Rogue.Crusader

[myrti]

Hi,

I have a topic where the game Crusader Kings by Paradox Interactive is being detected as Rogue.Crusader. I couldn't find anything indicating that the game wasn't legit. Let me know if you need the files.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4875

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10/19/2010 6:48:23 AM
mbam-log-2010-10-19 (06-48-23).txt

Scan type: Full scan (C:\|F:\|)
Objects scanned: 645880
Time elapsed: 5 hour(s), 25 minute(s), 23 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Packer.Gen) -> Data: f:\windows\system32\userinit.exe -> Quarantined and deleted successfully. [031153F3AC28B6B4EB1499C492E8619B]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Packer.Gen) -> Data: system32\userinit.exe -> Quarantined and deleted successfully. [031153F3AC28B6B4EB1499C492E8619B]

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Paradox Entertainment\Crusader Kings\Crusaders.exe (Rogue.Crusader) -> Quarantined and deleted successfully. [FE254D30F0C6B8F9D3A041DAB3464600]
C:\Documents and Settings\Owner\Desktop\Games\Thumb Drive\Crusaders_1.05.exe (Rogue.Crusader) -> Quarantined and deleted successfully. [FE254D30F0C6B8F9D3A041DAB3464600]
C:\Documents and Settings\Owner\Desktop\Games\Thumb Drive\Crusaders_104a_eng.exe (Rogue.Crusader) -> Quarantined and deleted successfully. [FE254D30F0C6B8F9D3A041DAB3464600]
F:\Documents and Settings\Jim\Local Settings\Temp\ie1B.tmp (Malware.Trace) -> Quarantined and deleted successfully. [C870F4A49897395E2FC092CA4F85E549]
F:\Documents and Settings\Jim\Local Settings\Temp\in1A.tmp (Malware.Trace) -> Quarantined and deleted successfully. [BEFBF0D8EE4A30DEF1A4598754734042]

regards myrti

[nosirrah]

Can you get me a copy of the file being detected?

[Faken Jones]

Pretty much the same issue: http://forums.malwarebytes.org/index.php?showtopic=66016

[nosirrah]

This will be fixed in just a bit.

[myrti]

Hi,

sorry for the lack of feedback. My user's hard disk died just at the wrong moment. So I can't get you the files.

Happy to see that you have been able to fix this anyways!