Jump to content

Malware.Packer.Gen on support soft dll file


piinkbox

Recommended Posts

Hi all!

I just scanned my computer and malwarebytes is telling me that C:\Program Files (x86)\Common Files\supportsoft\bin\msvcp60.dll is infected with malware.packer.gen.

Can this be a possible false positive? I used Avast 5 to scan this particular file and the results came out clean. I pasted my malwarebytes log below.

Thanks!!!

Malwarebytes' Anti-Malware 1.44

Database version: 3664

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

1/30/2010 5:35:25 PM

mbam-log-2010-01-30 (17-35-25).txt

Scan type: Full Scan (C:\|D:\|F:\|G:\|H:\|I:\|)

Objects scanned: 234045

Time elapsed: 40 minute(s), 5 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Program Files (x86)\Common Files\supportsoft\bin\msvcp60.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.

Link to post
Share on other sites

Same problem here but with a twist.... MBAM deleted the file but I restored it as I experienced boot-up delays. Now the file has vanished from where it was restored to i.e. Supportsoft/bin and further MBAM scans have been clean. By the way, there are four other msvcp.dlls in other locations which are not being flagged up by MBAM.

Link to post
Share on other sites

That is because they are the correct formation . The one we hit I know for a fact has been modified . You can actually replace the file that was removed with any of the ones not detected and there should be no ill effect .

Link to post
Share on other sites
I just received the same infection notification located in "C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP11\A000313.rbf"

Attached copy of file. AVG did not detect any infection in it with the latest definitions.A0003013.zip

I forgot to mention, the Date Modified of the file goes back to 2007, if that is in any way significant. MalwareNET lists the bug as only a couple weeks old, however.

Link to post
Share on other sites

The very fact that the msvcp60.dll file has gone missing from supportsoft/bin without any interaction from myself, even though I had to restore it there to correct boot-up problems, seems to reinforce the notion that it is malware.

Paradoxically, the absence of this file from supportsoft/bin is no longer interfering with the boot process, even though I restored it to correct this very issue.....

Link to post
Share on other sites
What we are detecting her is an unnatural file structure that should be impossible . Replacing these files with the correct version would resolve all issues .

Same popup msg to me. I was using MB def 3679. Location was C:\Program Files (x86)\Common Files\supportsoft\bin\msvcp60.dll

Renamed version of file attached.

I just downloaded def 3680 and did a quick scan. It indicated no problems. May I safely ignore this warning?

Thanks.

msvcp60.zip

Link to post
Share on other sites
Yes , this is the issue that has already been resolved .

Thanks. It wasn't clear to me that the issue was resolved, as there were comments about replacing the file with a correct one, which left me at something of a loss.

I've ignored, and am running a full scan, just to be safe.

Link to post
Share on other sites

Archived

This topic is now archived and is closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.