Malware.Packer.Gen on support soft dll file

[piinkbox]

Hi all!

I just scanned my computer and malwarebytes is telling me that C:\Program Files (x86)\Common Files\supportsoft\bin\msvcp60.dll is infected with malware.packer.gen.

Can this be a possible false positive? I used Avast 5 to scan this particular file and the results came out clean. I pasted my malwarebytes log below.

Thanks!!!

Malwarebytes' Anti-Malware 1.44

Database version: 3664

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

1/30/2010 5:35:25 PM

mbam-log-2010-01-30 (17-35-25).txt

Scan type: Full Scan (C:\|D:\|F:\|G:\|H:\|I:\|)

Objects scanned: 234045

Time elapsed: 40 minute(s), 5 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Program Files (x86)\Common Files\supportsoft\bin\msvcp60.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.

[nosirrah]

Please zip and attach a copy of that file to your next post .

[wickerberry]

I had malwarebytes flag the exact file (malware.packer.gen) and location as piinkbox but is not picked up by either Norton or Spysweeper when I scan the file with those utilities.

[nosirrah]

Please zip and attach a copy of that file to your next post .

[kacc4]

Same problem here but with a twist.... MBAM deleted the file but I restored it as I experienced boot-up delays. Now the file has vanished from where it was restored to i.e. Supportsoft/bin and further MBAM scans have been clean. By the way, there are four other msvcp.dlls in other locations which are not being flagged up by MBAM.

[nosirrah]

That is because they are the correct formation . The one we hit I know for a fact has been modified . You can actually replace the file that was removed with any of the ones not detected and there should be no ill effect .

[jr6456]

Similar msvpc.dll problems here. I've attached a copy of the file renamed msvpc.d_l

msvcp60.zip

[ackthbbft]

I just received the same infection notification located in "C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP11\A000313.rbf"

Attached copy of file. AVG did not detect any infection in it with the latest definitions.A0003013.zip

[ackthbbft]

I just received the same infection notification located in "C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP11\A000313.rbf"

Attached copy of file. AVG did not detect any infection in it with the latest definitions.A0003013.zip

I forgot to mention, the Date Modified of the file goes back to 2007, if that is in any way significant. MalwareNET lists the bug as only a couple weeks old, however.

[nosirrah]

3676 are the current definitions and do not detect that file .

[kacc4]

The very fact that the msvcp60.dll file has gone missing from supportsoft/bin without any interaction from myself, even though I had to restore it there to correct boot-up problems, seems to reinforce the notion that it is malware.

Paradoxically, the absence of this file from supportsoft/bin is no longer interfering with the boot process, even though I restored it to correct this very issue.....

[nosirrah]

What we are detecting her is an unnatural file structure that should be impossible . Replacing these files with the correct version would resolve all issues .

[starrigger]

What we are detecting her is an unnatural file structure that should be impossible . Replacing these files with the correct version would resolve all issues .

Same popup msg to me. I was using MB def 3679. Location was C:\Program Files (x86)\Common Files\supportsoft\bin\msvcp60.dll

Renamed version of file attached.

I just downloaded def 3680 and did a quick scan. It indicated no problems. May I safely ignore this warning?

Thanks.

msvcp60.zip

[nosirrah]

Yes , this is the issue that has already been resolved .

[starrigger]

Yes , this is the issue that has already been resolved .

Thanks. It wasn't clear to me that the issue was resolved, as there were comments about replacing the file with a correct one, which left me at something of a loss.

I've ignored, and am running a full scan, just to be safe.