KerryETB Posted July 15, 2013 ID:702937 Share Posted July 15, 2013 We have a Barracuda web filter which gives us Malwarebytes as a removal tool. Recently during scans it has started marking the firefox updater as a trojan agent. I was wondering if this is a risk or a false positive. I ran the following scan on a Windows XP PC today and it found the following Michael************************************** Barracuda Malware Removal Tool 1.46www.barracuda.com Database version: 913071408 Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.18702 15/07/2013 14:05:05bmrt-log-2013-07-15 (14-05-05).txt Scan type: Full scan (C:\|D:\|)Objects scanned: 362734Time elapsed: 40 minute(s), 18 second(s) Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 2 Memory Processes Infected:(No malicious items detected) Memory Modules Infected:(No malicious items detected) Registry Keys Infected:(No malicious items detected) Registry Values Infected:(No malicious items detected) Registry Data Items Infected:(No malicious items detected) Folders Infected:(No malicious items detected) Files Infected:C:\WINDOWS\SoftwareDistribution\Download\bb00e871d14625ce5324ccdf7ad36ca9016bcaec (Trojan.Llac) -> No action taken. [080C65FEA020D768026AD4E77C8A5A1D]C:\Program Files\Mozilla Firefox\updater.exe (Trojan.Agent) -> No action taken. [43EFC9EA4B44BAB93FA8A462F9CC13C4] bmrt-log-2013-07-15 (14-05-05).zip Link to post Share on other sites More sharing options...
Staff miekiemoes Posted July 15, 2013 Staff ID:702945 Share Posted July 15, 2013 Hi, Can you zip & attach both files that were detected to this thread?Thanks! Link to post Share on other sites More sharing options...
jni666 Posted July 16, 2013 ID:703384 Share Posted July 16, 2013 I have been infected with this and I have contained it. If someone wants the relevant files let me know. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted July 16, 2013 Staff ID:703446 Share Posted July 16, 2013 Hi, Please zip & attach the sample so we can verify whether this is a false positive or not. Link to post Share on other sites More sharing options...
KerryETB Posted July 16, 2013 Author ID:703504 Share Posted July 16, 2013 I will run a scan again and upload the zipped file Link to post Share on other sites More sharing options...
Staff miekiemoes Posted July 16, 2013 Staff ID:703523 Share Posted July 16, 2013 ok, please let me know in your next reply with the attachement.(because, in case you edit your previous post with the attachement added, I won't get a notification for this ) Link to post Share on other sites More sharing options...
KerryETB Posted July 17, 2013 Author ID:703833 Share Posted July 17, 2013 Attached is the firefox updater.exe that got flagged yesterday on a scanupdater.zip Link to post Share on other sites More sharing options...
Staff miekiemoes Posted July 17, 2013 Staff ID:703834 Share Posted July 17, 2013 Hi, I cannot reproduce detection for this one though... Link to post Share on other sites More sharing options...
KerryETB Posted July 17, 2013 Author ID:703835 Share Posted July 17, 2013 So does this mean it's a false positive? Link to post Share on other sites More sharing options...
spywar Posted July 17, 2013 ID:703836 Share Posted July 17, 2013 That means the file is not detected by MBAM latest DB. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted July 17, 2013 Staff ID:703837 Share Posted July 17, 2013 This file is not malicious and is not detected on our end Link to post Share on other sites More sharing options...
Staff miekiemoes Posted July 17, 2013 Staff ID:703842 Share Posted July 17, 2013 Hi Kerry, just to verify, the file you attached here, is this the one that was actually detected by Malwarebytes and was it located in C:\Program Files\Mozilla Firefox\updater.exe?So you uploaded the updater.exe that is located there?Does your barracuda still detect this file when you run a scan? Link to post Share on other sites More sharing options...
KerryETB Posted July 17, 2013 Author ID:703843 Share Posted July 17, 2013 Yes, that is the one that was detected by Malwarebytes - I copied it from the folder, zipped it and uploaded it here. I have started another scan of the PC Link to post Share on other sites More sharing options...
KerryETB Posted July 17, 2013 Author ID:703850 Share Posted July 17, 2013 Just scanned the PC again - it marked the firefox updater as Trojan.Agent (see attached copy of updater.exe and the log). Update details :Date : 7/16/2013Database version : 913071608Fingerprints loaded : 280462 I have removed the file and started another scanscan.zip Link to post Share on other sites More sharing options...
Staff miekiemoes Posted July 17, 2013 Staff ID:703852 Share Posted July 17, 2013 Ok thanks.You can restore this file from quarantine again and add to your whitelist since it's not malicious.Your version of Barracuda is outdated which explains this misdetection. Please update your baracuda build to 1.75.0.1300 Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now