Jump to content

Please could someone tell me if this is a new false positive


icekool

Recommended Posts

Hi all, I am new here but have been using Malwarebytes for quite a long time. I strongly suspect a false positive but am in no way sure and would be very grateful for any input from someone here.

I have just done a full scan on my new Samsung laptop (5 days old now, running Win 7 32 bit) and it found 1 item, this was labelled as "Trojan.FakeAlert" with the actual file name of "FailSafeFactoryInstaller_1017.exe" (all without quotes), this was found at the following location

C:\Windows\MSetup\BASW-01278A18\FailSafeFactoryInstaller_1017.exe

I have successfully removed this item but very much need to ask the following, firstly, my machine is a Samsung which came with the deep level security/laptop anti theft software, called "FailSafe" which doesnt actually register in the registry, its one of those programs that runs silently and tracks the physical location and IP address of the machine if triggered after an actual theft, it apparently allows all sorts of procedures such as remotely wiping the data, location tracking via GPS etc.. so is this a very new false positive??, I had no symptoms whatsoever of the fairly well known FakeAlert Trojan, my fully updated Norton IS 2010 didn't pick it up in a previous full scan and perhaps most curiously, the laptop has the aforementioned "FailSafe" software pre-installed by Samsung.

Here is a link to the software company website Samsung FailSafe website

Also, doing a Google and Yahoo search for the exact string FailSafeFactoryInstaller_1017.exe produces only 4 results, all of which are in European languages that I dont speak but look as though they are also mentioning the same sort of thing as me here.

Any help or information would be greatly appreciated as I have spent hours creating system image backups in 2 different formats in 3 different locations which will contain this item (yep, I'm stupid enough to do the Malwarebytes scan afterwards !! :blink: )

Link to post
Share on other sites

I am not finding a download for their software on that site. Please provide a download location or zip and attach a copy of FailSafeFactoryInstaller_1017.exe.
I deleted the file as mentioned above so dont have a copy, I also dont have a download location as it was pre-installed on my new machine, I only went to their site to read about uninstalling their app as I hate this type of pre-installed software that 'runs in the background'.

I have no idea where you could find a copy of this file but if it helps, my laptop is the new updated Samsung R530, core i3 model. Also, as I mentioned above, there were a handful of results from a google search for the file name but unfortunately not in English, I have a feeling that this is a very new file/app.

Anyway, thanks to the excellent Malwarebytes, I have removed this thing from my machine and even if it is a false positive, I would rather be on the safe side and I am glad to report it here in case more people over the next few weeks or months get the same thing, especially if they buy a laptop with this 'FailSafe' anti theft app pre-installed.

Link to post
Share on other sites

I read something about the company being bought by another, may explain why the download is hard to find. I have a Samsung laptop that may a disk with this one it. I blew away the OS and installed fresh so I don't have an installed copy either. I will take some time today to see if I can find it, may actually be on the Samsung site in the download section for your system.

Link to post
Share on other sites

http://www.help2go.com/forum/spyware-help/106392-error-message-when-i-run-hijackthis-first-time-create-1-st-log-help-plz.html

The same named file was found here (Help2Go Site) - Just the only bits I could find - Might help ??

Delete if not related to the item -

Thanks -

Files Infected:

C:\Windows\MSetup\BASW-01278A18\FailSafeFactoryInstaller_1017.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Link to post
Share on other sites

  • 2 months later...

I have just bought a samsung R530 and have exactly the same issue as icekool i.e. failsafe fakealert is flagged on the same file. The file is attached as requested in an earlier post. If you need anything else I can either post it or email if you let me have an address.

In addition I managed to start the instalation but stopped it so I do not know if anything untoward has happened. If it has would malwarebytes pick it up?

Something else that may help is that I have also scanned with AVG Free and Spybot and neither found a problem. Windows Malicious Software removal tool did not pick it up either.

Hope someone can help

Thanks

FailSafeFactoryInstaller_1017.zip

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.