Mismatch.Extension

[d.a.a]

Updated and scanned, and this thing showed up. No changes, aside from a Microsoft mouse driver being installed.

0/43 on VirusTotal

Here's a developer log and the attached file:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4733

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

2/10/2010 2:52:37 PM

mbam-log-2010-10-02 (14-52-37).txt

Scan type: Full scan (C:\|E:\|F:\|)

Objects scanned: 494816

Time elapsed: 1 hour(s), 6 minute(s), 20 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\PeerNetworking\e8ed5f9c4648ca30b1a4c53d98d2d47dd40b4eb3.HomeGroupClassifier\353d7bb469bb4834f371bd3e7681988b\grouping\edb003B1.log (Extension.Mismatch) -> No action taken. [88F127E9D8648C4D95FD86711C18BD28]

edb003B1.rar

[shadowwar]

Well this is a log file but for some reason it starts with the prefix for executable files. It would be safe to remove or ignore. Extension mismatch means it has an executable prefix inside the file but is not named with an executable extension.. (.exe .dll .sys). Malware does this trick a lot thus we add the extension mismatch check.

[d.a.a]

Well this is a log file but for some reason it starts with the prefix for executable files. It would be safe to remove or ignore. Extension mismatch means it has an executable prefix inside the file but is not named with an executable extension.. (.exe .dll .sys). Malware does this trick a lot thus we add the extension mismatch check.

Great, thanks. Should I wait for an update before removing, if it's harmless?

[shadowwar]

You can just add it to the ignore list in Mbam. I don't think anything will be affected if you delete it though but ignore list may be safer. An update will not affect this detection.

[d.a.a]

You can just add it to the ignore list in Mbam. I don't think anything will be affected if you delete it though but ignore list may be safer. An update will not affect this detection.

The file appears to have been deleted after a restart anyway. Not entirely sure what happened... thanks.