

 

RTP stands for Real-Time Protection and is where automatic protection operations would normally be logged

 

 

If you click on the View option you should get something similar to the following with other options available.

 

 

 

 

Thank you

[RRamdeo]

Hello,

Thank you for the reply. I attached the Detection log to this post. I also ended up putting the infected file into quarantine to generate the log. After doing so, I rescanned and everything came up clean. But any advice on how to proceed to see if this is a serious infection would be much appreciated.

Thank you for your time. Have a great day.

Malwarebytes Detection Log for RRamdeo.txt

[Porthos]

4 minutes ago, RRamdeo said:

I also ended up putting the infected file into quarantine to generate the log.

I would restore from quarantine and rescan. It will probably scan clean.

https://www.virustotal.com/gui/file/6e759fa338c587675f9dabb1521b07250ed1f3e8971258816ea0b9716a1f078a?nocache=1

[RRamdeo]

Hello,

Thank you for the response. Its comforting to see that nothing flagged the file as malicious. I'll will restore the file and rescan now and update on the results. Any idea on why it would be flagged as positive though? And, moving forward, should I not do custom scans and just stick with the regular threat scan unless something is flagged as positive? 

Thanks again for all the help.

[Porthos]

On 9/21/2023 at 8:21 PM, RRamdeo said:

"Malware.AI.2996531189"

It was an "Ai" detection. It walked like a duck and so on. Malwarebytes Ai temporarily thought it really was a duck so it "caged" it. Because the AI is learning it figured out it was a goose and stopped "calling" it a duck.

 

Ok, enough of Mother Goose for me. Thought that was a wild goose chase of a story? I'm here all week.

Edited September 23, 2023 by Porthos

[RRamdeo]

Hello,

Thanks again for the reply. I'm not sure I completely get the the duck and goose thing, but I think I get the overall idea.

So, when I scanned again after restoring the file from quarantine, the scan picked it up again. I attached the Detection log file. So, is this just a false positive that I should just leave in quarantine, or is there anything else that I should do before classifying it as a false positive? Any further advice is appreciated.

Thanks for all of the help. It's greatly appreciated.

 

 

Malwarebytes Detection Log for RRamdeo Sept 23, 2023.txt

[Porthos]

2 hours ago, RRamdeo said:

the scan picked it up again.

From the location of the file, is this an HP computer?

[blender]

Hello,

Thanks for the log. I'm not seeing a detection on my machine.. it has likely been fixed already.
Please check that you have the latest databases. Should be on Update Package Version: 1.0.75575 or newer.
You can see this from Settings >> about.

If it is still detected ...

Can I get another log from you please?

You'll probably need to show hidden files/folders first. (how-to if you need it: https://support.microsoft.com/en-us/windows/view-hidden-files-and-folders-in-windows-97fbc472-c603-9d90-91d0-1166d1d9f4b5)

Go here:

C:\ProgramData\Malwarebytes\MBAMService\ScanResults

Grab the newest scan log (it'll probably be around 4kb). Zip it and attach to your next reply.

 

Thanks!

 

[RRamdeo]

Hello,

Thank you both for the replies.

To the first question, yes, this is an HP computer.

And to the second inquiry, I will now update and scan. After that, I will post the log when it is ready. 

Thank you for all of the help.

[RRamdeo]

Hello,

So after updating and rescanning, nothing came up. I scanned the file individually and also nothing came up. 

So I am assuming the file was a false positive after all. If that is the case, thank you for all of the help. 

If there is anything else I need to do please let me know. I didn't attach any scan logs since nothing was detected.

Thank you again for all of the help.

[blender]

Good to hear the issue is resolved. Thank you for the update.

No need to do anything further.

Any further issues, don't hesitate to reach out again.

[RRamdeo]

Hello,

Thanks for the kind words and I thank both of you for all of the help again.

Thanks again. I wish all of you all the best. Have a great day.