False Positive

[JacobHoppe]

Hi, I would like a false positive to be removed. The first db i know to have the false posivite was 2013.6.13.10

 

 

 

Pivot_setup_IC2.zip

Pivot_v4-1_beta_setup_IC7.zip

[JacobHoppe]

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 4/1/2014

Scan Time: 3:35:43 PM

Logfile: mbam2.0logmarch.txt

Administrator: Yes

 

Version: 2.00.0.1000

Malware Database: v2014.04.01.08

Rootkit Database: v2014.03.27.01

License: Premium

Malware Protection: Enabled

Malicious Website Protection: Enabled

Chameleon: Disabled

 

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Alan

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 318983

Time Elapsed: 15 min, 1 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Shuriken: Enabled

PUP: Warn

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 10

PUP.Optional.SoftwareUpdater, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9}, Quarantined, [d854eb3a502ba393e6fa8a870af82ed2], 

PUP.Optional.SoftwareUpdater, HKLM\SOFTWARE\CLASSES\TYPELIB\{A0EE0278-2986-4E5A-884E-A3BF0357E476}, Quarantined, [d854eb3a502ba393e6fa8a870af82ed2], 

PUP.Optional.SoftwareUpdater, HKLM\SOFTWARE\CLASSES\INTERFACE\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}, Quarantined, [d854eb3a502ba393e6fa8a870af82ed2], 

PUP.Optional.SoftwareUpdater, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}, Quarantined, [d854eb3a502ba393e6fa8a870af82ed2], 

PUP.Optional.SoftwareUpdater, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{A0EE0278-2986-4E5A-884E-A3BF0357E476}, Quarantined, [d854eb3a502ba393e6fa8a870af82ed2], 

PUP.Optional.SoftwareUpdater, HKLM\SOFTWARE\CLASSES\Updater.AmiUpd.1, Quarantined, [d854eb3a502ba393e6fa8a870af82ed2], 

PUP.Optional.SoftwareUpdater, HKLM\SOFTWARE\CLASSES\Updater.AmiUpd, Quarantined, [d854eb3a502ba393e6fa8a870af82ed2], 

PUP.Optional.SoftwareUpdater, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Updater.AmiUpd, Quarantined, [d854eb3a502ba393e6fa8a870af82ed2], 

PUP.Optional.SoftwareUpdater, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Updater.AmiUpd.1, Quarantined, [d854eb3a502ba393e6fa8a870af82ed2], 

Adware.Hotbar, HKU\S-1-5-21-452854338-2404546207-1765307269-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\The Weather Channel, Quarantined, [6ac24fd6df9cbc7a0117cd17db27a65a], 

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 2

PUM.Hijack.StartMenu, HKU\S-1-5-21-452854338-2404546207-1765307269-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|Start_ShowSearch, 0, Good: (1), Bad: (0),Replaced,[909c1a0b0e6d92a4fd82b4589173b14f]

PUM.Hijack.StartMenu, HKU\S-1-5-21-452854338-2404546207-1765307269-1010-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|Start_ShowSearch, 0, Good: (1), Bad: (0),Replaced,[77b50c19b3c8fa3ca6d9a7659b69f60a]

 

Folders: 0

(No malicious items detected)

 

Files: 2

Trojan.Agent, C:\Users\Alan\Downloads\Pivot_setup_IC2.zip, No Action By User, [19134fd6205bab8b6da82518b34daa56], 

Trojan.Agent, C:\Users\Alan\Downloads\Pivot_v4-1_beta_setup_IC7.zip, No Action By User, [74b8170e225992a42ce90b32bf41d729], 

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

[Atribune]

The 2 files are not a false positive but are improperly named. They will be renamed in the next database to PUP.Optional.InstallCore.