Suspicious file left in mbam folder after uninstall

[Galileo7]

Hi,

I have an XP laptop on which mbam was installed some time ago. I was seeking to update it today, but it wouldn't recognize that the laptop was connected to the Internet. I ensured that mbam had a firewall exception, but it still would not update. So I uninstalled it, and then reinstalled. During reinstallation, the wizard noted that the /ProgramFiles/mbam folder already existed. Thinking that it had simply not been deleted, I checked to make sure it was empty... and it isn't. The only thing in there is a file called gitUsucka.exe.

Naturally, that struck me as odd. I could find no reference to this filename anywhere -- such as at experts-exchange or here, or even in a Google search -- which also seems odd.

Anyhow, I renamed the original mbam folder (leaving the gitUsucka file in there), and then proceeded with my mbam install, updated the new mbam, and scanned the laptop. The log file showed no malicious items were found on the computer.

Anyone ever see this gitUsucka.exe file before? I have no idea what it is, or why it would be in the mbam program folder. The file icon associated with it, by the way, is the mbam icon.

[Serj96o]

Hello.

Could you please upload the file gitUsucka.exe?

Did you tried to reboot your PC after Malwarebytes' Anti-Malware Uninstall?

[Galileo7]

Hello.

Could you please upload the file gitUsucka.exe?

Did you tried to reboot your PC after Malwarebytes' Anti-Malware Uninstall?

I'll attach the file to this post (in zip, since I can't attach exe).

Yes, I think I did reboot after the uninstall and before the re-install.

gitUsucka.zip

[Serj96o]

Ok.A forum member will take look at the file.

[Serj96o]

Ok.Well,try this steps:

1.Uninstall Malwarebytes' Anti-Malware.

2.Reboot PC.

3.If the Folder is still in Program Files,then delete it.

4.Download Ccleaner(to cleanup shortcuts and invalid files):

http://www.filehippo.com/download_ccleaner

-Run Ccleaner

5.Download the latest version of Malwarebytes' Anti-Malware and install it.

Tell me the results

[Guest name cool]

Please, attach a screenshot of the location of the file.

Or, type the path of the file.

.......................................

M' Anti-M Free use. XP SP 3

:::::::::::::::::::::::::::::::

[shadowwar]

This file was a renamed version 1.30 of our exectutable file. A VERY old version.

http://www.virustotal.com/file-scan/report...076f-1293881059

[Galileo7]

This file was a renamed version 1.30 of our exectutable file. A VERY old version.

http://www.virustotal.com/file-scan/report...076f-1293881059

Well... that seems like it would solve the mystery, eh? How old is VERY old, by the way? I don't recall installing on older version than the one I just UNinstalled.

[shadowwar]

Well... that seems like it would solve the mystery, eh? How old is VERY old, by the way? I don't recall installing on older version than the one I just UNinstalled.

This is from the sigcheck function under the show all button on VT

sigcheck:

publisher....: Malwarebytes Corporation

copyright....: © Malwarebytes Corporation. All rights reserved.

product......: Malwarebytes_ Anti-Malware

description..: Malwarebytes_ Anti-Malware

original name: mbam.exe

internal name: mbam

file version.: 1.30

comments.....: Malwarebytes_ Anti-Malware

signers......: Malwarebytes

UTN-USERFirst-Object

signing date.: 10:10 PM 10/22/2008

verified.....: -

[Galileo7]

Wow, thank you very much. I'm just going to delete it, then. Perhaps the prior owner of the laptop had installed that version.

By the way, I was unaware of the VT site. Thanks for that as well!

[shadowwar]

Its very good for suspect files like this instance.. Get multiple opinions from mulitple AV's. Very important to hit the showall button. Give you an idea when it was first submitted, latest scan etc. Lot of good information there.