False positive

[Ogden]

MBAM and Sandboxie.

After a full scan MBAM detect 8 objects.

Logs in attach.

mbam_log_2010_06_22__01_44_32_.rar

[Ogden]

After a full scan MBAM detect 8 objects.

[Ogden]

Sorry,my mistake .It was not sandboxie,it was LastPass (password manager)/

[nosirrah]

4223 will be up in just a sec, let me know if this fixes this

[nosirrah]

Should be up now.

[Ogden]

Roger that.

Checking....

*updated* Yes,realy fixed.

Tnx for you work!

[Roosman]

Should be up now.

My apologies if the following are obvious questions but,

1. The latest download from CNET did not turn up to have Database version 4223, it is 4052 instead.

2. The scan result below revealed some Disabled.SecurityCenter (registry data) items, I'm curious whether these are false positives as well.

"www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

7/1/2010 1:37:29 PM

mbam-log-2010-07-01 (13-37-29).txt

Scan type: Quick scan

Objects scanned: 293754

Time elapsed: 15 minute(s), 39 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 3

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)"

[TeMerc]

My apologies if the following are obvious questions but,

1. The latest download from CNET did not turn up to have Database version 4223, it is 4052 instead.

That's why we always recommend you update after install and before every scan, the set up files are not updated with each database, just usually with version updates.

2. The scan result below revealed some Disabled.SecurityCenter (registry data) items, I'm curious whether these are false positives as well.

"www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

7/1/2010 1:37:29 PM

mbam-log-2010-07-01 (13-37-29).txt

Scan type: Quick scan

Objects scanned: 293754

Time elapsed: 15 minute(s), 39 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 3

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)"

Those detections are not actually false\positives or actual infections but rather settings which you have made and in some cases, malware also makes. So we scan those sections of the drive for changes which differ from default settings

Please see the link below for an explanation:

http://www.malwarebytes.org/forums/index.p...c=12624&hl=

You can add them to ignore your next scan.

[Roosman]

Appreciate your input and Thanks!