False Positive of Trojan Dropper

[Alex_computer]

Found in the C: drive on the laptop running Vista Home Premium SP2.

Alex

Temp.zip

[nosirrah]

This file is not executable and not detected , please provide a scanlog .

[Alex_computer]

Scan log is on its way. I did not choose to save it the first time, so I am rescanning and will post when the scan is done.

[Alex_computer]

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4146

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18904

5/26/2010 7:48:47 PM

mbam-log-2010-05-26 (19-48-47).txt

Scan type: Quick scan

Objects scanned: 122870

Time elapsed: 12 minute(s), 1 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Temp (Trojan.Dropper) -> Not selected for removal.

[nosirrah]

That is likely MBAM being aggressive against a file in root , we don't let much get away with much in root .

I can check for sure if you post a developers log :

http://forums.malwarebytes.org/index.php?showtopic=3228

[Alex_computer]

That's what I was thinking it probably was. Here is the developer's log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4146

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18904

5/26/2010 8:42:41 PM

mbam-log-2010-05-26 (20-42-41).txt

Scan type: Quick scan

Objects scanned: 123130

Time elapsed: 10 minute(s), 35 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Temp (Trojan.Dropper) -> Not selected for removal. [C7EF3D782AC13171614C678C64588552]

[nosirrah]

Do you know how this file got in root ? There should never be files added to this location . I don't see any other reports on this so it seems to be a unique user customization .

[Alex_computer]

No, I am not sure how it got there. I will make sure to get it out. It did recieve a 0/41 on VT though.

[nosirrah]

We would not detect this file @ other locations . Malware frequently uses this location to launch infections and since real files should not be dropped/running from root we tighten up what we let happen there to better protect you .