False positive? $NtServicePackUninstall$\wab.exe [SOLVED by db 1041]

[loops08]

Hello,

I got this result on my last scan. Is this a false positive. If so, can it still be deleted or should I leave it alone. I did do a search and take the time to check other posts before posting. So, if this has already been asked, I do apologize.

IObit Malware Fighter

 

OS: Windows XP

Version: 1.0.0.12

Define Version: 1040

Time Elapsed: 00:20:57

Objects Scanned: 64254

Threats Found: 1

Save Time: 7/2/2011 5:39:57 PM

 

|Name|Type|Description|ID|

Trojan.Generic, FILE, C:\WINDOWS\$NtServicePackUninstall$\wab.exe, 4041681

[Toppack]

The wab.exe is normally the 'Windows address book' in windows-mail,

but wheather yours may be a Trojan in discuise, I don't know.

It's also normally a system-hidden file I think?

I've heard of that WAB file getting corrupted before, but not because of a trojan.

And the folder it is in is not the same as Mail folder. $NtServicePackUninstall$ is a strange place for it to be.

It's also strange that there a folder named that.

 

I cartainly seems like a good place for one to be Hidden though.

So my guess is that it may be a Trojan or at least something that needs to be deleted.

 

Did you do an Internet search to see if anyone else is reporting it, as a trojan?

[Toppack]

Errors with that file must be Common.

I found this website with wab.exe error fixing Info:

http://www.errorhelpers.com/support/file-Wab.exe.html?keyword=wab.exe

[loops08]

Yes, I did an internet search. I'm not experiencing any problems. Just not sure if this is a false positive or trojan. My experience with files in the window folder is that even if I do a system backup using windows system restore tool before deleting the file, it doesn't always restore files remvoed by spyware tools. Hence, if I have problems afterwards, I can't reverse it. If this is a legitimate file, I wonder why no one else has detected it doing a full scan? Assuming there pc is up do date.

[enoskype]

Hi loops08, welcome to IObit Forum! :grin:

 

Did you check it uploading to IObit Cloud and VirusTotal?

 

Also, you can put it into Ignore List of IMF if you think it is a False Positive until it is decided.

 

Cheers.

[hxin]

Hello,

I got this result on my last scan. Is this a false positive. If so, can it still be deleted or should I leave it alone. I did do a search and take the time to check other posts before posting. So, if this has already been asked, I do apologize.

IObit Malware Fighter

 

OS: Windows XP

Version: 1.0.0.12

Define Version: 1040

Time Elapsed: 00:20:57

Objects Scanned: 64254

Threats Found: 1

Save Time: 7/2/2011 5:39:57 PM

 

|Name|Type|Description|ID|

Trojan.Generic, FILE, C:\WINDOWS\$NtServicePackUninstall$\wab.exe, 4041681

Hi loops08

 

Thanks for your feedback.

After investigation, we have assured that it's a false positive. Sorry for the trouble we have caused to you.

 

We will solve this issue in our later update definition 1401.