ntbackup.exe False Positive [SOLVED by db 2410]

[jseverson]

Hi, I ran IObit Security's scan tonight and received 6 threats. 4 were cookies which I'm not concerned about. The other is a cookie that is on my ignore list. The 5th was for ntbackup.exe.

 

Additionally, I ran Windows Backup earlier in the evening to do a system state backup, which worked fine, and IObit Security flagged it at that time as well. I assumed at the time that it was due to having IOBit Security set to high. I haven't yet encountered any issues, errors, etc. that would lead me to believe my machine is infected.

 

The file in question was last modified on 8/4/2004 and clicking on properties appears to display all the proper MS Windows information. My anti virus software (Trend Micro) also detected no issues with the file.

 

Also, when I ran the scan on my laptop a few weeks ago, which was infected at the time, also flagged ntbackup.exe as a threat. When I removed it, Windows produced an error message stating that a critical file had been removed.

 

Note: The cookies listed in the log below have been edited to remove my name.

 

IObit Security 360

 

OS:Windows XP

Version:1.5.0.13

Define Version:2408

Time Elapsed:00:06:15

Objects Scanned:53586

Threats Found:6

 

|Name|Type|Description|ID|

Tracking Cookies, Cookies, Cookie:username@interclick.com/, 7-1905

Tracking Cookies, Cookies, Cookie:username@m.webtrends.com/, 7-2219

Tracking Cookies, Cookies, Cookie:username@turn.com/, 7-2167

Tracking Cookies, Cookies, Cookie:username@ancestry.com/, 7-1639

Trojan.Agent, File, C:\WINDOWS\system32\ntbackup.exe, 12-722

[enoskype]

Hi jseverson,

 

Most probably false positive, but please follow the procedure in Guidelines and Requirements for Reporting a False Positive. thread.

 

- Upload the file to VirusTotal and give the link to the analysis here in this thread.

 

- Upload the file to Wikisend and give the download link here in this thread for IObit to further investigate.

 

Cheers.

[jseverson]

ntbackup.exe False Positive?

 

IObit Security 360

 

OS:Windows XP

Version:1.5.0.13

Define Version:2408

Time Elapsed:00:06:15

Objects Scanned:53586

Threats Found:6

 

|Name|Type|Description|ID|

Tracking Cookies, Cookies, Cookie:username@interclick.com/, 7-1905

Tracking Cookies, Cookies, Cookie:username@m.webtrends.com/, 7-2219

Tracking Cookies, Cookies, Cookie:username@turn.com/, 7-2167

Tracking Cookies, Cookies, Cookie:username@ancestry.com/, 7-1639

Trojan.Agent, File, C:\WINDOWS\system32\ntbackup.exe, 12-722

 

VirusTotal Analysis:

http://www.virustotal.com/file-scan/report.html?id=f422e4e418f1f98d8c87aaa0a9d5855cf85f74a813070296011081ec3a1c2b74-1296400322

 

WikiSend Download Link:

http://wikisend.com/download/699430/ntbackup.zip

[jseverson]

Hi,

I followed the guidelines. Hopefully I did everything right. Thanks.

[wozofoz]

Hi,

I followed the guidelines. Hopefully I did everything right. Thanks.

Yep, except it is best to put your report in this thread to keep it neat and organised, so I moved it to here :smile:

 

All the best, woz of oz

[jseverson]

Sorry, I wasn't clear on which thread I was supposed to post it to. Thanks for moving it!

[1010101010101010101010101]

Me Too!! ( ntbackup.exe ) False Positive??

 

IObit Security 360

 

OS:Windows XP

Version:1.6.0.2

Define Version:2408

Time Elapsed:00:09:27

Objects Scanned:20972

Threats Found:1

 

|Name|Type|Description|ID|

Trojan.Agent, File, C:\WINDOWS\$NtServicePackUninstall$\ntbackup.exe, 12-722

 

http://www.virustotal.com/file-scan/report.html?id=b09dafbff29da8cacdfec2b783754306012f0ad86e42b39c8fd90bd4ba772ea2-1296709471

[1010101010101010101010101]

Are we being ignored??:???:

[enoskype]

Hi One Zero,

 

No, I think it is The Golden Rabbit Year! :lol:

 

Please let the probable FP rest in peace in the Ignore List until someone from IObit responds.:razz:

 

Cheers.

[1010101010101010101010101]

really???:?:

 

EDIT:YES, You see!:lol:

[hxin]

Hi all

 

We have solved this issue. PLS update and scan again.

 

Thanks & cheers