Heuristics.Reserved.Word.Exploit

[whatnext?]

Hi -- My computer (Windows XP Pro, SP2) is acting normal, but I am trying to make sure it is clean before adding SP3.

I just ran the Malwarebytes Anti-malware scan for the first time ever, and it found 1 infection:

Vendor: Heuristics.Reserved.Word.Exploit, Name: C:\WINDOWS\system32\smss.TMP

I am wondering if I should remove it, or if it is a false positive.

(When I searched the forums here, I found this post about a FP:

http://www.malwarebytes.org/forums/index.p...ed.word.exploit .

And also, earlier today, I had a different FP result when running a2 free, and after posting at the a2 forum, I was advised to un-quarantined it. So I am now a little slower to act on alerts.)

I saved the logfile, and will paste it below. I also ran a HJT log, and can post that, if you want me to.

Thank you very much.

---------LOG FILE----------

Malwarebytes' Anti-Malware 1.30

Database version: 1423

Windows 5.1.2600 Service Pack 2

11/25/2008 7:26:23 PM

mbam-log-2008-11-25 (19-26-12).txt

Scan type: Full Scan (C:\|)

Objects scanned: 286082

Time elapsed: 1 hour(s), 42 minute(s), 2 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\smss.TMP (Heuristics.Reserved.Word.Exploit) -> No action taken.

[whatnext?]

Update -- I submitted the supposedly infected file, smss.TMP, to jotti.org's online virus scan.

Every one of the scanners employed said the file was clean.

So I will post a link to this thread in the False Positive forum.