false positive

[jonesliu]

We have developed one of the application software, but it was mistook to worm.

Our software works accurately with the other antivirus software,just as "OfficeScan" and "Trend Micro".

Can someone kindly to tell me how to judge the software to worm by "Malwarebytes' Anti-Malware"?

hope for your advice urgently!

The log is post,Please refer to the attachment

hope for your advice!

mbam-log-2006-01-01 (15-50-32).7z

[nosirrah]

Please zip and attach UPSMS.exe to your next post.

[jonesliu]

Please zip and attach UPSMS.exe to your next post.

hi:

thank your for your reply.

But the file of UPSMS.exe is more than 10MB. I cannot post it

[jonesliu]

Please zip and attach UPSMS.exe to your next post.

The size of Our software is more than 10M, Is there any other way to post the file?or can you kindly to download the installation document from the website as below:

http://support.dell.com/support/downloads/download.aspx?c=us&l=en&s=gen&releaseid=R276438&SystemID=PWE_2950&servicetag=&os=WNET&osl=en&deviceid=23061&devlib=0&typecnt=0&vercnt=3&catid=-1&impid=-1&formatcnt=0&libid=31&typeid=-1&dateid=-1&formatid=-1&source=-1&fileid=408115

[jonesliu]

hello, any update?

[AdvancedSetup]

Please send me a Private Message with a link to download from your site, or send it to some site like rapidshare or filesonic and I'll grab it from there to test.

Thank you.

[AdvancedSetup]

Please update the program and run another scan.

I'm using the latest database rules 6348 and a scan currently is not detecting the file UPSMS.exe for me.

This was YOUR scan and if you notice the DATE is way off. Please adjust the DATE and TIME to the correct date and time before scanning again.

Your Database version is also way off by 985 updates. Make sure you update MBAM to at least the current database of 6348 before scanning.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5363

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512

1/1/2006 3:50:39 PM

mbam-log-2006-01-01 (15-50-32).txt

Scan type: Quick scan

Objects scanned: 96751

Time elapsed: 35 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

c:\program files\Dell\upsmanagementsoftware\UPSMS.exe (Worm.P2P) -> 1840 -> No action taken. [e90a52c24db38878068d20a143c04eb2]

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UPSMS (Worm.P2P) -> Value: UPSMS -> No action taken. [e90a52c24db38878068d20a143c04eb2]

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\program files\Dell\upsmanagementsoftware\UPSMS.exe (Worm.P2P) -> No action taken. [e90a52c24db38878068d20a143c04eb2]

[jonesliu]

Hi:

I have update the database rules to 6349,and adjust the DATE and TIME to the correct date and time.

but the issue still exist.

please refer to the scanning result in detail:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6349

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

2011-4-13 18:37:22

mbam-log-2011-04-13 (18-37-13).txt

Scan type: Quick scan

Objects scanned: 138777

Time elapsed: 6 minute(s), 12 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 1

Files Infected: 1

Memory Processes Infected:

c:\program files\Dell\upsmanagementsoftware\UPSMS.exe (Worm.P2P) -> 3648 -> No action taken.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UPSMS (Worm.P2P) -> Value: UPSMS -> No action taken.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

c:\bthci.dll (Trojan.SpyEyes) -> No action taken.

Files Infected:

c:\program files\Dell\upsmanagementsoftware\UPSMS.exe (Worm.P2P) -> No action taken.

Please update the program and run another scan.

I'm using the latest database rules 6348 and a scan currently is not detecting the file UPSMS.exe for me.

This was YOUR scan and if you notice the DATE is way off. Please adjust the DATE and TIME to the correct date and time before scanning again.

Your Database version is also way off by 985 updates. Make sure you update MBAM to at least the current database of 6348 before scanning.

[shadowwar]

This will be fixed in the next update.

Thanks for reporting.