JeremyWW Posted January 4, 2011 ID:369709 Share Posted January 4, 2011 This seems like an FP to me...?EDIT: Incidentally, I'm running it again now in developer mode. Will post the log again...mbam_log_2011_01_04__17_05_27_.txt Link to post Share on other sites More sharing options...
Fom Posted January 4, 2011 ID:369718 Share Posted January 4, 2011 I'm getting bitsadmin.exe flagged as well. I'm thinking FP too. Link to post Share on other sites More sharing options...
Fom Posted January 4, 2011 ID:369719 Share Posted January 4, 2011 Sry forgot to add log file.mbam_log_2011_01_04__12_19_10_.txt Link to post Share on other sites More sharing options...
JeremyWW Posted January 4, 2011 Author ID:369720 Share Posted January 4, 2011 I'm getting bitsadmin.exe flagged as well. I'm thinking FP too.Ah...good to know I'm not alone...Log after running in developer mode:mbam_log_2011_01_04__17_40_55_.txt Link to post Share on other sites More sharing options...
SpiderLover Posted January 4, 2011 ID:369736 Share Posted January 4, 2011 I'm also getting bitsadmin.exe flagged.Will get the log file once the scan is finished.bitsadmin.zip Link to post Share on other sites More sharing options...
DCross Posted January 4, 2011 ID:369745 Share Posted January 4, 2011 Like other users I ran a full scan today and had a bitsadmin.exe file in c:\\Windows\winsxs flagged as Trojan.FakeMS. Is this a false positive? The fact that the file in question is dated 2009 on my computer leads me to think that it might be (as does the fact that a quick scan earlier today and a full scan last night didn't detect any problems).Results of scan in developer mode attached.(Apologies if I should have posted this to the post below, but the instructions said don't reply to other users' posts so I wasn't sure)mbam_log_2011_01_04__18_42_35_.zip Link to post Share on other sites More sharing options...
nosirrah Posted January 4, 2011 ID:369749 Share Posted January 4, 2011 I am really sorry about this, the fix will be up in less than 5 minutes. Link to post Share on other sites More sharing options...
DCross Posted January 4, 2011 ID:369753 Share Posted January 4, 2011 I am really sorry about this, the fix will be up in less than 5 minutes.Good to hear that it's an FP. Thanks. Link to post Share on other sites More sharing options...
tanstaafl Posted January 4, 2011 ID:369850 Share Posted January 4, 2011 I am really sorry about this, the fix will be up in less than 5 minutes.Thanks for the quick fix! Glad I thought to check here before doing anything. Link to post Share on other sites More sharing options...
Mazdaspeeder Posted January 5, 2011 ID:370328 Share Posted January 5, 2011 Uh, I had MB delete the offending file. What have I done? What should I do now?This is what was shown in the report:Registry Data Items Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Link to post Share on other sites More sharing options...
nosirrah Posted January 6, 2011 ID:370336 Share Posted January 6, 2011 Uh, I had MB delete the offending file. What have I done? What should I do now?This is what was shown in the report:Registry Data Items Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.What you have posted is not related to the subject of this thread. In your log you can see that your desktop has been locked out from making changes. If you have done this intentionally just set it to ignore and you will not see that displayed again. Link to post Share on other sites More sharing options...
Mazdaspeeder Posted January 6, 2011 ID:370392 Share Posted January 6, 2011 What you have posted is not related to the subject of this thread. In your log you can see that your desktop has been locked out from making changes. If you have done this intentionally just set it to ignore and you will not see that displayed again.Sorry, I'm not sure what you mean. How would I have locked my desktop? I haven't encountered any difference in operation. I received this "infected registry key" when I ran a scan and got a positive for trojan.fakems (adminbits) and so I thought the two were related. Link to post Share on other sites More sharing options...
Mazdaspeeder Posted January 6, 2011 ID:370397 Share Posted January 6, 2011 Sorry, I've been doing some reading and I think I now understand what's going on. My questions is this...I quarantined and then deleted this, do I need to take steps to fix/restore it? Link to post Share on other sites More sharing options...
nosirrah Posted January 6, 2011 ID:370411 Share Posted January 6, 2011 The file was in backup location and not currently active.The one and only time this file would ever be needed is if you wanted to uninstall all of the windows updated that took plan on and after the update that placed this file in backup.In any event you should be able to restore the file from quarantine. Link to post Share on other sites More sharing options...
Mazdaspeeder Posted January 6, 2011 ID:370538 Share Posted January 6, 2011 The file was in backup location and not currently active.The one and only time this file would ever be needed is if you wanted to uninstall all of the windows updated that took plan on and after the update that placed this file in backup.In any event you should be able to restore the file from quarantine.Thank you for the information. That is a relief. Unfortunately, I cleared the file from quarantine, so it's gone for good I think. Next time I'll check for false positives before stupidly deleting from quarantine. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now