Massive amount of false positives from Malwarebytes

[mvillilo]

We are a corporate customer with malwarebytes but unfortunately, I have not received an email back from them about this issue so I'm turning to the community to see if an answer can be found:

We have Malwarebytes installed on the computers here at our company. Over the last two days, we have had dozens of users call into our help desk telling us that they had a pop-up from Malwarebytes saying that c:\documents and settings\<user name>\userinit.exe is infected with a Trojan and gives them the option to quarantine it (which we tell them to do). Afterwards, we connect into the system and run scans with both Malwarebyte and eTrust to try to locate any other infected files. Both scans come up with nothing. When I look at the quarantine tab on the MBAM GUI, there are no files listed there but when I check the protection logs it says the file has been quarantine.

I have just spent the last few hours on two machines running ComboFix, Kapersky's TDSS remover, Sophos Anti-Rootkit and spybot but nothing is finding anything at all and calls keep on coming in about this.

Would anyone have any insight as to what the program is trying to tell us?

[Haider]

Hello mvillilo:

I don't believe they are FP, otherwise forum would have been full of complaints, it is specific to your environment. Please check if you have any Scheduled Tasks that might be causing this issue!

Note: The views expressed here are explicitly my own

[mythinker]

We are also a corporate client and are seeing the exact same false positives starting this morning.

[yardbird]

@ mythinker

Please send an email to: corporate@malwarebytes.org or you may send a PM (private message) to: AdvancedSetup here! Please have all your information ready that the corporate dept. will ask you. regards......

[TeMerc]

To be clear:

As a licensed corporate user, technician, reseller, affiliate or non-profit user, you have access to the corporate helpdesk, contact them via the email address below.

corporate-support@malwarebytes.org

Please provide your corporate license information when requesting help.

[AdvancedSetup]

Please update the rules for the database and restart the computer. You must restart the computer after the updates. Then let us know if you're still getting a detection for this.

Current rules are 4623

Thank you.