Jump to content
Sign in to follow this  
zekeallmon

cadkey 19 false positive trojan.scar

Recommended Posts

Hello,

Tech on a service call here. Love malwarebytes, just want to make sure this is a false positive.

Customer uses ancient version of cadkey19, and has mbam pro, updated.

Got a pop up saying that C:\CK19\vib.cde was infected trojan.scar.

They quarantined the file, then deleted the file from quarantine.. and surprise cadkey would no longer open.

I scanned the computer for malware, with mbam, combofix and avast boottime. It was clean. Reinstalled cadkey, and scanned the c:\ck19 folder again w/ mbam. And it once again found the file as being infected.

So, Im sure its a false positive, but just wanted to get a second opinion, and to let you know about it.

Thanks,

Zeke Allmon

Share this post


Link to post
Share on other sites

I am not finding any instances of that file and folder anywhere but this thread, does this software actually install into root?

Share this post


Link to post
Share on other sites

I have a very similar experience today Zeke

Thanks for your post - I am not a tech and was very worried about the positive till I read of your experience with CK19 on Google

Peter

Hello,

Tech on a service call here. Love malwarebytes, just want to make sure this is a false positive.

Customer uses ancient version of cadkey19, and has mbam pro, updated.

Got a pop up saying that C:\CK19\vib.cde was infected trojan.scar.

They quarantined the file, then deleted the file from quarantine.. and surprise cadkey would no longer open.

I scanned the computer for malware, with mbam, combofix and avast boottime. It was clean. Reinstalled cadkey, and scanned the c:\ck19 folder again w/ mbam. And it once again found the file as being infected.

So, Im sure its a false positive, but just wanted to get a second opinion, and to let you know about it.

Thanks,

Zeke Allmon

Share this post


Link to post
Share on other sites

Outside of this thread I am still not seeing a single instance of this, are you guys installing this into root intentionally or does the installer do this intentionally?

Share this post


Link to post
Share on other sites

Same issue here. We use Cad Key 19 - it is indeed ancient. To answer your question, yes CadKey 19 automatically creates the folder C:\CK19\ and installs the vib.cde file, and other files here. This program used to run on older win98 pc's way back when. It is indeed a false positive.

Outside of this thread I am still not seeing a single instance of this, are you guys installing this into root intentionally or does the installer do this intentionally?

Share this post


Link to post
Share on other sites

I am having this problem with CADKEY 99.

We need a LOT more information than this. Post a scan log and collect any files we detect. You can paste the scan log directly into your reply and then zip and attach any files we detect.

Share this post


Link to post
Share on other sites

We need a LOT more information than than. Post a scan log and collect any files we detect. You can paste the scan log directly into your reply and then zip and attach any files we detect.

It appears that you are only going by the file name "vib.cde" and saying that it is a Trojan.Scar.

If I copy and rename the file it is not found to be a problem.

Erasing the file blows my CADKEY.

Share this post


Link to post
Share on other sites

It appears that you are only going by the file name "vib.cde" in deciding that it is a Trojan.Scar.

If I copy and change the file name it is not found to be a problem.

When you remove the file it blows my CADKEY program.

Share this post


Link to post
Share on other sites

Can you post a scan log and the file please. We can not figure out what is going on without this information. As far as i can tell we are not keying off the file name.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.