5 replies to this topic

[Jason023]

Hi, all. I do scans with Malwarebytes regularly and this is the first infected file to come up.

Files Infected:
c:\program files\DivX\divx player\pS2Xx.ddc (Backdoor.Bot) -> Quarantined and deleted successfully.

I haven't restored the file to check when it was created, but the containing folder has been unmodified for over 2 years and everything else in it is just as old. I'm sure it's been that long since I've installed or used DivX Player, so that makes sense. It wasn't picked up until after I updated MBAM this week. Is it possible that this is a false positive and the file is just from an older, legitimate install?

Is it safe to restore the file and submit it to a site like virustotal?

[nosirrah]

Restore , update and scan again , I believe that this was already fixed .

[Jason023]

Thanks for the quick reply.
I updated to "Database version: 2500" and restored the file. It is still said to be infected.

Uploading to virustotal gives clean results. 0/41 (0.00%)

[nosirrah]

Please follow these instructions :

http://www.malwareby...?showtopic=3228

[Jason023]

nosirrah, on Jul 25 2009, 07:12 PM, said:

Please follow these instructions :

http://www.malwareby...?showtopic=3228

Malwarebytes' Anti-Malware 1.39
Database version: 2500
Windows 5.1.2600 Service Pack 2

7/25/2009 3:19:16 PM
mbam-log-2009-07-25 (15-19-12).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|H:\|I:\|J:\|K:\|)
Objects scanned: 226496
Time elapsed: 1 hour(s), 1 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\program files\DivX\divx player\pS2Xx.ddc (Backdoor.Bot) -> No action taken. [55385152424847304680807977747273850136808369777084840145856911]

[chimpy]

Was this checked out as a deffo FP?
I saw another thread about this and I inferred it was but can some one clarify?