CaptureText.com

[dvk01]

Looks like a fp to me here

http://forums.techguy.org/windows-7/924865...tml#post7403754

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4136

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

5/24/2010 2:43:16 AM

mbam-log-2010-05-24 (02-43-16).txt

Scan type: Quick scan

Objects scanned: 152971

Time elapsed: 5 minute(s), 32 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

C:\Program Files (x86)\CaptureText.com\Capture Text\CaptureText.exe (Trojan.Downloader) -> No action taken.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\ Program Files (x86)\CaptureText.com\Capture Text\CaptureText.exe (Trojan.Downloader) -> No action taken.

Registry Data Items Infected:

HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Program Files (x86)\CaptureText.com\Capture Text\CaptureText.exe (Trojan.Downloader) -> No action taken.

[exile360]

Greetings dvk01

That does indeed appear to be an FP. Would it be possible to get a developers log from the user simply have the user perform a Quick Scan by executing MBAM with the /developer switch?

Thanks

[dvk01]

I will certianly ask them to

[dvk01]

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4136

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

5/24/2010 3:20:27 PM

mbam-log-2010-05-24 (15-20-27).txt

Scan type: Quick scan

Objects scanned: 153332

Time elapsed: 3 minute(s), 40 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

C:\Program Files (x86)\CaptureText.com\Capture Text\CaptureText.exe (Trojan.Downloader) -> No action taken. [08A2BA14DCD902ECF56B2250EFDD61DE]

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\ Program Files (x86)\CaptureText.com\Capture Text\CaptureText.exe (Trojan.Downloader) -> No action taken. [08A2BA14DCD902ECF56B2250EFDD61DE]

Registry Data Items Infected:

HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> No action taken. [35FF61C37574A0915CF467CFD321FF14]

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Program Files (x86)\CaptureText.com\Capture Text\CaptureText.exe (Trojan.Downloader) -> No action taken. [08A2BA14DCD902ECF56B2250EFDD61DE]

[nosirrah]

I wont be able to correct this without a copy of that file . This is a packer issue and I need the real file to make a workaround .

[exile360]

Hi Bruce

I believe the installer for it can be found here.

edit: Nevermind, I installed that version and scanned and got no detection. The user must have an older version of the software installed .