rundll32.exe (Backdoor.bot) - is this false positive?

[ParanoidAndroid]

I have for the last few weeks been receiving this error log from MBAM

This is on a Dell Inspiron 1525 - which I patched from the Dell website just before this started with a range of drivers including video, chipset and onboard hardware updates.

Malwarebytes' Anti-Malware 1.44

Database version: 3799

Windows 6.0.6001 Service Pack 1

Internet Explorer 8.0.6001.18882

27/02/2010 12:53:31 PM

mbam-log-2010-02-27 (12-53-24).txt

Scan type: Quick Scan

Objects scanned: 103635

Time elapsed: 6 minute(s), 47 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Windows\rundll32.exe (Backdoor.Bot) -> No action taken.

I tried to remove it with MBAM's default removal (including a reboot), but that was unsuccessful - its still reported as being there as the file in C:\WINDOWS - it should be in C:\WINDOWS\SYSTEM32

I then checked with

• scanning in safe mode - nothing shows up
  
• a range of AV/Spyware applications (Avista, Spybot S&D, SuperAntiSpyware, MGtools & Trojan Remover) nothing came up
  
• HiJack this also shows nothing (see the attached logfile in the ZIP)
  

My host file only has these two entries:

127.0.0.1 localhost

::1 localhost

Is this a false positive? Are the other apps being fooled (all are up to date)?

Any help appreciated - and anything else needed in the report?

Chris

hijackthis.zip

[Firefox]

Hello ParanoidAndroid, and welcome to Malwarebytes.org

If you think it is a false positive, you can submit it in the False Positive section for analysis RIGHT HERE

Just for your info, I do not have that file located in my windows folder, and you are right it should be in the Windows\system32 folder.

But to correct your problem for sure, please seek help from the Experts by following the below instructions.

We don't work on Malware removal in the general forums.

Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org

[ParanoidAndroid]

Thanks Firefox - I appreciate the prompt correction. Wasn't sure where to post.....

Chris