Some False positive?

[Hanger]

Some false positive have found... again?

"Malwarebytes' Anti-Malware 1.22

Database version: 982

Windows 6.0.6001 Service Pack 1

17:28:51 23.7.2008

mbam-log-7-23-2008 (17-28-49).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 99439

Time elapsed: 43 minute(s), 26 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 4

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Windows\rundll16.exe (Fake.Dropped.Malware) -> No action taken.

C:\Windows\System32\vcmgcd32.dll (Trojan.Agent) -> No action taken.

C:\Windows\logo1_.exe (Worm.Viking) -> No action taken.

C:\Windows\System32\systems.txt (Trojan.FakeAlert) -> No action taken."

I can

[nosirrah]

http://www.google.com/search?hl=en&q=S...G=Google+Search

http://www.google.com/search?hl=en&q=W...amp;btnG=Search

http://www.google.com/search?hl=en&q=W...amp;btnG=Search

http://www.google.com/search?hl=en&q=S...amp;btnG=Search

Google is 4 for 4 on confirming malware paths .

Now the question is how did dead 0k files of known bad file names get into your system ?

These cant be FPs because the paths are known but at the same time that are empty so they are not a threat .

I do not know where they could have come from , do you have any idea ?

[Dominic]

http://www.google.com/search?hl=en&q=S...G=Google+Search

http://www.google.com/search?hl=en&q=W...amp;btnG=Search

http://www.google.com/search?hl=en&q=W...amp;btnG=Search

http://www.google.com/search?hl=en&q=S...amp;btnG=Search

Google is 4 for 4 on confirming malware paths .

Now the question is how did dead 0k files of known bad file names get into your system ?

These cant be FPs because the paths are known but at the same time that are empty so they are not a threat .

I do not know where they could have come from , do you have any idea ?

Hello,

I had today the same results

C:\WINDOWS\rundll16.exe (Fake.Dropped.Malware) -> No action taken.

C:\WINDOWS\system32\vcmgcd32.dll (Trojan.Agent) -> No action taken.

C:\WINDOWS\logo1_.exe (Worm.Viking) -> No action taken.

So these things are not a threat?

Because I cant remove them and I would like to know definately if they are Dangerous or not.

BTW:They didnt occur in the Safe Mode

[nosirrah]

There is something odd here . This almost looks like a problem that was fixed many manths ago . The code that was used to detect hidden files could cause this from time to time but that code has been gone for months .

Ill have t oask Marcin to look at this .

[Dominic]

There is something odd here . This almost looks like a problem that was fixed many manths ago . The code that was used to detect hidden files could cause this from time to time but that code has been gone for months .

Ill have t oask Marcin to look at this .

Today I updated MalwareBytes.

Then I scanned my PC again and again there were the 3 threats.I clicked on the remove Button.

After that a Message appeared,that I have to restart my PC in order to remove the threats.So I did.

I scanned again and everzthing was clean now.

[Hanger]

Today I updated MalwareBytes.

Then I scanned my PC again and again there were the 3 threats.I clicked on the remove Button.

After that a Message appeared,that I have to restart my PC in order to remove the threats.So I did.

I scanned again and everzthing was clean now.

Same there:

"Malwarebytes' Anti-Malware 1.23

Database version: 985

Windows 6.0.6001 Service Pack 1

12:57:14 24.7.2008

mbam-log-7-24-2008 (12-57-04).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 98442

Time elapsed: 1 hour(s), 13 minute(s), 1 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 4

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Windows\rundll16.exe (Fake.Dropped.Malware) -> No action taken.

C:\Windows\System32\vcmgcd32.dll (Trojan.Agent) -> No action taken.

C:\Windows\logo1_.exe (Worm.Viking) -> No action taken.

C:\Windows\System32\systems.txt (Trojan.FakeAlert) -> No action taken."

[Hanger]

Deckard's System Scanner v20071014.68

Run by Mikko on 2008-07-24 18:18:02

Computer is in Normal Mode.

--------------------------------------------------------------------------------

Total Physical Memory: 1022 MiB (1024 MiB recommended).

-- HijackThis (run as Mikko.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:18:21, on 24.7.2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\RtHDVCpl.exe

C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Windows Live\Perheturva\fssui.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Google\Google Updater\GoogleUpdater.exe

C:\Windows\System32\mobsync.exe

C:\Windows\System32\rundll32.exe

C:\Users\Mikko\Desktop\dss.exe

C:\HJT\Mikko.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Windows Live OneCare Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Perheturva\fssbho.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto

O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Perheturva\fssui.exe" -autorun

O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h

O4 - HKLM\..\Run: [skytel] Skytel.exe

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')

O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')

O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Lis