After an un-attended scan, ver# 8.0.2.27 on Windows XP Pro SP3, detected "c:program fileswinrarwinrar v3.41 final trial to full by great elmo!!.exe" and a subsequent scan found "c:windowssystem32cmdlineext03.dll". First file was cleaned but the second I searched and suspect this may be a false positive. I removed the winrar exe positive as I never use it anyway, but still suspect a false positive.
Malwarebytes and AVG have not tugged at these files ever. Just finished scans with these other two protectors came up clean, zero infections or malware.
Any conformation or clarification is appreciated.
Solved
Possible false positives?
Best answer by jbiel
Fast turnaround with the support. Resolved as follows.
Hello,
The winrar v3.41 final trial to full by great elmo!!.exe file is a crack/patch/keygen file which we do not normally detect. The detection on that file has been reversed, but due to the nature of the file we would not consider that to be a False Positive in the traditional sense.
The c:windowssystem32cmdlineext03.dll file is a suspicious file, but does appear to be a false positive, and the detection has been reversed.
Thanks,
Webroot Threat Research
Posted for others that may see these pop.
Many thanks.
View originalHello,
The winrar v3.41 final trial to full by great elmo!!.exe file is a crack/patch/keygen file which we do not normally detect. The detection on that file has been reversed, but due to the nature of the file we would not consider that to be a False Positive in the traditional sense.
The c:windowssystem32cmdlineext03.dll file is a suspicious file, but does appear to be a false positive, and the detection has been reversed.
Thanks,
Webroot Threat Research
Posted for others that may see these pop.
Many thanks.
Hey jbiel,
Welcome to the Webroot Community and thanks for posting! :D
The best way to find out it if a file in question is a false positive is to open a support ticket so our Threat Research team can look into it and double check for you. Not only will you get a definite answer, but also, if it is a false positive, we can whitelist the file so it won't show up as a threat anymore for any other Webroot SecureAnywhere user either!
Just follow the aforementioned link and follow the prompts to submit the ticket. You can just copy and paste your post and title it something like "Possible False Positive" and select "Threat Found-False Positive" for the category to ensure it gets over to the right place faster!
Let me know if you have any more questions!
Welcome to the Webroot Community and thanks for posting! :D
The best way to find out it if a file in question is a false positive is to open a support ticket so our Threat Research team can look into it and double check for you. Not only will you get a definite answer, but also, if it is a false positive, we can whitelist the file so it won't show up as a threat anymore for any other Webroot SecureAnywhere user either!
Just follow the aforementioned link and follow the prompts to submit the ticket. You can just copy and paste your post and title it something like "Possible False Positive" and select "Threat Found-False Positive" for the category to ensure it gets over to the right place faster!
Let me know if you have any more questions!
+56Hello jbiel and Welcome to the Webroot Community Forums!
May I ask where you got v3.41 as on my PC and there Website shows v4.20 why would you use such an older version?
TH
EDIT: I see that you really don't use it sorry!
May I ask where you got v3.41 as on my PC and there Website shows v4.20 why would you use such an older version?
TH
EDIT: I see that you really don't use it sorry!
Not sure where or when I got this zip utility. Haven't used it in ages. That's why I had no issue removing the possible infection. Was just suprised that it was flagged.
I will open a support ticket.
Thanks for pointing me to the right direction
Thanks for pointing me to the right direction
Fast turnaround with the support. Resolved as follows.
Hello,
The winrar v3.41 final trial to full by great elmo!!.exe file is a crack/patch/keygen file which we do not normally detect. The detection on that file has been reversed, but due to the nature of the file we would not consider that to be a False Positive in the traditional sense.
The c:windowssystem32cmdlineext03.dll file is a suspicious file, but does appear to be a false positive, and the detection has been reversed.
Thanks,
Webroot Threat Research
Posted for others that may see these pop.
Many thanks.
Hello,
The winrar v3.41 final trial to full by great elmo!!.exe file is a crack/patch/keygen file which we do not normally detect. The detection on that file has been reversed, but due to the nature of the file we would not consider that to be a False Positive in the traditional sense.
The c:windowssystem32cmdlineext03.dll file is a suspicious file, but does appear to be a false positive, and the detection has been reversed.
Thanks,
Webroot Threat Research
Posted for others that may see these pop.
Many thanks.
Hello jbiel, Welcome to the Webroot Community Forum. :D
Thank you for posting the reply from the Webroot Threat Research Team. 😉
Thank you for posting the reply from the Webroot Threat Research Team. 😉
+4Thanks for posting the reply. Glad everything was sorted out!
Reply
Login to the community
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.