30 FP

[disPlay]

Yesterday mbam found 30 Trojans in the system32.

Log is in the post.

mbam_log_2010_07_08__13_32_07_.zip

[nosirrah]

How did you end up with nested system32 folders?

\System32\System32\

[disPlay]

How did you end up with nested system32 folders?

\System32\System32\

The strange thing is after a quick lookup and research there is no folder with the name system32 under the system32. Most of the files I scanned in virustotal and they are clean.

[nosirrah]

I am confused now.

"no folder with the name system32 under the system32"

That statement makes the following one impossible:

"Most of the files I scanned in virustotal and they are clean. "

We need to get on the same page here as what you posted is telling me that you are checking files from a folder that you cant find.

[disPlay]

I am confused now.

"no folder with the name system32 under the system32"

That statement makes the following one impossible:

"Most of the files I scanned in virustotal and they are clean. "

We need to get on the same page here as what you posted is telling me that you are checking files from a folder that you cant find.

under the System 32 there are that files. I don't have 2 folders with the same name I only have one with that name. and the files are inside them.

[AdvancedSetup]

Please post a new post here with your log and send me a Private Message when ready: http://forums.malwarebytes.org/index.php?showforum=7

I will assist you at looking into this further.

Thank you.

[casy]

Sorry for my bad English (automatic translation by Google)

I have the same problem on the same files, this evening. MBAM shows the path C:\windows\system32\system32\ but on the disk the real path is c:\windows\SysWOW64\system32 (Win 7 64 bits).

It is possible that these files are from installation of Samsung Kies (I made an update today), but I'm not sure.

[disPlay]

Attached.

Attach.txt

DDS.txt

[AdvancedSetup]

This is not the forum where I wanted you to run the logs. I'll take a look and see but if we need to continue then you'll need to create a post in the other forum please.

Thanks.

[AdvancedSetup]

Sorry for my bad English (automatic translation by Google)

I have the same problem on the same files, this evening. MBAM shows the path C:\windows\system32\system32\ but on the disk the real path is c:\windows\SysWOW64\system32 (Win 7 64 bits).

It is possible that these files are from installation of Samsung Kies (I made an update today), but I'm not sure.

Can both of you please run the following.

Click on the start button and type in CMD on the search bar and when it shows up click to run it. Then type the following exactly.

set >"%USERPROFILE%\DESKTOP\MYVARS.TXT"

That will put a copy of your environment variables in a text file on your desktop named: MYVARS.TXT please attach that on your next reply.

Then if you can please zip up a copy of that Samsung installer you're using if it's not too large so that we can test it out as well and see what's going on.

[casy]

Can both of you please run the following.

Click on the start button and type in CMD on the search bar and when it shows up click to run it. Then type the following exactly.

set >"%USERPROFILE%\DESKTOP\MYVARS.TXT"

That will put a copy of your environment variables in a text file on your desktop named: MYVARS.TXT please attach that on your next reply.

Then if you can please zip up a copy of that Samsung installer you're using if it's not too large so that we can test it out as well and see what's going on.

Here are my environment variables

The installer Samsung Kies is a little large (148 MB) but can be downloaded at this link:

http://www.samsung.com/fr/support/download...=MULTI+LANGUAGE

MYVARS.TXT

[disPlay]

The installer is the same as the casy posted.

There is my MYVARS.TXT

[disPlay]

Sorry for doing another reply but I got and error after posting.

Here is it.

MYVARS.TXT

[AdvancedSetup]

Thanks - it will probably be a few days before I can check this. I'll need to build an x64 VM image to test as I have time.

The download site is very slow for this file.

[AdvancedSetup]

We have tracked down the issue. It appears that Samsung's installer is not properly installing the files.

When a 32 Bit program does an install on a 64 Bit Operating System (which is the case here) then those files which normally would go to C:\Windows\System32 folder will now go to C:\Windows\SysWOW64 but in this case Samsung is directing them to C:\Windows\SysWOW64\system32 and this is where the FP is being caused.

Due to an invalid installation method by Samsung you will need to either see if you can write to Samsung and get it corrected or maybe post on their support board. Until, or if you'd rather, you can simply add each of those files to your IGNORE list and then they will no longer be detected.

Further information on how the WOW64 operates can be found here