why is sardu.exe still a false positive

[jimnw]

why is sardu.exe still a false positive? this was supposed to be fixed in Jan. '10.

[MAM]

That was, in the past that is fixt now.

A older report from MBAM.

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

i:\sardu_rescue dvd\sardu_2.0.3_beta5\sardu.exe (Trojan.Agent) -> No action taken.

i:\system volume information\_restore{0102ad5b-dcc9-49c2-b7d1-11c730d52c94}\RP287\A0152664.exe (Trojan.Agent) -> No action taken.

And the second one, i think that was also a f/p ???!!!

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 7138

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

14.07.2011 19:13:44

mbam-log-2011-07-14 (19-13-44).txt

Scan type: Quick scan

Objects scanned: 47

Time elapsed: 10 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 7138

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

14.07.2011 19:13:44

mbam-log-2011-07-14 (19-13-44).txt

Scan type: Quick scan

Objects scanned: 47

Time elapsed: 10 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

The sardu issue is definitely a f/p by Malwarebytes' Anti-Malware, if more available !!!

And the result´s, from virustotal.com, ---> http://www.virustotal.com/file-scan/report.html?id=2fb2544b51c05255216e7325c103370a4f71dd3a613fd3918c70d2d40cb8e53b-1310663420

MAM

[MAM]

Ok, i see that is a New version from the sardu.exe, the result´s from virustotal.com is diffrent.

http://www.virustotal.com/file-scan/report.html?id=aa40269864e59906749e3e6677745d04ca823127111b52bd87481ab50999fe0a-1310665416

This is also a f/p, from the diffrent Av vendors !!!

Ok will check it now with Malwarebytes' Anti-Malware....

Ok, i see it now that is also a f/p by Malwarebytes' Anti-Malware, please fix it.

The Log from MBAM:

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 7139

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

14.07.2011 20:01:52

mbam-log-2011-07-14 (20-01-45).txt

Scan type: Quick scan

Objects scanned: 23

Time elapsed: 7 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

i:\200\sardu_2.0.3\sardu.exe (Trojan.Agent) -> No action taken.

MAM

[MAM]

Hello, is not fixed now yet, please make it.

Malwarebytes' Anti-Malware 1.51.1.1800

www.malwarebytes.org

Database version: 7140

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

14.07.2011 23:06:35

mbam-log-2011-07-14 (23-06-28).txt

Scan type: Quick scan

Objects scanned: 24

Time elapsed: 10 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

i:\200\sardu_2.0.3\sardu.exe (Trojan.Agent) -> No action taken.

MAM

[MAM]

This problem is solved.

Sorry, i am not the Tread starter, but i am answering nevertheless.

Malwarebytes' Anti-Malware 1.51.1.1800

www.malwarebytes.org

Database version: 7141

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

14.07.2011 23:32:45

mbam-log-2011-07-14 (23-32-45).txt

Scan type: Quick scan

Objects scanned: 24

Time elapsed: 4 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Regards MAM.

[shadowwar]

Yes this was confirmed a false positive and fixed in the most recent DB update.

Thanks for reporting!