12 replies to this topic

[darthsideous666]

I am getting "Faked.Dropped.Malware" during my scans with MBAM paid. The problem is that neither Kaspersky or SAS Pro are alerting to it and when I ran MBAM in the Developer Mode it did not show up either, the scan was clean? I cannot find the path in regedit either. What do you think?


Malwarebytes' Anti-Malware 1.11
Database version: 707

Scan type: Quick Scan
Objects scanned: 33163
Time elapsed: 5 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\services (Fake.Dropped.Malware) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[nosirrah]

Fake.Dropped.Malware are what fake antispyware applicatiosn drop to find with their fake scans .

These are not actually malware (why they are not detected by real scanners usually) .

After further research it does seem that this key can also sometimes be used for legit purposes so I am removing it from definitions .

Next update will have this resolved .

[darthsideous666]

nosirrah, on May 2 2008, 08:03 AM, said:

Fake.Dropped.Malware are what fake antispyware applicatiosn drop to find with their fake scans .

These are not actually malware (why they are not detected by real scanners usually) .

After further research it does seem that this key can also sometimes be used for legit purposes so I am removing it from definitions .

Next update will have this resolved .

Just out of curiosity, why is it that the developer mode did not show this when I ran it? It is actually the second time that I ran a scan with it and this has occurred.

ds

[nosirrah]

That technically should not happen .

All dev mode does is show the def line that hits .

[Cordialis]

I just had one of those Fake.Dropped.Malware and MBAM stopped it. That I find to be a very good thing because I have not downloaded anything that could have left such a file. I'm almost sure that this my newest piece malware is not so fake after all!

Spec's: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7e853d72-626a-48ec-a868-ba8d5e23e045} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

[RubbeR DuckY]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7e853d72-626a-48ec-a868-ba8d5e23e045} (Fake.Dropped.Malware)

This is a false positive. It is not malware. Please restore it from quarantine and I will have it fixed shortly .

[AdvancedSetup]

Thanks RD

I'm assuming this is similar/same.


Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{7e853d72-626a-48ec-a868-ba8d5e23e045} (Fake.Dropped.Malware) -> No action taken.
Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.

[RubbeR DuckY]

Quote

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{7e853d72-626a-48ec-a868-ba8d5e23e045} (Fake.Dropped.Malware) -> No action taken.

This has been fixed.

Quote

Registry Data Items Infected:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.

This can be used for malicious intentions. You can add it to the ignore list.

[Eric the Red]

RubbeR DuckY, on Jun 9 2008, 10:03 PM, said:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7e853d72-626a-48ec-a868-ba8d5e23e045} (Fake.Dropped.Malware)

This is a false positive. It is not malware. Please restore it from quarantine and I will have it fixed shortly .

I can confirm that db update #844 no longer flags this one. Thanks Bruce

[Cordialis]

Ok, thanks guys. I believe that I've already deleted it but I'll see what I can do. I hope it's not important...

[Raid]

Cordialis, on Jun 10 2008, 02:29 PM, said:

Ok, thanks guys. I believe that I've already deleted it but I'll see what I can do. I hope it's not important...

I noticed in the logfile that v1.11 was being used. v1.16 is out now, and you should upgrade.

[Cordialis]

Raid, on Jun 10 2008, 06:58 PM, said:

I noticed in the logfile that v1.11 was being used. v1.16 is out now, and you should upgrade.

No, - I'm not the one who made the start post. My version is updated. But thanks for your thoughtfulness. That was a kind move.

[Cordialis]

I had to choose when MBAM found this malware - should I start an ego-trip-thread or should I stick to the Fake.Dropped.Malware thread that was already here? I ended up writing in this one. It seemed like a good idea at the time...