multimedia.rum false positive? [SOLVED by db 1247]

[Almcd]

Hi,

 

I think I have a false positive report from Malware Fighter v2.0 Free. I first of all had a crossover period with McAfee and AVG, which caused AVG to pick up a file from McAfee as a rootkit. I then installed Malware Fighter thinking I had a serious problem to remove. Malware Fighter keeps picking up what I think is a Windows file and reporting it as a Trojan.

 

Here is the report:

 

IObit Malware Fighter

 

OS: Windows 7

Version: 2.0.1.8

Define Version: 1244

Time Elapsed: 00:31:11

Objects Scanned: 128903

Threats Found: 1

Save Time: 20/06/2013 23:17:36

 

|Name|Type|Description|ID|

Trojan.BHO, FILE, C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\multimedia.rum, 4026432

 

Running this file past Virus Total gave this:

 

SHA256: e245d8b5f9b4db34e278aea9163892a0a105bfe1776ef1d6e2292d8f4cb472ec

SHA1: 3c4e537951522dd4dd5e70849a34e2e1b4e8542a

MD5: 5c6a7465eb76d1d2cf2c90095d0f5be7

File size: 78.5 KB ( 80384 bytes )

File name: multimedia.rum

File type: Win32 DLL

Detection ratio: 0 / 47

Analysis date: 2013-06-25 20:47:06 UTC ( 0 minutes ago )

 

 

Here is a link to the zipped file:

 

http://wikisend.com/download/600866/multimediarumzip.zip

 

Will you e-mail me for the password or is it OK to post it here?

 

Thanks,

Al.

 

EDIT: You can post the password here. NOTE: Please also update your database version to 1246 as of today.

[Cicely]

Hi Almcd,

 

Thanks for your feedback.

 

I have sent your a PM to ask for the password to download the file to look into the issue.

 

Looking forward to hearing from. :wink:

[Almcd]

Hi,

 

Thanks for your reply.

 

Hope you got the password OK. I have run the scan again with the latest version and it is still coming up:

 

IObit Malware Fighter

 

OS: Windows 7

Version: 2.0.1.8

Define Version: 1246

Time Elapsed: 00:35:20

Objects Scanned: 126410

Threats Found: 1

Save Time: 26/06/2013 23:40:09

 

|Name|Type|Description|ID|

Trojan.BHO, FILE, C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA7FFFFB744AA0000000010\10.0.0\multimedia.rum, 4026432

[Cicely]

Hi Almcd,

 

Thanks for your fast reply.

 

We have downloaded the file. However, it is Add-in Express\adxregistrator.log not multimedia.rum. Did you send us the wrong one? Please upload the file multimedia.rum to wikisend and send us the link to download. Besides, you can post the password here.

 

Thanks in advance.

[Almcd]

Sorry, must have clicked on the wrong file.

 

This should be multimedia.rum zipped:

 

http://wikisend.com/download/426370/multimediarum.zip

 

Password: unzipme

 

Same file unzipped, if that's any use:

 

http://wikisend.com/download/147360/multimedia.rum

 

Same password.

 

Thanks. Hope it's OK this time.

[Almcd]

Hi,

 

I have just updated to 1247 and the report came back clear. Was this included in the last release?

 

Thanks.

[Cicely]

Hi Almcd,

 

Do you mean that the false positive still exists on your PC? But we did test and the false positive has been removed in Database Version 1247.

 

Please ensure that you have update to the latest Database version and try again.

 

Thanks for supporting IObit.

[enoskype]

False Report case is SOLVED!

 

Hi Cicely,

 

Almcd means that after updating to database version 1247, IMF didn't report the concerned file as a malware.

 

With your last post it is also understood that the case is SOLVED by db 1247.

 

Cheers.

[Cicely]

Hi enoskype,

 

Sorry I made mistakes. When Almcd said" the report came back clear, I thought that he meant the false positive came back. :oops::???: