DPPDLL. dll - False positive? [SOLVED by db 1241]

[monsta]

I got this - in Quarantine at the moment - is it safe to leave it there?

 

 

Trojan.Agent, FILE, C:\Program Files (x86)\CyberLink\PhotoDirector\Kernel\Photo\DPPDLL.dll, 4089037

[enoskype]

Hi monsta, welcome to IObit Forum! :grin:

 

To be sure, please after uploading it to VirusTotal, post the report in this thread and also upload the file in a zip file to Wikisend giving the download link here, so IObit can further investigate it.

 

You can use THIS post as an example.

[monsta]

Excuse my ignorance - but how do I find the file?

[enoskype]

Hi monsta,

 

Click on the figure at the right side second from the top http://forums.iobit.com/attachment.php?attachmentid=11804&stc=1&d=1370555702. This will open Quarantine List window.

 

After opening Quarantine List window, tick the checkbox and click Restore button.

 

This will restore the DPPDLL. dll file to :

C:\Program Files (x86)\CyberLink\PhotoDirector\Kernel\Photo

folder.

 

After uploading it, you can quarantine it by scanning with IMF.

 

Cheers.

[monsta]

Thanks.

 

Managed that and got this:

"

File already analysed

 

This file was already analysed by VirusTotal on 2013-05-28 16:59:52 .

 

Detection ratio: 0/47

 

You can take a look at the last analysis or analyse it again now."

 

I re-analysed and got :

 

"SHA256: de696fb7a95687cf6593f3ddbfe3578b5a4665f4248e83ddf02fbf4fef38ccd7

File name: DPPDLL.dll

Detection ratio: 0 / 47

Analysis date: 2013-06-06 23:23:12 UTC ( 0 minutes ago ) "

 

The initial report from IMF is here:

 

IObit Malware Fighter

 

OS: Windows 8

Version: 2.0.1.6

Define Version: 1240

Time Elapsed: 00:29:23

Objects Scanned: 80683

Threats Found: 1

Save Time: 06/06/2013 11:41:51

 

|Name|Type|Description|ID|

Trojan.Agent, FILE, C:\Program Files (x86)\CyberLink\PhotoDirector\Kernel\Photo\DPPDLL.dll, 4089037

 

I have now scanned and re-quarantined the file, awaiting your advice?

(I have not yet sent it to wiki or cloud).

 

Im scared :oops:

 

Thanks.

[enoskype]

Thanks for the VirusTotal report.

 

It seems that it is a false positive, but please upload it to Wikisend and give the download link here in a post for IObit to further investigate and add to their database.

 

Since it seems to be a false positive, there is nothing to be scared to restore and also upload it to Wikisend.

 

Yo can even keep it at it's original location and not put to Quarantine List.

 

Cheers.

[monsta]

Thanks enoskype - a brand new comp which is why I installed IObit - want to keep it clean

 

I wiil do that now and post.

 

Many thanks :grin:

[monsta]

http://wikisend.com/download/421018/DPPD

 

zip file - time to live 7 days.

 

Cheers for your help. M

[Cicely]

Hi monsta and enoskype,

 

monsta, thanks for your feedback.

 

I have reported the false positive to our product team and it will be removed by Define Version: 1241.

 

Let's thanks enoskype's detailed and patient instructions.

 

Cheers.:wink: