False Positive: RSGUIProvider.exe

[techron]

I have found a false positive that I would like to report. Below is the copy of the scan, ran in developer mode.

The file in question is part of the Symantec Endpoint Encryption product. It’s default location is:

c:\program files\Symantec\symantec endpoint encryption clients\rsguiprovider.exe

Log:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8077

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

11/3/2011 1:28:34 PM

mbam-log-2011-11-03 (13-28-20).txt

Scan type: Quick scan

Objects scanned: 166311

Time elapsed: 3 minute(s), 43 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

c:\program files\Symantec\symantec endpoint encryption clients\rsguiprovider.exe (Trojan.Apppatch) -> 1292 -> No action taken. [89044ed15ea252ae3bc4912ad03031cf]

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowCpl\1 (Malware.Trace) -> Value: 1 -> No action taken. [a8e559c6f60a5ca47964a3bd37cd3bc5]

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\program files\Symantec\symantec endpoint encryption clients\rsguiprovider.exe (Trojan.Apppatch) -> No action taken. [89044ed15ea252ae3bc4912ad03031cf]

___________________________________

The file in question in also attached in a zip format.

RSGUIProvider.zip

[sUBs]

Thank you for reporting this. It shall be fixed in the next update.

[shadowwar]

This will be fixed in the next update.

Thanks for reporting!

[techron]

WOW! - that was quick. I pulled a test machine to see what would happen if the file were to be deleted by MWB, and by the time I scanned again to remove it, you had already changed the definitions and put out a new version. That was less than 10 minutes! You guys are on the ball...Thanks!