halflife3 Posted May 23, 2010 ID:254927 Share Posted May 23, 2010 Hi, sorry for bad english! Im think that file is detected as false positive, it is found in C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\ and the malwarebytes recognize as Trojan.Agent, not only this files, but in all projects of visual studio 2008! with database 4052 the program not recognize this files a Trojan.Agent!Please check the file!Thank you!vshost.zip Link to post Share on other sites More sharing options...
Andy Spragg Posted May 24, 2010 ID:254948 Share Posted May 24, 2010 I have a closely related question, which I asked in the general MBAM forum a little while ago:http://forums.malwarebytes.org/index.php?s...mp;#entry254946I got a warning at start-up about a Visual Studio 2008 process being a Trojan agent. I have attached a zip of the file named.AndyControlsDictionary.vshost.zip Link to post Share on other sites More sharing options...
nosirrah Posted May 24, 2010 ID:254954 Share Posted May 24, 2010 Andy, your attached file is not detected, please post a developers log :http://forums.malwarebytes.org/index.php?showtopic=3228@halflife This will be fixed in the next update. Link to post Share on other sites More sharing options...
Andy Spragg Posted May 24, 2010 ID:254987 Share Posted May 24, 2010 Andy, your attached file is not detected, please post a developers log :http://forums.malwarebytes.org/index.php?showtopic=3228Hello nosirrah,Couple of problems with this request:Followed the instructions and got the message "MBAM is already running"Closed MBAM down and tried again, and still got the same messageeven if I get it to run as suggested, I can't "do the same scan as I did before" because I wasn't doing a scan when I got the warning about the Visual Studio file -it was a warning at startupPlease can you advise what I need to do next? In the meantime, I've tried re-zipping the offending file (a different way) and reattaching it. I seem to be having issues with WinRAR at the moment. Upload facility says (again) "Upload successful and is available from the 'Manage Current Attachments' menu".ControlsDictionary.vshost.zip Link to post Share on other sites More sharing options...
nosirrah Posted May 24, 2010 ID:255153 Share Posted May 24, 2010 It has nothing to do with how you are zipping or attaching the file, it is simply not an executable file to begin with and as a result cant even be detected on my end. Link to post Share on other sites More sharing options...
begbodyguard Posted May 24, 2010 ID:255277 Share Posted May 24, 2010 I had the same malware byte did report some off the VShost.exe in my visual studio folder Link to post Share on other sites More sharing options...
Andy Spragg Posted May 24, 2010 ID:255372 Share Posted May 24, 2010 It has nothing to do with how you are zipping or attaching the file, it is simply not an executable file to begin with and as a result cant even be detected on my end.I didn't say it was an executable file, and I don't see what difference that would make? It's just a file to be zipped up and sent. I've looked and what it actually is is a file called "ControlsDictionary.vshost.exe.config". The config "extension" is being hidden since it is a known file type, and the MBAM message is quoting the residual name verbatim. Why on Earth anyone who isn't up to no good would choose to name a file with a double extension to make it look like something it isn't is beyond me. But it's something that MS appear to be quite fond of with the advent of .NET.Are you saying that any attachment that is not an exe just gets filtered out, on grounds that it can't be a "proper" false positive?How do you advise me to proceed with trying to get a developer's log? Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now