Strange detection

[RuyLopez]

Greetings,

A scan log is posted below. The file that was detected as being infected with Trojan.Zbot is the Mail Tagger add-on for Thunderbird. What I find strange about this detection is that I uninstalled that add-on days before running this scan.

In-depth scans with both SAS and NOD32 do not even indicate the existence of the add-on. Searching for it yields nothing, nor can it be found in the location indicated by MBAM.

Best regards,

RL

**************************

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 5115

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

11/14/2010 13:13:03

mbam-log-2010-11-14 (13-13-03).txt

Scan type: Quick scan

Objects scanned: 679

Time elapsed: 21 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\***\Application Data\Thunderbird\Profiles\gqvixbhm.default\extensions\{554c2c30-935c-11d9-9669-0800200c9a66}\library\moods\smiling.gif (Trojan.Zbot) -> No action taken.

[yardbird]

Welcome to Malwarebytes!

Please read the following so that you can begin the cleaning process:

As we don't deal with malware removal in the General Malwarebytes' Anti-Malware Forum, you need to start a topic in the Malware Removal forum so a qualified helper can help you fix any malware related problems/infections you may have.

• Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.
  
• After posting your new post, make sure under options, you select Track this topic and choose Immediate Email Notification, so that you're alerted when someone has replied to your post.
  
• One of the expert helpers there will give you one-on-one assistance when one becomes available.
  
• Please refrain from making any further changes to your computer (Install/Uninstall programs, use special fix tools, delete files, edit the registry, etc...) unless advised by a malware removal helper. Doing so can result in system changes which may hinder the attempts by a helper to clean your machine.
  

NOTE: Please DO NOT post back to (bump) your topic within the first 48 hours.

Replying to your own posts changes the post count and helpers are looking for topics with zero replies. If you reply to your own post helpers may think that you're already being helped and thus overlook your post.

• • If there is no reply from any experts after 48 hours, you can reply to the topic, asking for help again.
    Or
    
  • You may send a Private Message to a Moderator asking for assistance.
    

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org or here.

Please be patient, someone will assist you as soon as it is possible.

[RuyLopez]

Please read the following so that you can begin the cleaning process...

Greetings,

Thank you for your reply, but I believe that you have misinterpreted the intent of my post. I am not seeking assistance with cleaning.

I am endeavoring to make MBAM aware of an observation, and in so doing implicitly inquiring as to how exactly does MBAM detect a minor component of something that had been uninstalled well prior to a scan--including specifying a non-existent location of an infection.

Best regards,

RL

[Alex_computer]

What I am thinking is that the addon did not fully uninstall. Does this file show up when you browse to that location via Windows Explorer?

[RuyLopez]

What I am thinking is that the addon did not fully uninstall. Does this file show up when you browse to that location via Windows Explorer?

Greetings,

I considered that possibility.

The observations:

1. MBAM scans the entire folder associated with that add-on. If I run an MBAM scan of the extensions folder via the right click menu, I can watch MBAM run through many items within the uninstalled add-on.

2. Neither SAS nor NOD32 see that add-on folder.

3. Visual inspection of the designated folder location via Windows Explorer shows that it is not there.

4. Searches based on the add-on number {554...} and by the specific "infected" item indicate that no such entries exist.

Best regards,

RL

[nosirrah]

http://forums.malwarebytes.org/index.php?showtopic=3228

This will give me more data to work with.

[RuyLopez]

http://forums.malwarebytes.org/index.php?showtopic=3228

This will give me more data to work with.

Hi Bruce,

Good to see. Been a long time since we roamed the halls at CC. I hope all is well with you.

Zipped copy of the requested log is attached.

Best regards,

RL

mbam_log_2010_11_14__16_56_36_.zip

[nosirrah]

Thanks for the scan log, this confirms that a non executable file is being detected in a way that should not be possible. I am going to talk with the code team about this but it is certainly not an infection.

[RuyLopez]

Thanks for the scan log, this confirms that a non executable file is being detected in a way that should not be possible. I am going to talk with the code team about this but it is certainly not an infection.

Thanks Bruce,

That is good to know with certainty. I am still puzzled as to why MBAM even sees that uninstalled add-on.

Best regards,

RL

[nosirrah]

It would be interesting to know if 1.50 detects this. You can always go back to 1.46 if you do not like it for any reason. All of my team is using 1.50 currently and none of us are having any issues so I feel safe recommending it to anyone to try.

[RuyLopez]

It would be interesting to know if 1.50 detects this. You can always go back to 1.46 if you do not like it for any reason. All of my team is using 1.50 currently and none of us are having any issues so I feel safe recommending it to anyone to try.

Installed MBAM 1.50 Beta over the top of 1.46. Scans run with Definition database 51215. No threat was found, but MBAM still sees the uninstalled add-on.

I have one idea as to why that might be--old emails in which I has used that add-on that are still in my various mail boxes. When I have time, I will check on that possibility. The idea came to mind following this experiment. I copied the Extensions folder onto my desktop and did a right click menu scan with MBAM. Under those conditions, MBAM did not detect the uninstalled add-on.

Anyway, I will look into it more when time permits. Thanks for the help Bruce!

Best regards,

RL