DoyleFrank Posted January 21, 2011 ID:377524 Share Posted January 21, 2011 Hi,After fresh installing my PC, the only thing I did was adding Noscript, Adblock and Downloadhelper to Firefox. MB found Trojan.ZBot in Kaspersky's Sandbox Folder. Wasnt possible to attach the supposed file - .autoreg. Never had any Problems with MB and Kaspersky's Sandbox or AddOns. Is it a false positive? Thanks for your help!Malwarebytes' Anti-Malware 1.50.1.1100www.malwarebytes.orgDatenbank Version: 5565Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.1870221.01.2011 17:03:44mbam-log-2011-01-21 (17-03-39).txtArt des Suchlaufs: Vollst Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 21, 2011 Staff ID:377595 Share Posted January 21, 2011 I am unable to duplicate this here. Link to post Share on other sites More sharing options...
DoyleFrank Posted January 22, 2011 Author ID:377791 Share Posted January 22, 2011 After deinstalling Noscript and scanning again, the log is clean. So it has something to do with Noscript. Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 22, 2011 Staff ID:377809 Share Posted January 22, 2011 Normal noscript install doesnt trigger here. Are you scanning the files from outside of the sandbox with Malwarebytes? Link to post Share on other sites More sharing options...
DoyleFrank Posted January 22, 2011 Author ID:377979 Share Posted January 22, 2011 Yes, Malwarebytes is started outside the sandbox with admin rights. The Firefox-AddOns were installed on another restricted account, while running inside the sandbox. All the Add-On content is saved inside the Kaspersky Sandbox. Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 23, 2011 Staff ID:378041 Share Posted January 23, 2011 This has to be Kaspersky blocking the file from being scanned. Did you have any exceptions added in kaspersky or mbam before that maybe you forgot to put back in after the fresh install. With the amount of people that use no script and in a normal windows enviroment i can't duplicate it then it has to be something with kaspersky and the way it protects the files inside the sandbox. You might be better off with support in The general forum with this.These files that you are scanning are virtualized because of the sandbox so they probably arent really accessible in a normal sense. Link to post Share on other sites More sharing options...
DoyleFrank Posted January 25, 2011 Author ID:379379 Share Posted January 25, 2011 Thank you very much for your response. Youre probably right, it has to be something with Kaspersky's sandbox. Its intreresting though, that MB itentifies this problem as Trojan.Zbot. Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 25, 2011 Staff ID:379416 Share Posted January 25, 2011 When i get caught up i will see if i can duplicate this with the kaspersky trial. Being it's a sandbox its probably safe to add that path to the ignore list.Can you tell me what version of kaspersky and noscript so i can duplicate this.. Any other info that i would need also. Link to post Share on other sites More sharing options...
daledoc1 Posted January 25, 2011 ID:379462 Share Posted January 25, 2011 Can't reproduce it here, either.System specs are below, KIS is current build (11.0.2.556 (a.b.c), FF 3.6.13, NoScript 2.0.9.6.I don't use Safe Run for routine browsing, and I do clear the Safe Run folder quite often (usually at the end of every session).Regards,daledoc1 Link to post Share on other sites More sharing options...
exile360 Posted January 28, 2011 ID:380610 Share Posted January 28, 2011 Greetings DoyleFrank Please follow the instructions posted here so that I can find out exactly what definition is detecting this as that will help us to replicate the problem and get it resolved.Thanks Link to post Share on other sites More sharing options...
DoyleFrank Posted January 29, 2011 Author ID:381100 Share Posted January 29, 2011 I did a fresh install 2 days ago, and didnt add Noscript to Firefox. When adding Noscript, ill do it outside the sandbox this time. Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 30, 2011 Staff ID:381353 Share Posted January 30, 2011 We may have found the issue. Can you please update to 5637 or on when its released.. Reinstall noscript and let me know if its still detected Link to post Share on other sites More sharing options...
DoyleFrank Posted January 30, 2011 Author ID:381607 Share Posted January 30, 2011 I did the same as last time, added Noscript while running Firefox in KAV's Sandbox - the log is clean this time, nothing was found! Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 30, 2011 Staff ID:381618 Share Posted January 30, 2011 Thanks!Please let me know if this changes! Link to post Share on other sites More sharing options...
DoyleFrank Posted January 31, 2011 Author ID:382181 Share Posted January 31, 2011 I will, thank you for your great support! Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 31, 2011 Staff ID:382284 Share Posted January 31, 2011 Thanks for reporting and sticking with us.. This wasn't a general run of the mill false positive so took the collective minds to figure out especially since we couldnt duplicate it on this end Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now