Powerarchive FP?

[creatifica]

Attached file sshnas21.dll is stated as a trojan.downloader by mbam.

Since my Norton Internet Security 2010 didn't report it as malicious, I think it may be a FP.

Below is the virustotal log.

http://www.virustotal.com/analisis/a589947...7651-1280729912

sshnas21.zip

[Fatdcuk]

Hi creatifica,

You need to send this file to Norton so they can add it to their DB of malicious code

This is not a F/p and in no way should anyone be benchmarking that because their AV dose'nt flag a file means it cannot be malicious.

There is always the risk as in this case it is a malicious file and Norton just did not know it yet...

[creatifica]

Thanks, i've just submitted it

[creatifica]

Hold on...

Now MBAM doesn't report the file as malicious, what gives?

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4379

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

8/4/2010 12:03:33 AM

mbam-log-2010-08-04 (00-03-33).txt

Scan type: Quick scan

Objects scanned: 129181

Time elapsed: 7 minute(s), 42 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[Fatdcuk]

Hi,

MBAM is still flagging the attached file so perhaps maybe you have quarantined it or manually deleted it.

17:23:43	(null)	DETECTION	C:\Documents and Settings\User\My Documents\Malware Samples\sshnas21.dll	Trojan.Downloader	QUARANTINE
17:23:43	(null)	DETECTION	C:\Documents and Settings\User\My Documents\Malware Samples\sshnas21.dll	Trojan.Downloader	DENY

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4385

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

03/08/2010 17:25:05
mbam-log-2010-08-03 (17-25-05).txt

Scan type: Quick scan
Objects scanned: 2
Time elapsed: 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\User\My Documents\Malware Samples\sshnas21\sshnas21.dll (Trojan.Downloader) -> Quarantined and deleted successfully.

[creatifica]

I restored the file from mbam's quarantine so that I could make the attachment to post here.

I did a right-click on that file to scan it individually, mbam said no problem.

Then I did a quick scan and still it didn't trigger.

It was really strange...

Anyway, I think Symantec has updated its database, the file has finally been picked up by norton and quarantined.

THANKS!