J. L. Posted April 19, 2011 ID:418121 Share Posted April 19, 2011 There is no scan log, because it was detected on-execution, not during scanning.Here is the attached file. Please fix soon. Link to post Share on other sites More sharing options...
sUBs Posted April 19, 2011 ID:418123 Share Posted April 19, 2011 Hello, you forgot to attach the file. Link to post Share on other sites More sharing options...
J. L. Posted April 19, 2011 Author ID:418124 Share Posted April 19, 2011 Why can't I edit my thread post?Also, you should really just attach the file without having to click another button, especially after clicking post.CCEnhancer.zip Link to post Share on other sites More sharing options...
sUBs Posted April 19, 2011 ID:418127 Share Posted April 19, 2011 Thank you. It shall be fixed in the next update. Link to post Share on other sites More sharing options...
patrice33 Posted April 19, 2011 ID:418136 Share Posted April 19, 2011 (Trojan.MSIL.SD) ? Link to post Share on other sites More sharing options...
patrice33 Posted April 19, 2011 ID:418142 Share Posted April 19, 2011 False positive ? - meteo-fusion.exemeteo-fusion.rar Link to post Share on other sites More sharing options...
Barz Posted April 19, 2011 ID:418146 Share Posted April 19, 2011 Hi Mbytes,Got a threat detection on cdbxpp.exe when conducting a full scan. Have used this software before with no problems and have also scanned file with Microsoft Security Essentials which shows a clean filePlease adviseCheersmbam-log-2011-04-19 (12-59-29).rar Link to post Share on other sites More sharing options...
Stisfa Posted April 19, 2011 ID:418156 Share Posted April 19, 2011 Hello,First time poster, so I'm not entirely familiar with the MBAM culture, so please forgive me if I'm making a mistake here (I'm sleep deprived right now, as it's ~2 AM where I'm at).2011-04-07, I ran a full MBAM scan and had nothing infected.Yesterday (really, all but a few hours ago), I ran MBAM and had cdbxpp.exe flagged as infected.Now there are two variables I'm having to consider:I Updated MBAM Prior to Running the ScanI Went to ubuntugeek.comThe first is self-explanatory, but the second is where I'm concerned.Here are two links that have me disconcerted. The second one was a URL scan I submitted after reading a couple posts that referenced virustotal.com being an integral tool for diagnosing possible malware.http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=xivee.com/http://www.virustotal.com/url-scan/report.html?id=331fc433e5aa56018034842bbe8d7868-1303191262It was after I visited ubuntugeek.com that I decided to run MBAM. The thing was, I'm pretty sure everything would have been fine had I just left it alone when browsing w/Chrome, but I had to get adventurous. I decided I'd see if the same warning page from Google would pop-up when running Firefox 4. Well, it didn't. I didn't navigate to any links or stay on for very long in Firefox, but feeling a little paranoid, I ran a full scan with KIS 2010 after updating it. No infections found. Following that, I updated MBAM, ran a full scan and CDBurnerXP was flagged. Under the "Vendor" column there was "Trojan.MSIL.SD", with "C:\Program Files\CDBurnerXP\cdbxpp.exe" referenced as the "Item"; I right clicked it and went to "Vendor Information". This is the link I was routed to: http://www.malwarebytes.org/malwarenet.php?name=Trojan.MSIL.SD. As you can see, the message I received was "This entry no longer exists. Please contact our support team about this problem."I decided to do a Google search and found this on the MBAM Forums, so that's why I thought this might also be a False Positive with the new update, which I would have been fine with, had it not been for xivee.com (ubuntugeek.com - make no mistake, I'm not blaming ubuntugeek, I realize it's xivee.com that's the problem URL/URI). So, still feeling uncertain, I ran an MD5Sum Hash against the cdbxpp.exe and got this: 0373ba18fd585e102ce6af9d7e5ed152With this, I ran a query against VirusTotal and got this result: http://www.virustotal.com/file-scan/report.html?id=0e274ea5e7908fcfde94337e2095e0c6ad7e4d0c7eb703ebb99f12b066149906-1302273251. Other than the Anonymous comment flagging it for malware, there's no indication that it is; unfortunately, MD5 can be subverted quite easily, so I'm not entirely put at ease with this either. An hour or so ago, Kaspersky had another update, so I scanned "cdbxpp.exe" again and still had no malware issue; compared it to another MBAM scan and still had it recognized as malware (specifically targeted only "cdbxpp.exe" in both instances). Of course, that was me being naively hopeful, but I figured it was worth a shot.FYI, I've had CDBurnerXP since Tuesday, November 9, 2010. Downloaded from CNET, since all the downloads I've had from there have been safe, in my experience.Attached are both log files showing the difference in results (EDIT: couldn't upload earlier due to "forums.malwarebytes.org Driver Error". Tried to use "advanced uploader", but that didn't work either, database issue being cited as cause).Apologies for the long-winded post; just wanted to make sure that I was thorough in helping you diagnose the issue (there'd be a lot less reason to worry if I had just used Ubuntu to go to that site in the first place, doh!).mbam-log-2011-04-07 (19-55-47).txtmbam-log-2011-04-19 (00-23-32).txt Link to post Share on other sites More sharing options...
ptoye Posted April 19, 2011 ID:418157 Share Posted April 19, 2011 Title says it all, really.Here's one such file.Looking at some of the other posts it seems that MSIL.sd is being detected in a lot of programs.Textwriters.zip Link to post Share on other sites More sharing options...
sUBs Posted April 19, 2011 ID:418158 Share Posted April 19, 2011 Apologies. This is a false positive which shall be fixed in our next update. Link to post Share on other sites More sharing options...
sUBs Posted April 19, 2011 ID:418159 Share Posted April 19, 2011 To better keep track, I have merged all the topics here. Link to post Share on other sites More sharing options...
MikeW Posted April 19, 2011 ID:418161 Share Posted April 19, 2011 Also found in spellcheck anywhere Link to post Share on other sites More sharing options...
Stisfa Posted April 19, 2011 ID:418162 Share Posted April 19, 2011 To better keep track, I have merged all the topics here.Ok, so I'm not the only one with the same error; so I guess I'm being overly paranoid about the possible "Drive-By Download" from xivee.com?I know MBAM support isn't really meant to address this kind of issue, but if anybody has any personal experience they'd like to share, I'd really appreciate it.Sorry, it's just that I've never been infected on my personal box, especially since I take extra care to make sure I'm secure. Well, there's that and the fact that Andy Grove has helped to fortify my pessimistic imagination =P. Link to post Share on other sites More sharing options...
sUBs Posted April 19, 2011 ID:418168 Share Posted April 19, 2011 Hello, please update to database version: 6396Please let us know if we're still picking up those files. Link to post Share on other sites More sharing options...
RonHarris Posted April 19, 2011 ID:418171 Share Posted April 19, 2011 Hello, please update to database version: 6396Please let us know if we're still picking up those files.This seems to have fixed my problem - I was about to report iPhoneBrowser being reported as Trojan.MSIL.SD too, however the update fixed it. Link to post Share on other sites More sharing options...
cuth64 Posted April 19, 2011 ID:418178 Share Posted April 19, 2011 seagate seatools detected as Trojan.MSIL.SDmbam-log-2011-04-19 (19-52-27).txt Link to post Share on other sites More sharing options...
sUBs Posted April 19, 2011 ID:418179 Share Posted April 19, 2011 seagate seatools detected as Trojan.MSIL.SDHello, this was fixed earlier. Please update mbam and scan again. Link to post Share on other sites More sharing options...
MikeW Posted April 19, 2011 ID:418181 Share Posted April 19, 2011 Also found in spellcheck anywhereAll OK after defs update. Thanks Link to post Share on other sites More sharing options...
tedus987 Posted April 19, 2011 ID:418194 Share Posted April 19, 2011 i got two of the trojan.msil.SD. here are the attached files. there from a game i installed on my slave drive and i've been using them for 4 months so i can't see how this happens and how it just showed up now. here's the logMalwarebytes' Anti-Malware 1.50.1.1100www.malwarebytes.orgDatabase version: 6395Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.1870219/04/2011 12:32:39mbam-log-2011-04-19 (12-32-31).txtScan type: Full scan (C:\|E:\|G:\|)Objects scanned: 456075Time elapsed: 2 hour(s), 35 minute(s), 33 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 2Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:e:\installedgames\dragon age\dao-modmanager.exe (Trojan.MSIL.SD) -> No action taken.e:\installedgames\dragon age\propertygridex.dll (Trojan.MSIL.SD) -> No action taken.Dragon Age questionable files.rar Link to post Share on other sites More sharing options...
sUBs Posted April 19, 2011 ID:418199 Share Posted April 19, 2011 Database version: 6395Hello, you're using an older database. Please update and rescan. Link to post Share on other sites More sharing options...
tedus987 Posted April 19, 2011 ID:418201 Share Posted April 19, 2011 ok, updated to 6397 scanning now. Link to post Share on other sites More sharing options...
tedus987 Posted April 19, 2011 ID:418202 Share Posted April 19, 2011 ok, just did a scan of just those 2 files and now there clean, i wasn't sure before so i just ignored them, when i updated to 6397 i then un-ignored them i scanned them and therer now clean... odd. Link to post Share on other sites More sharing options...
b2gary Posted April 19, 2011 ID:418205 Share Posted April 19, 2011 Full scan found nothing yesterday, then I got an execution alert on bosonserialization.dll at some point during the night. Scanned the file with Norton and found nothing.Came up as Trojan.MSIL.SD, file attached (hope I did this right - just purchased the software and my first post).Bosonserializationdll.zip Link to post Share on other sites More sharing options...
sUBs Posted April 19, 2011 ID:418215 Share Posted April 19, 2011 Full scan found nothing yesterday, then I got an execution alert on bosonserialization.dll at some point during the night.Hello, please update and rescan with mbam again. Link to post Share on other sites More sharing options...
b2gary Posted April 19, 2011 ID:418219 Share Posted April 19, 2011 Updated, scanned again, all clear. Thank you very much for the support. Link to post Share on other sites More sharing options...
Recommended Posts