Malware Bytes Scan

  • Thread starter Thread starter Dave Cohen
  • Start date Start date
D

Dave Cohen

Just updated MalwareByte and scanned system. Getting over 400
'Trojan.Downloader' messages on files that have been on the system
forever. Avira doesn't find anything.
 
Just updated MalwareByte and scanned system. Getting over 400
'Trojan.Downloader' messages on files that have been on the system
forever. Avira doesn't find anything.
Click to expand...
..
I would trust MBAM, but if you want a second opinion install Hitman Pro
(free thirty day license) or SuperAntiSpyware. I find that AV is
notoriously unable to detect the types of malware that MBAM, SAS etc. are
designed to find/remove.
 
FredW said:
Are you sure it is MBAM and not Avast?
;-)

I would wait for the next update and then scan again.

In the meantime for a second opinion
- SuperAntiSpyware (Free Edition)
http://www.superantispyware.com/download.html
Click to expand...
This was a problem with Update 3286 which was only out there for a
little while. It was replaced with 3287, then 3288.

There were several threads on the MBAM forums.

RB
 
Dave Cohen said:
Just updated MalwareByte and scanned system. Getting over 400
'Trojan.Downloader' messages on files that have been on the system
forever. Avira doesn't find anything.
Click to expand...

Submit one of the suspect files to Virustotal or Jotti to help ascertain
if it is a false positive.
 
FredW said:
Looks like the same kind of problem Avast had today.
Click to expand...

Huh? Why did MBAM and Avast have problems around the same time?
What is the connection??
Do they share or steal each others definitions?
Buffalo
 
From: "Buffalo" <Eric@nada.com.invalid>




| Huh? Why did MBAM and Avast have problems around the same time?
| What is the connection??
| Do they share or steal each others definitions?
| Buffalo



Pure coincidence of a rash of False Positives!
 
FromTheRafters said:
Submit one of the suspect files to Virustotal or Jotti to help ascertain
if it is a false positive.
Click to expand...

I did that. When it came back 'negative', I checked the MBAM forums.

RB
 
| I really don't believe that explaination!
| Buffalo


Sorry, that's the way it is.
 
Buffalo said:
I really don't believe that explaination!
Click to expand...

If it were more than a coincidence, it would be the *same* malware being
purportedly found by each program, since you are talking about the def
files being possibly shared or stolen. For example if both entities
stole their defs from PCButts - all three would FP on the same files for
the same malware (possibly giving different malware names as a result).
 
Rube Bumpkin said:
I did that. When it came back 'negative', I checked the MBAM forums.
Click to expand...

Even the best programs can and will FP - it is nice to have a
programmatical consensus available online. When online is not possible,
it is nice to have an alternative program available locally for a second
opinion.
 
Dave said:
Just updated MalwareByte and scanned system. Getting over 400
'Trojan.Downloader' messages on files that have been on the system
forever. Avira doesn't find anything.
Click to expand...

All is well. My 12/3 update installed 3287 and the scan indicated
problems I stated.
Today (12/4) I updated and installed 3289, full scan showed zero problems.
One curious note: I don't recall having to re-start the computer after
yesterday's update. Today I received and responded to that message.
Thanks for all your replies.
 
From: "Buffalo" <Eric@nada.com.invalid>




| I guess so. That kind of coincidence just throws up a red flag to me.
| Thanks for the response.
| Buffalo


I understand.
 
Leonard Agoado said:
FTR,

Do you imagine, in the scenario described above, either entity
functioning well enough to make it to that point?
Click to expand...

Of course, virus (or malware) description language is not a programming
language.

:oD

Butt's programs work reasonably well even though the data files
describing the malware are stolen from the actual people doing the
research to create them (the "engines" consuming that data are probably
stolen as well, by this has not been demonstrated as well as the other
aspect has).

If you recall the "other" thieves (from China?) - they actually gave the
same malware name (marker) in the alert, probably because the engine
(maybe even the GUI) is stolen as well.
 
Dave Cohen said:
All is well. My 12/3 update installed 3287 and the scan indicated
problems I stated.
Today (12/4) I updated and installed 3289, full scan showed zero
problems.
One curious note: I don't recall having to re-start the computer after
yesterday's update. Today I received and responded to that message.
Thanks for all your replies.
Click to expand...

Often, that is indicative of a program update as opposed to just a
definitions update. I'm not sure if Malwarebyte's Anti-Malware shares
this nature so familiar with the AV programs.
 
From: "FromTheRafters" <erratic@nomail.afraid.org>


| Of course, virus (or malware) description language is not a programming
| language.

::oD

| Butt's programs work reasonably well even though the data files
| describing the malware are stolen from the actual people doing the
| research to create them (the "engines" consuming that data are probably
| stolen as well, by this has not been demonstrated as well as the other
| aspect has).

| If you recall the "other" thieves (from China?) - they actually gave the
| same malware name (marker) in the alert, probably because the engine
| (maybe even the GUI) is stolen as well.


Yes, IObit's theft of the Malwarebytes database is an excellent example.

Those who decrypted the IObit database and the Malwarebytes database have *NO DOUBT* of
this theft.
 
FromTheRafters said:
Even the best programs can and will FP - it is nice to have a
programmatical consensus available online. When online is not possible,
it is nice to have an alternative program available locally for a second
opinion.
Click to expand...

Oh, yeah, I also did that. I ran SAS, Spybot S&D, Ad-Aware, and Norton
AV (the corporate version), before I sent a file to VT, and checked the
forums.

RB
 
Rube Bumpkin said:
Oh, yeah, I also did that. I ran SAS, Spybot S&D, Ad-Aware, and Norton
AV (the corporate version), before I sent a file to VT, and checked
the forums.
Click to expand...

It sounds like you have things pretty well covered with respect to
sorting out FP's. :o)

A lot depends (for me) on where a file is found as well. For instance
some months ago a had detection of malware in my IBM utilities folder -
I suspected FP's and did nothing - subsequent scans did not repeat the
issue. Some months later I got a detection in my Java jar's zip files -
I quarantined (or deleted) them, because I didn't care about saving
FPed malware in Java jars.
 
Huh? Why did MBAM and Avast have problems around the same time?
Click to expand...

We had temporary problems with our database... Shrug. Sorry. We fixed it
quick, but evidently not quick enough; some systems did get the bad
definitions.
What is the connection??
None.

Do they share or steal each others definitions?
Click to expand...

We don't share definitions with anyone. It wouldn't do much good;
Definitions are typically custom and very specific to the antimalware
engine. For example, the definitions system in use by BugHunter (my app) is
entirely 100% incompatable with the definitions system used by malwarebytes
antimalware. While some definitions can and do consist of hashes or
checksums of some sort, others do not.
 
Back
Top