false positive?

[riobio]

Quick scan just moved to virus chest:
C:\SWSetup\HPPhoto\setup\HPZpsco1.exe as a severe threat...I cannot find anything about this.
Is there anything to do or check further?
I have AIS, SAS paid, MBAM paid, Webroot,Windows XP Pro, IE8, all is current and constantly updated.  No other scans picked this up.
Thanks

[JuninhoSlo]

Quick scan just moved to virus chest:
C:\SWSetup\HPPhoto\setup\HPZpsco1.exe as a severe threat...I cannot find anything about this.
Is there anything to do or check further?
I have AIS, SAS paid, MBAM paid, Webroot,Windows XP Pro, IE8, all is current and constantly updated.  No other scans picked this up.
Thanks

You can send suspicious file to virustotal.

[polonus]

Here it is found secure: http://www.online-armor.com/oasis2/file/hewlett_packard/hpzpsc01_exe/hpzpsc01_exe/7646
&
http://exefile.submitfile.com/HPZpsc01.exe.html
Re:
Product:   ICE *1
Company:   Hewlett-Packard
Description:   ICE Pre-Scrubber plug-in *1
Version:   7.0.0.71 *1
MD5:           8E39A63B3780A290E3B728E015A2503B *1
Size:           1028096 *1
Directory:   %TEMP%\7zS060B\Setup\HPZpsc01.exe *1
Operating System:   Windows XP

polonus

[riobio]

Thank you Polonus; I have an HP 5610 All in One so this makes sense.

However, the full scan later on picked up:
C:\System Volume Information\_restore......A0227143.exe  and
C:\WINDOWS\MEMORY.DMP identified as Win32:Trojan-Gen and Win32:Fake Alert+NF{Trj} respectively.
Then later on, IE shut down unexpectedly; the Blue Screen said Bad_Pool_Header, IE recovered, and then directed me to MS knowledge base that said I may have two antivirus software installed.
I do not have two antivirus installed.

I ran a full MBAM and a full SAS; nothing at all.  Webroot log says it is corrupted and needs to be reinstalled; I uninstalled it, but will wait to reinstall.

Are you able to advise of further action?  I'm older and without tech expertise; I'd appreciate any further advice you may have.
Thank you.

[Cast]

I have AIS, SAS paid, MBAM paid, Webroot,Windows XP Pro, IE8, all is current and constantly updated

You do have two antivirus as Webroot is one,and Avast the other.

[bobo1]

Hi,
Had webroot spysweeper on my machine and is very bad at consuming resourses. If it is the version with a antivirus it will conflict and do damage to the op system. Only use 1 antivirus! and run avast boot scan without webroot installed.
You must have a malware process going off as your system restore point is infected as malware is common to infect system restore points. After malware removal you need to clear all your restore points as these will be more than likly infected.

Update malware bytes IMPORTANT DO a full scan in safe mode and clear what it finds. Malware will not run in safe mode.

[Pondus]

Update malware bytes IMPORTANT DO a full scan in safe mode and clear what it finds. Malware will not run in safe mode.

not necessary to do as the quick scan will find and remove 99% of what MBAM is able to detect
Malwarebytes can be run in safemode but is designed to work best in normal mode



http://forums.malwarebytes.org/index.php?showtopic=5590

http://forums.malwarebytes.org/index.php?showtopic=8914&st=20&p=43831&#entry43831
http://forums.malwarebytes.org/index.php?showtopic=10405&st=0&p=141646&#entry141646
http://forums.malwarebytes.org/index.php?showtopic=8710&st=0&p=41633&#entry41633

[riobio]

The product is Webroot Spy Sweeper only; I do not want and do not have any antivirus product from Webroot.  I apologize for an incomplete description.

[Asyn]

You can report a FP here: http://www.avast.com/contact-form.php?loadStyles

[riobio]

Thanks for the input; finally got a link to submit the FP.

This morning, mbam will not open up even though the popups showing automatic updates keep coming and the icon is in the taskbar; it is saying "runtime error 0", "runtime error 440/automation" and once I got "vb Accelerator SGrid II Control".  Have emailed support at mbam but no response yet.

Another note: yesterday the AIS boot time scan showed nothing and this was before the bad pool header shutdown; also mbam will not open up in safe mode this morning (same error messages)and SpySweeper (it has NO av features) is not installed.

[polonus]

Hi riobio,

Workaround for you:

Fire up command prompt, type in following commands:

regsvr32 mbamext.dll
regsvr32 ssubtmr6.dll
regsvr32 vbalsgrid6.ocx
regsvr32 zlib.dll

Give in the commands the last one may do the trick,

polonus

[bobo1]

Hi,
Run hijack this from trend micro and post the log to read? Sure a malware process is running!

[riobio]

MBAM support sent a link to get mbam back up; it is OK now, quick scan shows nothing.

I am clueless here, so you win bobo1--here is the trend micro hijack this log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:10:54 PM, on 6/12/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\afwServ.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\dmadmin.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Documents and Settings\jcb.PC272393594253\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\trend micro\HiJackThis\HiJackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://apod.nasa.gov/apod/astropix.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4A

[DavidR]

Hi,
Run hijack this from trend micro and post the log to read? Sure a malware process is running!

Sorry bobo1, but HijackThis is a busted flush now, it hasn't had any development for probably over 18 months and it just isn't up to the task any longer. It doesn't even look in the areas that modern malware hides, this is why specialist analysis tools have come to the fore like OTS as you will see mentioned in the forums.

[riobio]

Hi,
Run hijack this from trend micro and post the log to read? Sure a malware process is running!

Sorry bobo1, but HijackThis is a busted flush now, it hasn't had any development for probably over 18 months and it just isn't up to the task any longer. It doesn't even look in the areas that modern malware hides, this is why specialist analysis tools have come to the fore like OTS as you will see mentioned in the forums.

David R, you're saying the hijack this is useless?  If so, do you have a suggestion?  Just finished deleting all system restore points, making a new one, doing a full mbam scan which shows zero "0" infections.  Am I done, or is there something else?