Carry it Easy FP's

[exile360]

A user reported an FP here but was unable to post a developers log for some reason so I tracked down the software that installs the items detected and installed it on my own system. I confirmed it is an FP here and the software in question can be downloaded here, using the autologin component with the software active triggers the FP's in a scan, they are removed when the software exits (it's a portable app used for migrating settings an user profiles between computers via a flash drive similar to MIGO and other such apps):

Malwarebytes' Anti-Malware 1.43

Database version: 3486

Windows 6.0.6002 Service Pack 2

Internet Explorer 7.0.6002.18005

03/01/2010 7:26:38 AM

mbam-log-2010-01-03 (07-26-33).txt

Scan type: Quick Scan

Objects scanned: 89339

Time elapsed: 4 minute(s), 21 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598b818e-71f1-486e-a0be-9952b5851367} (Trojan.BHO.H) -> No action taken. [D0D3827745BF5FFDD67CE6A737FB3EC6]

HKEY_CLASSES_ROOT\CLSID\{598b818e-71f1-486e-a0be-9952b5851367} (Trojan.BHO.H) -> No action taken. [D0D3827745BF5FFDD67CE6A737FB3EC6]

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Users\Exile\AppData\Local\Temp\CarryItEasy\safeloginie.dll (Trojan.BHO.H) -> No action taken. [D0D3827745BF5FFDD67CE6A737FB3EC6]

[nosirrah]

Trojan.BHO.H

This detection is created by any BHO that breaks 3 specific rules , all of which should never be broken by legit software .

When a coder is this foolish the only option is to whitelist the detections .