11 replies to this topic

[Doktor Notor]

Really no idea why's this detected, I have C:\Install directory on my drive where I do store lots of utils, what's wrong with that?

Malwarebytes' Anti-Malware 1.21
Verze databáze: 969
Windows 5.1.2600 Service Pack 3

Infikované soubory:
C:\Install (Rogue.Multiple) -> No action taken.

[nosirrah]

This is also the name of a folder that multiple rogues install out of .

If I whitelist this I am putting one person in front of many thousands that I am protecting .

If you would , please right click that entry and select ignore , it will never turn up in a scan again .

[Doktor Notor]

nosirrah, on Jul 20 2008, 03:41 PM, said:

This is also the name of a folder that multiple rogues install out of .
If I whitelist this I am putting one person in front of many thousands that I am protecting .

Shrug; it's just rather confusing - there's no risk in having C:\Install directory, it's the stuff in there that matters. I didn't assume this is intended to be detected, that's all...

[ihatespam]

Doktor Notor, on Jul 20 2008, 02:58 PM, said:

Shrug; it's just rather confusing - there's no risk in having C:\Install directory, it's the stuff in there that matters. I didn't assume this is intended to be detected, that's all...

I must admit I'm surprised by nosirrah's reply but will bow to his superior knowledge on the matter. If your directory contains utilities why not rename it C:\Utils?

[Doktor Notor]

ihatespam, on Jul 20 2008, 04:34 PM, said:

If your directory contains utilities why not rename it C:\Utils?

Well yeah, I can rename it to whatever else, that wasn't the point... I'm just surprised that such a horribly generic directory name triggers this... Maybe some better description of similar stuff instead of Rogue.Multiple would reduce the possible confusion.

[nosirrah]

Rogue.Multiple is the def for all rogue antispyware/antivirus components that belong to more than one rogue application .

It is designed to remove the confusion between multiple rogue families . There are some rogues that have parts for 3 or more rogues and having defs like that would generate what looked like 3 completely different infections at the same time all the while there was only one .

This generic def is a big hammer that prevents the installation of an entire rogue family as every single installer jumps from temp to %ROOTDRIVE%\Install and then installs .

I do not like adding these and remove them once we no longer need them for protection but for now it is doing a lot of good .

[GT500]

nosirrah, on Jul 20 2008, 09:41 AM, said:

If I whitelist this I am putting one person in front of many thousands that I am protecting .

If you always detect it, then you are detecting and removing the installers for CompuCom's applications and drivers in their base image. CompuCom is not the only company that uses such a directory in the root of C: to store applications and drivers, so you are making it hard for Malwarebytes to score corporate contracts by always detecting that directory as malware. There either needs to be more advanced checks to determine if the software in this directory is safe, or you need to remove it from defs.

[elero]

If my girlfriend runs malwarebytes anti-malware she will delete this directory. I would remove this database entry, it could make a lot of problems

[JeanInMontana]

ght, on Aug 5 2008, 01:38 AM, said:

If my girlfriend runs malwarebytes anti-malware she will delete this directory. I would remove this database entry, it could make a lot of problems

Use the whitelist and no problems.

[nosirrah]

http://www.malwareby...?showtopic=5612

Enough is enough , it is gone .

I am also no longer seeing the rogues using it so removing it should not cause a problem .

[elero]

Thank you guys

[GT500]

nosirrah said:

I am also no longer seeing the rogues using it so removing it should not cause a problem .

That's good. They probably figured out that since many of them were doing it, that it was too easy to block the install.