zip.SFX

[zxcdsa]

This file is part of a legitimate install of WinRAR from their website.

File name:

Zip.SFX

Submission date:

2010-09-16 04:22:02 (UTC)

Current status:

queued queued analysing finished

Result:

1/ 43 (2.3%)

http://www.virustotal.com/file-scan/report...57d2-1284610922

[nosirrah]

This should be fixed.

[zxcdsa]

This should be fixed.

I hope so, a more definite answer would help, but tank you!

[MAM]

Is not fixt now, always the same by me.

MAM

[nosirrah]

Is not fixt now, always the same by me.

MAM

Please post your scan log.

[MAM]

...here is a developer log of Malwarebytes' Anti-Malware, i hope that help

[MAM]

And now ?

mbam-log-2010-09-16 (18-23-22).txt

Art des Suchlaufs: Vollst

[shadowwar]

Please post the full log with the def version in it.

Thanks.

[MAM]

That was not the full log, of the developer mode ?

Ok, we start again.

Here the log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Datenbank Version: 4629

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

16.09.2010 18:23:22

mbam-log-2010-09-16 (18-23-22).txt

Art des Suchlaufs: Vollst

[MAM]

Ok, i understand now, sorry that was my fault

MAM

[nosirrah]

Please zip and a attach a copy of Zip.SFX, yours must be different.

[MAM]

Please zip and a attach a copy of Zip.SFX, yours must be different.

Ok, here i am again....

Here are the result

[MAM]

And now what shall i do ?

MAM

[FrankieHi]

Hi, I have the same problem described by MAM...

Same file (C:\Programmi\WinRAR\ZIP.SFX), same result (Backdoor.Bot), same version of Mbam (Malwarebytes' Anti-Malware 1.46) and same definition ver (Versione database: 4629)

In this moment the file is quarantined.

I'll wait for news

Regards

[MAM]

Hi, I have the same problem described by MAM...

Same file (C:\Programmi\WinRAR\ZIP.SFX), same result (Backdoor.Bot), same version of Mbam (Malwarebytes' Anti-Malware 1.46) and same definition ver (Versione database: 4629)

In this moment the file is quarantined.

I'll wait for news

Regards

Hello, i must ask you, this the same result from virustotal.com too, as me ?

MAM

[nosirrah]

Everyone has permission to upload ZIP files, there are no restrictions to anyone. Look at the use above in this post. They ZIPPED and attached the same file.

[MAM]

Hello, why are you using not the download link in my posting #12 ?

Sorry i can

[FrankieHi]

Hello, i must ask you, this the same result from virustotal.com too, as me ?

Yes, the result was

1/ 43 (2.3%) --> McAfee-GW-Edition 2010.1C 2010.09.16 Heuristic.BehavesLike.Win32.Suspicious.H

Everyone has permission to upload ZIP files, there are no restrictions to anyone. Look at the use above in this post. They ZIPPED and attached the same file.

Ok, I'm sorry. This the first post for me

File zipped and attached:

ZIP.zip

Thank you in advance

Regards

[MAM]

Ok it

[nosirrah]

If you rename its extension to .zip or .txt you will be able to attach it, I will fix it on my end.

You do not actually need to zip the file, only the extension needs to be .zip so renaming will work.

[MAM]

Is this the right one now ?

I renamed to'.txt.

MAM

[nosirrah]

Yes, the result was

1/ 43 (2.3%) --> McAfee-GW-Edition 2010.1C 2010.09.16 Heuristic.BehavesLike.Win32.Suspicious.H

Ok, I'm sorry. This the first post for me

File zipped and attached:

ZIP.zip

Thank you in advance

Regards

Thanks for the file, this will be fixed in about 5 minutes.

[MAM]

I have zipped, before i am renaming to .txt.

MAM

[FrankieHi]

Thanks for the file, this will be fixed in about 5 minutes.

Thank you so much for your quickness and professionality.

Do I have to wait for an uptade now, right?

Regards

[FrankieHi]

Ok nevermind

The update has come and now zip.sfx is not detected as a backdoor!

Just a question, just for knowledge... was that file a real false positive then?

Thank you so much for your help

Best Regards, Francesco