8 ArcSoft False Positives

[Sneakyone]

Hi,

I have come across these 8 false positives that are related to ArcSoft. ArcSoft is part of what I use as video recording software for my Hauppauge HD PVR.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5501

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

1/10/2011 11:35:59 PM

mbam-log-2011-01-10 (23-35-56).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 38374

Time elapsed: 8 minute(s), 23 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 8

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\program files (x86)\ArcSoft\totalmedia extreme\Codec\checkactivate.dll (Trojan.Hiloti) -> No action taken. [90ed38dd59a7926edc871a4933cd926e]

c:\program files (x86)\ArcSoft\totalmedia extreme\Codec\checkcommon.dll (Trojan.Hiloti) -> No action taken. [4b328f8628d8986870f397cc08f8e719]

c:\program files (x86)\ArcSoft\totalmedia extreme\digital theatre\Codec\checkactivate.dll (Trojan.Hiloti) -> No action taken. [2c51011406fa6799560d144fdb258d73]

c:\program files (x86)\ArcSoft\totalmedia extreme\digital theatre\Codec\checkcommon.dll (Trojan.Hiloti) -> No action taken. [295473a29e624eb2164d3f24a25e3ac6]

c:\program files (x86)\ArcSoft\totalmedia extreme\mediaconverter\mpeg_engine\checkactivate.dll (Trojan.Hiloti) -> No action taken. [a1dc080deb15aa56dc87b8ab3ec233cd]

c:\program files (x86)\ArcSoft\totalmedia extreme\mediaconverter\mpeg_engine\checkcommon.dll (Trojan.Hiloti) -> No action taken. [d5a8e62fdb25be425a09303304fc0bf5]

c:\program files (x86)\ArcSoft\totalmedia extreme\totalmedia studio mv\Codec\checkactivate.dll (Trojan.Hiloti) -> No action taken. [3c41fc195ea203fd372cbaa9df21ce32]

c:\program files (x86)\ArcSoft\totalmedia extreme\totalmedia studio mv\Codec\checkcommon.dll (Trojan.Hiloti) -> No action taken. [bebf64b10ef236ca184ba3c03fc14fb1]

Thanks,

Sneakyone

False_Positives.zip

[nosirrah]

Fixed in the next update.

[ParrotSlave]

Fixed in the next update.

Did you mean in the next program update or in the next definition update? I got 4 of the same false positives today, with MAB 1.50.1.1100, database version 5551:

Files Infected:

c:\program files (x86)\ArcSoft\mediaimpression 2\mpeg_engine\checkactivate.dll (Trojan.Hiloti) -> No action taken.

c:\program files (x86)\ArcSoft\mediaimpression 2\mpeg_engine\checkcommon.dll (Trojan.Hiloti) -> No action taken.

c:\program files (x86)\ArcSoft\mediaimpression hd edition\mpeg_engine\checkactivate.dll (Trojan.Hiloti) -> No action taken.

c:\program files (x86)\ArcSoft\mediaimpression hd edition\mpeg_engine\checkcommon.dll (Trojan.Hiloti) -> No action taken.

[shadowwar]

Can you please zip up those files and attach them here so we can get them fixed?

Thanks.

[ParrotSlave]

Can you please zip up those files and attach them here so we can get them fixed?

Thanks.

Actually, I was thinking this: if it was the version of MAB that was at fault, then it would have detected those files before, since the version was from mid-December, and my ArcSoft stuff is the same as it was. I usually scan with MAB once a week, after scanning with PCMatic. So that would mean that it would have to be a new definition, which doesn't make that much sense to me either, since the previous post suggests that MAB was aware of the issue several days ago. One thing that might be relevant is this: I don't use the ArcSoft software that much, but recently, due to the difficulty of manually uploading to Facebook--having to try a dozen times or more to get a video to upload--I started using MediaImpression to upload to FB, which I had never done before, and it worked flawlessly. I couldn't help but wonder if that activated something in the Arcsoft program that resulted in the false positive. ???

mbam_log_2011_01_16__13_56_13_.zip

[shadowwar]

This was fixed in the next database up after you reported. To fix the rest:

I cant verify or fix the f/p without the files themselves. I need for you to upload those files detected here so i can fix this for you. A log doesnt do me any good towards fixing this.

As we seem to have fixed 4 out of the 8 these 4 have to have something different about them.

Thanks.

[ParrotSlave]

I cant verify or fix the f/p without the files themselves. I need for you to upload those files detected here so i can fix this for you. A log doesnt do me any good towards fixing this.

As we seem to have fixed 4 out of the 8 these 4 have to have something different about them.

Thanks.

On my system, all the files, despite different file names, are 113,152 bytes, and they all have the same date modified, 6/26/09. Despite the fact that the four seem to be identical, I have zipped all four of them. The ones with (2) in the file name are from the MediaImpression 2 folder, while the other two are from the MediaImpression HD folder.

arcsoft_dll_files.zip

[nosirrah]

Fixed in the next update.