False Positives for Mal/FakeMS-D?

Hello Bungle_Bear,

(ok, so Sandy beat me - but some words from the "other side" do no harm; might as well add some additional remarks)

please submit a sample to the labs (here's the Submitting samples of suspicious files to Sophos article). Looks like it was digging in an archive - are these results from a scheduled scan? If so, it might be simple to grab the file and submit it (but zip it up with a password). Otherwise please see Collecting samples blocked by on-access scanning (although, as it is likely not harmful, you could simply turn off on-access scanning for the few seconds needed to zip it).

Note that the articles mention zipping only when you send the samples by mail,  BUT - depending on your settings even the moved files might be intercepted. Once it is archived with a password it will neither be blocked nor can it do harm (unless of course you unpack it) so you can safely keep it (something I always do, whether for false positives or suspicous/malicious files, to verify that the updated detections work as expected).

False positives are encountered from time to time, usually with generic detection (and the analysis - if available - will ask you to submit a sample) but I also had a few "non-generic" cases and all indicated pretty old files. You should be careful with judging from the timestamps though - while malware most of the time doesn't care about them ou can't rule it out that it does. If you have a backup for comparison it's always a good idea to check it. Anyway - in all but one rather complex case updated detections were issued literall within hours and the problem was resolved.

Christian

Hello Bungle_Bear,

(ok, so Sandy beat me - but some words from the "other side" do no harm; might as well add some additional remarks)

please submit a sample to the labs (here's the Submitting samples of suspicious files to Sophos article). Looks like it was digging in an archive - are these results from a scheduled scan? If so, it might be simple to grab the file and submit it (but zip it up with a password). Otherwise please see Collecting samples blocked by on-access scanning (although, as it is likely not harmful, you could simply turn off on-access scanning for the few seconds needed to zip it).

Note that the articles mention zipping only when you send the samples by mail,  BUT - depending on your settings even the moved files might be intercepted. Once it is archived with a password it will neither be blocked nor can it do harm (unless of course you unpack it) so you can safely keep it (something I always do, whether for false positives or suspicous/malicious files, to verify that the updated detections work as expected).

False positives are encountered from time to time, usually with generic detection (and the analysis - if available - will ask you to submit a sample) but I also had a few "non-generic" cases and all indicated pretty old files. You should be careful with judging from the timestamps though - while malware most of the time doesn't care about them ou can't rule it out that it does. If you have a backup for comparison it's always a good idea to check it. Anyway - in all but one rather complex case updated detections were issued literall within hours and the problem was resolved.

Christian