edge Posted December 12, 2011 ID:504119 Share Posted December 12, 2011 Hello, Version 1.51.2.1300 Database version: 8357 reports fsquirt.exe as a Trojan.Dropper.BCM. Virustotal finds no malware in this file and internet search find this file may be Microsoft bluetooth application. I have not removed this from the system yet. Attached are DDS and attach.txt. Please advise.attach.txtDDS.txt Link to post Share on other sites More sharing options...
mona7865 Posted December 12, 2011 ID:504127 Share Posted December 12, 2011 Removed, sorry. Link to post Share on other sites More sharing options...
Dreadwing Posted December 12, 2011 ID:504133 Share Posted December 12, 2011 I got this same result as well. Was this a false positive? If so, I deleted the file. Link to post Share on other sites More sharing options...
ScrltOTara Posted December 12, 2011 ID:504135 Share Posted December 12, 2011 Me, too. I have a bluetooth device installed on my windows xp machine, file is dated 2004, Malwarebytes has never detected it as a trojan before, but today it did. I'm afraid to remove it in case it's a valid file. Link to post Share on other sites More sharing options...
Klinker Posted December 12, 2011 ID:504139 Share Posted December 12, 2011 Count me in too. Kaspersky, McAfee and ESET scans found nothing so wondering if it's a false positive. A second Malwarebytes scan was clean. Like the OP, could not find any other reference to this as malware. Link to post Share on other sites More sharing options...
missk2u Posted December 12, 2011 ID:504149 Share Posted December 12, 2011 Same here! I too deleted it. I don't use bluetooth devices. Do I need to reinstall this file? And how do I do this? I was suspicious when the date of the file was the same as my OS but I know that doesn't always mean anything so I deleted, Malwarebytes quarantined and deleted it. So I think it's gone? False positive? Norton shows nothing.I have Win XP MC 2005 OS Link to post Share on other sites More sharing options...
joachim711 Posted December 12, 2011 ID:504254 Share Posted December 12, 2011 I tried the following:extract fsquirt.ex_ from xp service pack 3 into a temporary folderin cmd window enter "expand fsquirt.ex_ fsquirt.exe"this gives you the original fsquirt.exe as delivered from microsoftcheck the single file with malwarebytes (right click)bingo! It is reported as trojan dropper, so I conclude it must be a false positiveI'm no expert, this is my first post in a computer forum. Any comments?Thank you. Link to post Share on other sites More sharing options...
DavidCatGuy Posted December 12, 2011 ID:504278 Share Posted December 12, 2011 Got the same thing today (Dec 11, 2011) and removed it. Also found other references that see it as a Bluetooth file accesory. Don't use Blue tooth but am disturbed by a false positive as y'all have mentioned. Reply from Malwarebytes? Link to post Share on other sites More sharing options...
onDvine Posted December 13, 2011 ID:504396 Share Posted December 13, 2011 I found c:\Windows\system32\fsquirt.exe in my computer. Per MBAM, that's where Trojan.Dropper.BCM is. My copy was created in 2004 (this is an old machine) and there's no indication it was modified. I'll watch this thread but am thinking it's a false positive and will leave it in place for now. Link to post Share on other sites More sharing options...
moondane Posted December 13, 2011 ID:504491 Share Posted December 13, 2011 This may have happened before: http://forums.malwarebytes.org/index.php?showtopic=101848I too, deleted the file. Waiting for confirmation of false positive before reinstalling. Link to post Share on other sites More sharing options...
onDvine Posted December 13, 2011 ID:504670 Share Posted December 13, 2011 Looks like the 2nd post (quoted below) was a reply to the original post. Removed, sorry.MBAM scan doesn't show infection with Trojan.Dropper.BCM on my computer now and I left c:\Windows\system32\fsquirt.exe where it was. Link to post Share on other sites More sharing options...
edge Posted December 13, 2011 Author ID:504698 Share Posted December 13, 2011 Looks like the 2nd post (quoted below) was a reply to the original post.MBAM scan doesn't show infection with Trojan.Dropper.BCM on my computer now and I left c:\Windows\system32\fsquirt.exe where it was. You may be right, I initially though it meant the comment was edited and removed. mona7865 can you clarify please?I left the fsquirt.exe file in place and re-scanned the system with database version: 8366 and found no infection. Looks like a false positive, but I think we need confirmation from MBAM. Link to post Share on other sites More sharing options...
Dreadwing Posted December 14, 2011 ID:504787 Share Posted December 14, 2011 Looks like this problem has been resolved, but in other threads. It is a false positive.http://forums.malwarebytes.org/index.php?showtopic=101845http://forums.malwarebytes.org/index.php?showtopic=101846http://forums.malwarebytes.org/index.php?showtopic=101848I thought I had deleted the file, but checking MBAM showed the file was in quarantine. I updated MBAM, restored the file, and ran a scan, everything was OK. Link to post Share on other sites More sharing options...
Staff screen317 Posted December 23, 2011 Staff ID:508290 Share Posted December 23, 2011 Anyone who is not the topic starter, please start your own topic and someone will assist you.edge,Are you still experiencing any issues?? Link to post Share on other sites More sharing options...
edge Posted December 23, 2011 Author ID:508329 Share Posted December 23, 2011 Anyone who is not the topic starter, please start your own topic and someone will assist you.edge,Are you still experiencing any issues??No other issues since update to later databases. Link to post Share on other sites More sharing options...
Staff screen317 Posted December 23, 2011 Staff ID:508365 Share Posted December 23, 2011 Thank you for letting us know. Link to post Share on other sites More sharing options...
Staff screen317 Posted February 22, 2012 Staff ID:529494 Share Posted February 22, 2012 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts