Carol Posted October 2, 2008 ID:29492 Share Posted October 2, 2008 A fellow member at CNET, reported MBAM detected the CBO_Setup_4.26.exe as Trojan.Vundo. He felt it might be a f/p, as I did. I downloaded BOClean's lastest installer (CBO_Setup_4.27.exe) to my desktop. MBAM detected Vundo. The log was saved in "devoloper mode". If the mode includes the long sequence of number's at the end of the log, all you need do is ask.Malwarebytes' Anti-Malware 1.28Database version: 1226Windows 5.1.2600 Service Pack 310/1/2008 9:07:29 PMmbam-log-2008-10-01 (21-06-57).txtScan type: Quick ScanObjects scanned: 48339Time elapsed: 4 minute(s), 8 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\Documents and Settings\Carol \Desktop\CBO_Setup_4.27.exe (Trojan.Vundo) -> No action taken. Carol Link to post Share on other sites More sharing options...
Tigger93 Posted October 2, 2008 ID:29495 Share Posted October 2, 2008 This is not the developer mode log, if you could get one of those please. Link to post Share on other sites More sharing options...
Carol Posted October 2, 2008 Author ID:29496 Share Posted October 2, 2008 Tigger..Is this log you were referring to? Malwarebytes' Anti-Malware 1.28Database version: 1226Windows 5.1.2600 Service Pack 310/1/2008 7:40:21 PMmbam-log-2008-10-01 (19-40-21).txtScan type: Quick ScanObjects scanned: 17768Time elapsed: 3 minute(s), 51 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)I saved the log according to Marcin's instructions. The first log I posted was copied and "saved" to a different location. The above is from the program itself. If the above is also incorrect...... I'm stumped! Kindly, let me know what I need to do to correct this. Link to post Share on other sites More sharing options...
Hardhead Posted October 2, 2008 ID:29497 Share Posted October 2, 2008 Hello Carol,I ran full scan and found what we are looking for.Files Infected:C:\Users\Hardhead\Downloads\CBO_Setup_4.27.exe (Trojan.Vundo) -> No action taken. [5253514247405230538380756679155586796980130125182623130117172518362119171721171717173620222022232224222225183621172139173939393922172520362139362535392525372336192117213525171717171718171738253438371817171717253539172020373536231723171738352317251720381717242217342020361725342122171725203925243524212218202037192534222217172520393424372421232125353622382526223719171717171720]I'm sure Bruce will fix this soon. Link to post Share on other sites More sharing options...
Carol Posted October 2, 2008 Author ID:29498 Share Posted October 2, 2008 Hi Tim...Thankfully, I saw your post while editing mine for the "umpteenth" time. I wrote in my original post, "if the mode includes the long sequence of number's at the end of the log, all you need do is ask". (I wasn't sure it if was necessary) For my own edification and knowledge, is that what Tigger meant when he said it wasn't a developer mode log? I didn't think Marcin's instructions for saving a log in developer mode was rocket science, but I've been knocking myself out trying to figure what I could have done wrong.Thanks again. Carol Link to post Share on other sites More sharing options...
Hardhead Posted October 2, 2008 ID:29500 Share Posted October 2, 2008 Hello Carol,The developer mode will show the long sequence of number and while running in regular mode will not. Link to post Share on other sites More sharing options...
Carol Posted October 2, 2008 Author ID:29501 Share Posted October 2, 2008 Thanks again, Tim. Having never seen the 'long sequence of numbers' in my logs before, and never having saved a log in developers mode, I "shudda" thought to include it. 'Shudda cudda'.. it's history now! I do appreciate you taking the time to explain it. Link to post Share on other sites More sharing options...
Hardhead Posted October 2, 2008 ID:29502 Share Posted October 2, 2008 My pleasure Carol. Link to post Share on other sites More sharing options...
Ray Posted October 4, 2008 ID:29716 Share Posted October 4, 2008 Has a patch been issued for this false positive.Ray Link to post Share on other sites More sharing options...
melboy Posted October 4, 2008 ID:29731 Share Posted October 4, 2008 Has a patch been issued for this false positive.RayI no longer get the detection with database version 1227, so try updating and re-scanning. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 4, 2008 Root Admin ID:29739 Share Posted October 4, 2008 You could also upload the file to Jotti's online scannerThey will scan it with all the major Antivirus scanners and let you know the outcome. Link to post Share on other sites More sharing options...
nosirrah Posted October 4, 2008 ID:29755 Share Posted October 4, 2008 dbversion=1229 <- let me know if it is fixed in this version of defs , should be out in an hour Link to post Share on other sites More sharing options...
Hardhead Posted October 5, 2008 ID:29788 Share Posted October 5, 2008 dbversion=1229 <- let me know if it is fixed in this version of defs , should be out in an hourI right clicked on file, scanned and all is clean now.Thanks Bruce Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now