Tech Posted May 22, 2010 ID:254215 Share Posted May 22, 2010 Hello, I use MBAM for years... But now I decided to register and login.This is the second time I have problems with detection of a file that does not exist.I have tried to solve this problem (twice) with the help of Essexboy (an antimalware guru) in avast forums.What can I do more to help debbuging this as I'm quite confident this is a false positive.I have already rum OTL, OTM, Combofix and avast.External link to where I've discussed this: http://forum.avast.com/index.php?topic=59953 Link to post Share on other sites More sharing options...
Tech Posted May 24, 2010 Author ID:255220 Share Posted May 24, 2010 Can we bump?Any help related to this? Link to post Share on other sites More sharing options...
exile360 Posted May 24, 2010 ID:255375 Share Posted May 24, 2010 Greetings and welcome Please click on Start and select Run then type or copy/paste mbam /developer and run another Quick Scan and copy and paste the resulting log into your next reply.Thanks Link to post Share on other sites More sharing options...
Tech Posted May 25, 2010 Author ID:255671 Share Posted May 25, 2010 Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgVers Link to post Share on other sites More sharing options...
Tech Posted May 25, 2010 Author ID:256044 Share Posted May 25, 2010 Well, start to think if I'll recommend MBAM as I always did... I hate lack of support... Link to post Share on other sites More sharing options...
nosirrah Posted May 25, 2010 ID:256101 Share Posted May 25, 2010 What happens when you try to create a file by the same name ? Link to post Share on other sites More sharing options...
Tech Posted May 25, 2010 Author ID:256108 Share Posted May 25, 2010 What happens when you try to create a file by the same name ?The UAC is invoked and a file could be copied there without any "replace" warning.Thanks for following this. Link to post Share on other sites More sharing options...
Tech Posted May 25, 2010 Author ID:256115 Share Posted May 25, 2010 Things get messed...I can't delete that file. It's clean (http://www.virustotal.com/analisis/273f49ba639a0b208ce88224ff09ff4edc8ea5ac1690bdea8756cb9b705a1f3b-1274810862) but I can't delete or rename it... I can change the permissions either... Unlocker fails too. I'll try to boot... Link to post Share on other sites More sharing options...
Tech Posted May 25, 2010 Author ID:256122 Share Posted May 25, 2010 File get deleted on boot due to Unlocker.Now running another MBAM scanning. Link to post Share on other sites More sharing options...
Tech Posted May 25, 2010 Author ID:256133 Share Posted May 25, 2010 File is detected again Link to post Share on other sites More sharing options...
nosirrah Posted May 25, 2010 ID:256243 Share Posted May 25, 2010 I am going to have the code team check into this as this should not be possible . Link to post Share on other sites More sharing options...
Tech Posted May 26, 2010 Author ID:256360 Share Posted May 26, 2010 Many thanks for the support.Of course, feel free to ask me anything I could/need to do to follow this issue. Link to post Share on other sites More sharing options...
Tech Posted May 26, 2010 Author ID:256362 Share Posted May 26, 2010 Many thanks for the support.Of course, feel free to ask me anything I could/need to do to follow this issue. Link to post Share on other sites More sharing options...
Tech Posted May 26, 2010 Author ID:256989 Share Posted May 26, 2010 nosirrah, any news? Link to post Share on other sites More sharing options...
Tech Posted May 31, 2010 Author ID:259471 Share Posted May 31, 2010 I've restored a full partition image from 15 days ago.Only avast Internet Security was there (no Comodo Time Machine) and the detection persists with the latest virus database of MBAM.Any help? Should I give up? Link to post Share on other sites More sharing options...
exile360 Posted June 1, 2010 ID:259824 Share Posted June 1, 2010 This could be an issue with file/folder permissions. Please try the fix located here to see if it helps.If it does not, then re-create the f.exe file you created previously and leave it in place then do the following:Perform a Quick Scan with Malwarebytes' Anti-Malware and allow it to remove the file, rebooting the computer so it can complete removal.Open C: and verify that the file is now gone.Run another Quick Scan with Malwarebytes' Anti-Malware to see if the file is still being detected or not.Please let me know how it goes.Thanks Link to post Share on other sites More sharing options...
Tech Posted June 1, 2010 Author ID:259980 Share Posted June 1, 2010 Thanks exile.The Microsoft fix is for Windows XP/Vista and seems to be dangerous to be applied to Windows 7 that I'm using. It could mess all Windows installation.I've recreated the f.exe file (copying a new and different executable and renamed it). Direct copy give me access permission denied, even allowing UAC.Run MBAM. The file was detected, I'll clean and reboot. I'll post after that. Link to post Share on other sites More sharing options...
Tech Posted June 1, 2010 Author ID:260001 Share Posted June 1, 2010 The file is gone after boot.But the next MBAM scanning detect it again. It's not shown in Windows Explorer (even unhidding files).I'm afraid to change anything with Microsoft Fix as it is the root driver (C:\). Link to post Share on other sites More sharing options...
Tech Posted June 1, 2010 Author ID:260002 Share Posted June 1, 2010 The file is gone after boot.But the next MBAM scanning detect it again. It's not shown in Windows Explorer (even unhidding files).I'm afraid to change anything with Microsoft Fix as it is the root driver (C:\). Link to post Share on other sites More sharing options...
Tech Posted June 1, 2010 Author ID:260004 Share Posted June 1, 2010 The file is gone after boot.But the next MBAM scanning detect it again. It's not shown in Windows Explorer (even unhidding files).I'm afraid to change anything with Microsoft Fix as it is the root driver (C:\). Link to post Share on other sites More sharing options...
exile360 Posted June 1, 2010 ID:260043 Share Posted June 1, 2010 That's OK, please do the following and we can verify the settings manually without altering anything:Open C: and right click in a blank area, not on any file or folder there, and select PropertiesClick on the Security tabClick on SYSTEM under Group or user names: and make sure that Full Control along with all other entries except Special permissions have a check under the Allow columnDo the same for Administrators and make sure that Users has check marks for each of the following:Read & executeList folder contentsReadPlease let me know if any of the settings differ from what I have described.Thanks Link to post Share on other sites More sharing options...
Tech Posted June 6, 2010 Author ID:263034 Share Posted June 6, 2010 Sorry for the double (triple) post... I don't know what happened I've tried to boot from a CD (both Linux and DOS) and could never find a file called f.exe.There aren't any references into Windows Registry also.Can anybody help?I'll give up on MBAM if I can't solve this issue. It's the logical of the lack of support.I've tested my computer with ComboFix, OTL, OTM and GMER. Neither of them find the file.The problem seems to be inside MBAM. If not, please, guide me. Link to post Share on other sites More sharing options...
Tech Posted June 6, 2010 Author ID:263063 Share Posted June 6, 2010 Exile, the properties are exactly as you've posted. Link to post Share on other sites More sharing options...
Tech Posted June 6, 2010 Author ID:263066 Share Posted June 6, 2010 Exile, the properties are exactly as you've posted. Link to post Share on other sites More sharing options...
Tech Posted June 6, 2010 Author ID:263067 Share Posted June 6, 2010 Exile, the properties are exactly as you've posted. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now