False Positives in antivirus-programs

This topic will be used to post false positives in Anti-virus/Anti-malware programs so that end-users know not to fix the particular entries that may be shown.


Note: A separate reporting area specifically dedicated for AdwCleaner can be found in this topic...AdwCleaner False Positive Reporting Topic

Week of 11/16 MalwareBytes' Anti-malware had the following false positives:

C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll (Virus.Mariofev)
C:\WINDOWS\$NtServicePackUninstall$\user32.dll (Virus.Mariofev)
C:\WINDOWS\ServicePackFiles\i386\user32.dll (Virus.Mariofev)

These false positives have already been resolved in a past definitions update. Please make sure you update your MBAM definitions.

MalwareBytes' Anti-malware

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\atapi
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\atapi
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi

Files Infected:
C:\WINDOWS\system32\drivers\atapi.sys


Had this one yesterday 11/17

Edited by Grinler, 19 November 2009 - 01:22 PM.
Resolved via definitons update

@Grinler, delete this post if you want, its just a note...

@Boopme, this can be part of a very 'legit' rootkit. Maybe you can include a link.

You want false positives? Here ya go, have fun

I kept all files in a folder on my desktop and will be able to rescan them to check if they are still detected whenever you like. I included all tools I am using on a regular basis.

Combofix.exe
dds.scr
Flash_Disinfector.exe
Inherit.exe
OTL.exe
OTM.exe
RootRepeal.exe
RSIT.exe
Win32kDiag.exe
OTS.exe
TFC.exe

Note - I included Junction.zip, GooredFix.exe, SystemLook.exe and GMER (<random>.exe) as well, but those came out clean. apart from that, kudo's to McAfee!

@Grinler, delete this post if you want, its just a note...

@Boopme, this can be part of a very 'legit' rootkit. Maybe you can include a link.

Hi Elise as I didn't trust it 100% I had them post in HJT here. But while looking it up MBAM site had it as an FP.

http://www.bleepingcomputer.com/forums/ind...p;#entry1504844

@boopme

Yes, you were right, there was a FP regarding that which was posted in the MBAM forum topic over here:
http://www.malwarebytes.org/forums/index.p...=30371&st=0

This FP should of been resolved now with the latest updates.

Cheers.

~Extremeboy

Oh yeah.
Don't forget the FP malwarebytes gives for Night of Parasite. That is an accessible game for the visually impaired I like to play, and these were the files MBAM flagged as infected: C:\program files\Night Of Parasite\NOP(3.1) (trojan.FlyStudio), and then there was a file with a .fnr extension that I can't remember the name of. And I've tried talking to them about it, but they don't care. But for all those who love it, it's a fine game to play, and security programs should know the difference between real trojans, and programs that have installation characteristics of trojans. I'm thinking that it could be that the installer is in the original chinese that causes the issue.

Regards,
Your tech geek Chromebuster

Hey folks,
It's just me with another one LOL. All folks belonging to the blind and visually impaired community, keep an eye out for Super Antispyware for it accidentally detected two of the files for the accessible game judgment day as being infected with trojan.agent/gen-cryptor. I reported it immediately, so they should update their defs so that it doesn't happen again. Just keep a close eye.

Regards,
Chromebuster

I can't stand False Positives - always frustrates me if my computer is still safe or if its infected. Thanks for keeping us updated.

MalwareBytes' Anti-malware

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\atapi
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\atapi
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi

Files Infected:
C:\WINDOWS\system32\drivers\atapi.sys


Had this one yesterday 11/17

HI

C:\WINDOWS\system32\drivers\atapi.sys is an infected file. Check for the file size.
The size of atapi.sys should be 94kb. If the file size is 95kb or 93kb , the file is infected . This infected can cause Google and other search engines redirection.

The Antivirus software which I am using detected few genuine system files as infected files
C:\windows\system32\services.exe
C:\windows\system32\winlogon.exe

Please click HERE and follow the instructions in STEP 2 to download and run the norton removal tool.

Maybe you should make sure they are not infected with a file infector virus. You can doublecheck those files at www.virustotal.com

C:\WINDOWS\system32\drivers\atapi.sys is an infected file. Check for the file size.
The size of atapi.sys should be 94kb. If the file size is 95kb or 93kb , the file is infected . This infected can cause Google and other search engines redirection.

Maybe you should check the date this was reported

Edited by elise025, 30 June 2010 - 05:06 AM.

HI

C:\WINDOWS\system32\drivers\atapi.sys is an infected file. Check for the file size.
The size of atapi.sys should be 94kb. If the file size is 95kb or 93kb , the file is infected . This infected can cause Google and other search engines redirection.

My atapi.sys is 24kb O.o Then again, I have Win7.....

just another one. USB Guardian is tagged by MBAM. The main executable is tagged as Trojan.FakeAlert.