Backdoor.Winbach - FP's?

[antontonkovic]

I just did a intelli-scan and sd found 5 infections of Backdoor.Winbach.
Seeing that they are in the Registry, I need confirmation that they are false positives or a real threat.

I have Googled the threat and it says that they are real, I just want to be sure.

I have placed them in Quarantine.

BTW, in the History, they are classified as Medium, and under Quarantine, they are classified as Low threats. Any explanations?

I have attached some screen shots:

Thanks

[AChen]

Hi Antontonkovic,

Could you please attach a history file from SD to this thread?

[antontonkovic]

Hi AChen, I am having trouble sending the sd history.zip file to the new compressed folder. I get a message saying that I "cannot copy a compressed (zipped) file onto itself". I am obviously doing something wrong.
I need instructions on how to do this.

I have also downloaded 7-zip file manager, but I don't know how to use it.

[AChen]

Go to SD-> Settings-> History-> Click on the history you want to select-> Save to file-> save it to your Desktop (or preferred location).

Once saved, right click on the file-> 7-Zip-> Add to archive-> A another file will be created on the desktop (preferred location)-> Attach to forum :)

[antontonkovic]

Still having trouble AChen. I get "Invalid File" when I try to upload the file from the desktop. I tried a couple times with different File Type to save under

[AChen]

Can you send the .htm file to my email?

[lisaz]

I too had the same infection as anton. Yesterday intelliscan 8/26. I am sending attachment of history. I too would like to know if this is real or actually a fp. thank you

[AChen]

Thanks for the info Antontonkovic and Lisaz, this does look like an FP, however, the MRC team are double checking to be on the safe side and I will get back to you shortly.

[Black_Image]

I had the same infection as well. I have attach the history.

[AChen]

A fix will be available in today's update :)

[antontonkovic]

Thanks Achen, Do we RESTORE those files?

[AChen]

Thanks Achen, Do we RESTORE those files?

Yep, restore those files and when you run another scan, these shouldn't be detected again, considering, the fix was in the update :)

[antontonkovic]

Intelli scan shows up clean