Is it a false positive?

[dafmat71]

avp.exe is Kaspersky!!

mbam-log-2011-05-28 (15-18-32).txt

[melboy]

Hi

No, this is not a false positive.

Malware can use this technique to load it's own executables.

http://blogs.mcafee.com/mcafee-labs/image-file-execution-options

Here's one example of malware using that.

http://www.threatexpert.com/report.aspx?md5=a527f6279d441cfc0d11cccd3ce82883

Installs a default debugger that is injected into the execution sequence of a target application. If a threat is installed as a default debugger, it will be run every time a target application is attempted to be launched - either to mimic it and hide its own presence (e.g. an open port or a running process), or simply to be activated as often as possible.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe]

Debugger = ""%UserProfile%\%UserName%1\winlogon.exe""

so that winlogon.exe is injected into the execution sequence of avp.exe by being installed as its default debugger

[dafmat71]

Hi

No, this is not a false positive.

Malware can use this technique to load it's own executables.

http://blogs.mcafee....ecution-options

Here's one example of malware using that.

http://www.threatexp...d11cccd3ce82883

OK mate, thx bu what must i do: only delete the registry key?

[dafmat71]

ok, i've delete it, but....on each restart it come back!!

[melboy]

Edited. Possible FP.

[melboy]

Hi

http://forums.malwarebytes.org/index.php?showtopic=85807

I see you've posted another topic concerning this in the false Positives section. As you appear to be Beta testing Kaspersky please wait for a verdict by Malwarebytes staff in the above topic.

[dafmat71]

Hi

No, this is not a false positive.

Malware can use this technique to load it's own executables.

http://blogs.mcafee....ecution-options

Here's one example of malware using that.

http://www.threatexp...d11cccd3ce82883

See here mate: http://forum.kaspersky.com/index.php?showtopic=208492&st=40&gopid=1665147entry1665147

[shadowwar]

Yes verified.

New database is up with this fixed.

Thanks for reporting.

[dafmat71]

Yes verified.

New database is up with this fixed.

Thanks for reporting.

thx a lot mate!!