Jump to content

Malwarebytes

trojan help


10 replies to this topic

#1
beck

    New Member

  • Members
  • Pip
  • 47 posts
  • Location:MN, USA
Just ran a scan with version 1.34 and it found c:\windows\system32\ENCAPI32.dll.

What is it? I quarantined it, but should I remove it?
thanks.

#2
AdvancedSetup

    Forum Deity

  • Administrators
  • PipPipPipPipPipPip
  • 22,575 posts
  • Gender:Male
  • Location:US
It may be a false positive. Please restore the file or don't quarantine it yet, and upload the file here and we'll take a look.

Please start a new post there and put a link back to this post.

The file may be part of Microsoft Encarta, but it could also be infected. If you upload it then we can check on it.
You may have to zip the file up first though.
Ron Lewis
Manager, Online Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

If you've posted to the HJT forum and it has been over 5 days without a response please send a Private Message asking for assistance.

#3
beck

    New Member

  • Members
  • Pip
  • 47 posts
  • Location:MN, USA

View PostAdvancedSetup, on Feb 11 2009, 02:08 PM, said:

It may be a false positive. Please restore the file or don't quarantine it yet, and upload the file here and we'll take a look.

Please start a new post there and put a link back to this post.

The file may be part of Microsoft Encarta, but it could also be infected. If you upload it then we can check on it.
You may have to zip the file up first though.

It can't be Encarta and "I'm not permitted to upload."

#4
beck

    New Member

  • Members
  • Pip
  • 47 posts
  • Location:MN, USA

View Postbeck, on Feb 11 2009, 02:15 PM, said:

It can't be Encarta and "I'm not permitted to upload."


Also, I had just scanned with 1.33 a couple of hours prior and it showed nothing.

#5
beck

    New Member

  • Members
  • Pip
  • 47 posts
  • Location:MN, USA

View Postbeck, on Feb 11 2009, 02:25 PM, said:

Also, I had just scanned with 1.33 a couple of hours prior and it showed nothing.

Well, you're right. Under properties it says encarta, but I don't have Encarta, what gives? should I just quarantine it for a while and see how it goes or delete?
Strange it was created right around the time I scanned with 1.34.

#6
beck

    New Member

  • Members
  • Pip
  • 47 posts
  • Location:MN, USA
And, it doesn't show up if I just scan the file by itself in windows explorer, only on a quick scan. I haven't tried a full scan,

#7
beck

    New Member

  • Members
  • Pip
  • 47 posts
  • Location:MN, USA
Problem solved, maybe. I restarted the system and ran another quick scan and it showed nothing! The quick scan took longer than the previous ones. So, a restart is in order after updating to 1.34?
Mybe I should have uninstalled 1.33 and installed 1.34?

I'm using Win XP Home SP3.

#8
beck

    New Member

  • Members
  • Pip
  • 47 posts
  • Location:MN, USA

View Postbeck, on Feb 11 2009, 03:25 PM, said:

Problem solved, maybe. I restarted the system and ran another quick scan and it showed nothing! The quick scan took longer than the previous ones. So, a restart is in order after updating to 1.34?
Mybe I should have uninstalled 1.33 and installed 1.34?

I'm using Win XP Home SP3 and the free version of MBAM


#9
beck

    New Member

  • Members
  • Pip
  • 47 posts
  • Location:MN, USA
Nope, I guess not. Just ran a scan on my other computer and had the same thing.
Must be a FP?
I don't know what's going on.

#10
AdvancedSetup

    Forum Deity

  • Administrators
  • PipPipPipPipPipPip
  • 22,575 posts
  • Gender:Male
  • Location:US
You need to check for Definition updates for sure. If it is a False Positive that's where and how they get corrected.
Go to the UPDATE tab and click on UPDATE please then do another scan and see if it's still there.
Ron Lewis
Manager, Online Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

If you've posted to the HJT forum and it has been over 5 days without a response please send a Private Message asking for assistance.

#11
beck

    New Member

  • Members
  • Pip
  • 47 posts
  • Location:MN, USA
Well, after an uninstall and reinstall and the latest data base, no problem. ??





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

Follow Us