Guest Seagull Posted June 14, 2012 ID:560313 Share Posted June 14, 2012 Malwarebytes just updated to the latest version and ran a flash scan and said a Legitimate Windows Registry Key was a Trojan.Agent.Log is attached. Malwarebytes PRO version 1.61.0.1400 update version v2012.06.14.01.Thank you. Link to post Share on other sites More sharing options...
DarkSnakeKobra Posted June 14, 2012 ID:560314 Share Posted June 14, 2012 I got the same thing.Edit: Developer logMalwarebytes Anti-Malware (PRO) 1.61.0.1400www.malwarebytes.orgDatabase version: v2012.06.14.01Windows 7 Service Pack 1 x64 NTFSInternet Explorer 9.0.8112.16421DarkSnake-Kobra :: XPS17 [administrator]Protection: Enabled6/13/2012 8:02:00 PMmbam-log-2012-06-13 (20-02-13).txtScan type: Flash scanScan options enabled: Memory | Startup | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: Registry | File System | P2PObjects scanned: 184644Time elapsed: 6 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 1HKCU\Software\Microsoft\Windows\CurrentVersion\Run (Trojan.Agent) -> No action taken. [4693797abba191a5c6083e21ca3a936d]Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end) Link to post Share on other sites More sharing options...
ottchris Posted June 14, 2012 ID:560317 Share Posted June 14, 2012 Malwarebytes just updated to the latest version and ran a flash scan and said a Legitimate Windows Registry Key was a Trojan.Agent.Log is attached. Malwarebytes PRO version 1.61.0.1400 update version v2012.06.14.01.Thank you.I can confirm that deleting/quarantining said registry key stops various applications running, or at least automatically running after reboot! :-( Fortunately restoring the key resolves the situation.Regards to All,Chris Link to post Share on other sites More sharing options...
turtledove Posted June 14, 2012 ID:560320 Share Posted June 14, 2012 I have the same also.Same update version.mbam-log-2012-06-13 (18-30-56).txt Link to post Share on other sites More sharing options...
Hardhead Posted June 14, 2012 ID:560322 Share Posted June 14, 2012 This False positive deletes the Windows sidebar.I would would look for a fix soon.Malwarebytes Anti-Malware (PRO) 1.61.0.1400www.malwarebytes.orgDatabase version: v2012.06.14.01Windows Vista Service Pack 2 x64 NTFSInternet Explorer 9.0.8112.16421Hardhead 5 :: OWNER-PC [administrator]Protection: Enabled6/13/2012 9:39:39 PMmbam-log-2012-06-13 (21-39-39).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2PScan options disabled:Objects scanned: 223244Time elapsed: 3 minute(s), 17 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 1HKCU\Software\Microsoft\Windows\CurrentVersion\Run (Trojan.Agent) -> Quarantined and deleted successfully.Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end) Link to post Share on other sites More sharing options...
Hardhead Posted June 14, 2012 ID:560326 Share Posted June 14, 2012 I forgot to add the developer mode scan.Posted below:Malwarebytes Anti-Malware (PRO) 1.61.0.1400www.malwarebytes.orgDatabase version: v2012.06.14.01Windows Vista Service Pack 2 x64 NTFSInternet Explorer 9.0.8112.16421Hardhead 5 :: OWNER-PC [administrator]Protection: Enabled6/13/2012 10:07:01 PMmbam-log-2012-06-13 (22-07-01).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2PScan options disabled:Objects scanned: 223308Time elapsed: 3 minute(s), 11 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 1HKCU\Software\Microsoft\Windows\CurrentVersion\Run (Trojan.Agent) -> Quarantined and deleted successfully. [8d4c0be82f2de155bb13b0af08fc7090]Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end) Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 14, 2012 Root Admin ID:560329 Share Posted June 14, 2012 Thank you for the report. Our Research Team is looking into it now. Link to post Share on other sites More sharing options...
nosirrah Posted June 14, 2012 ID:560331 Share Posted June 14, 2012 I am really sorry about this guys. If you update and check again this should be fixed. Link to post Share on other sites More sharing options...
Hardhead Posted June 14, 2012 ID:560332 Share Posted June 14, 2012 My pleasure. Link to post Share on other sites More sharing options...
Guest Seagull Posted June 14, 2012 ID:560334 Share Posted June 14, 2012 Thank you, and your welcome. I can confirm, after updating and running a flash scan, this Registry Key is no longer being flagged.Thanks again Malwarebytes Team. Link to post Share on other sites More sharing options...
DarkSnakeKobra Posted June 14, 2012 ID:560335 Share Posted June 14, 2012 No longer detected after latest update. Thanks again Malwarebytes' . Link to post Share on other sites More sharing options...
Hardhead Posted June 14, 2012 ID:560338 Share Posted June 14, 2012 Thank you Bruce,Windows sidebar is now back. Link to post Share on other sites More sharing options...
wildman424 Posted June 14, 2012 ID:560348 Share Posted June 14, 2012 I'm still getting a trojan.agent detection for the run key under HKCU. Its empty there's nothing there. The only thing I had there was the startup key for Sandboxie, which was removed the first time it was detected.Edit: Fp seems fixed now, Thanks Link to post Share on other sites More sharing options...
Henrilaconte Posted June 14, 2012 ID:560365 Share Posted June 14, 2012 Sames Issue this day: see result.Log attached:Versions: 1.61.0.1400Please fixThanksmbam-log-2012-06-14 (05-55-24).txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 14, 2012 Root Admin ID:560366 Share Posted June 14, 2012 Sames Issue this day: see result.Log attached:Versions: 1.61.0.1400Please fixThanksI don't see any detection in your log HenrilaconteMalwarebytes Anti-Malware (PRO) 1.61.0.1400www.malwarebytes.orgDatabaseversie: v2012.06.14.03Windows 7 Service Pack 1 x64 NTFSInternet Explorer 9.0.8112.16421H.W. van Berkum :: HWVANBERKUM-PC [administrator]Realtime bescherming: Ingeschakeld14-06-2012 05:55:24mbam-log-2012-06-14 (05-55-24).txtScantype: Flash-scanIngeschakelde scanopties: Geheugen | Opstartitems | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUMUitgeschakelde scanopties: Register | Bestanden en mappen | P2PObjecten gescand: 153118Verstreken tijd: 29 seconde(n)Geheugenprocessen gedetecteerd: 0(Geen kwaadaardige objecten gedetecteerd)Geheugenmodulen gedetecteerd: 0(Geen kwaadaardige objecten gedetecteerd)Registersleutels gedetecteerd: 0(Geen kwaadaardige objecten gedetecteerd)Registerwaarden gedetecteerd: 0(Geen kwaadaardige objecten gedetecteerd)Registerdata gedetecteerd: 0(Geen kwaadaardige objecten gedetecteerd)Mappen gedetecteerd: 0(Geen kwaadaardige objecten gedetecteerd)Bestanden gedetecteerd: 0(Geen kwaadaardige objecten gedetecteerd)(einde) Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 14, 2012 Root Admin ID:560367 Share Posted June 14, 2012 I'm still getting a trojan.agent detection for the run key under HKCU. Its empty there's nothing there. The only thing I had there was the startup key for Sandboxie, which was removed the first time it was detected.Edit: Fp seems fixed now, Thanks Latest version is: Database version: v2012.06.14.04Your code where shown was Database version: v2012.06.14.03Thanks Link to post Share on other sites More sharing options...
Phone Man Posted June 14, 2012 ID:560521 Share Posted June 14, 2012 Latest version is: Database version: v2012.06.14.04Your code where shown was Database version: v2012.06.14.03ThanksGot that on two systems with Database version v2012.6.14.1.v2012.6.14.2 fixed the false positive on both my systems.Jim Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now