9 replies to this topic

[gdiloren]

C:/Windows/ACER_NORMAL/Install_Flash_Player_9_AX_9.0.28.0.exe, a 1.12 Mo file should be a FP, detected since the 2008-08-15 definitions

[RubbeR DuckY]

Can you please ZIP and attach this file.

[labougie]

Hi,

First, sorry to enter in your post.

I'm in the same case of gdiloren.

Exactly in the file name
Fichier(s) infecté(s):
c:\Windows\acer_normal\Install_Flash_Player_9_AX_9.0.28.0.exe (BHO.Baidu) -> No action taken.

here is my windows file system
Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1066
Windows 6.0.6001 Service Pack 1

23:32:01 18/08/2008
mbam-log-08-18-2008 (23-31-29).txt

is it possible that file is a false positif, cause i'm in France, and the probality ta have the same infected file in the same file is null.
I am ok to send you the bad file but his weight is 1149 ko and tha maw upload is 500 ko.

thanks a lot to answer me asap.
sincerely yours,
Labougie

[nosirrah]

Please zip and attach a copy of the file and we can check for sure .

[labougie]

Hi Nosirrah,

i've cut the file with winrar in three parts but the upload is not permitted, give me a tip to do it correctly.

thanks a lot,

here is the mistake "" Upload failed. You are not permitted to upload this type of file ""

Labougie

[nosirrah]

Upload the sample here (but in one part) :

http://uploads.malwarebytes.org/

Rename the rar (or whatever you use to compress) to DUSTIN_DONT_DELETE_FP.rar

[labougie]

Hi nosirrah,

i've upload the file to your link without problem, the name is "" DUSTIN_DONT_DELETE_FP.rar ""

in a second time i've checked my computer with the advice of "" Le sioux "", ( french computer forum tips against viruses and so on ) , with http://secunia.com/software_inspector/

my computer is up todate.

so, is i've this file in this place i think it comes from my last restore in june 08.
This file c\windows\acernormal was created in the same time, that the reason why i have this mistake.
i hope the upload help you to find and solve " the false positve ", i think so.

in my case i destroy that bad file cause i'm up todate.

thanks a lot,

i follow this post till you check the upload

bye
Labougie,

[Raid]

Confirmed fp,removed. Please update your defs.

[labougie]

Hi Raid,

when i've done my check-up i was up todated.

sorry i am not sure to understand you well. "" Confirmed fp,removed ""

That is to say that was a false positive Yes / No

Bye
Labougie,

[Raid]

labougie, on Aug 21 2008, 03:00 PM, said:

Hi Raid,

when i've done my check-up i was up todated.

sorry i am not sure to understand you well. "" Confirmed fp,removed ""

That is to say that was a false positive Yes / No

Bye
Labougie,

Yes sir, it's a confirmed FP and has been removed. Apologies for any inconvenience it may have caused.