pw0005 Posted August 22, 2010 ID:303870 Share Posted August 22, 2010 When I run MWB, it shows 87 infected files (I've attached the log). However, when I run Superantispyware, combofix, AVG, etc. they do not find anything. In addition, the files that are shown to be infected are nonexistent as are some of the paths.Am I really infected or is something showing false positives?thanks in advancembam_log_2010_08_22__17_04_07_.txt Link to post Share on other sites More sharing options...
Staff miekiemoes Posted August 23, 2010 Staff ID:303979 Share Posted August 23, 2010 Hi,Looks like a 3rd party Security application is the cause here. So, during a malwarebytes scan - another 3rd party security application sees some files mbam enumerates and blocks this. The enumeration of the files during a mbam scan doesn't mean that they are on your computer - mbam just does a comparision to see if these files exist. So since these 3rd party security application blocks the enumeration during mbam scan, it causes misdetections in malwarebytes.An example of a third party application causing this is Kaseya.Kaseya's file access control features are blocking MBAM. In Kaseya server (Audit -> Protection), static filenames can be added in File Access and Application Blocker, so that's why it is causing misdetections in Malwarebytes.Do you have Kaseya installed? Link to post Share on other sites More sharing options...
pw0005 Posted August 23, 2010 Author ID:304043 Share Posted August 23, 2010 Yes it is! I'm going to remove it and try the scan again and see what happens...Thanks! Link to post Share on other sites More sharing options...
Staff miekiemoes Posted August 23, 2010 Staff ID:304050 Share Posted August 23, 2010 Hi,No need to remove it. I'm not really familiar with Kaseya, but can you search for this option?:In Kaseya server (Audit -> Protection) > File access > application blocker ... there should be some static filenames listed there. In your case it looks like av.exe and braviax.exe are entered there.Is there an option to remove these names there? Link to post Share on other sites More sharing options...
Staff miekiemoes Posted September 4, 2010 Staff ID:309238 Share Posted September 4, 2010 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts