Solved Emsisoft detected Trojan.BAT.Delete!IK

I ran Emsisoft's "smart scan" and the above threat was detects.

More info:

File c:Windows\w7sbc\change.bat
File c:windows\w7sbc\restore.bat

This is from that program "Windows 7 Start Button Changer v 2.6" which is used by many people.

This must be a false positive?

I have not use Emsisoft to fix the issue yet, I would like some opinions please.

Malwarebytes
SuperAntiSpyware
Hitman Pro
MSE

all found nothing.

I have no personal experience with the program, but considering that MSE and MBAM didn't detect anything then I would say that it is probably clean. If you want to be sure, then upload the file that was detected to:

http://www.virustotal.com

This site will scan a file against the definitions of many different anti viruses, and you will be given a percentage of detections. This should be a good indicator as to whether it is a false positive or not.

Tom

tom982 said:

I have no personal experience with the program, but considering that MSE and MBAM didn't detect anything then I would say that it is probably clean. If you want to be sure, then upload the file that was detected to:

http://www.virustotal.com

This site will scan a file against the definitions of many different anti viruses, and you will be given a percentage of detections. This should be a good indicator as to whether it is a false positive or not.

Tom

Click to expand...

Virustotal Report:

File c:Windows\w7sbc\change.bat

Ikarus T3.1.1.84.0 2010.06.16 Trojan.BAT.Delete

a-squared 5.0.0.26 2010.06.16 Trojan.BAT.Delete!IK
(All others did not detect anything)

File c:windows\w7sbc\restore.bat

a-squared 5.0.0.26 2010.06.16 Trojan.BAT.Delete!IK
Ikarus T3.1.1.84.0 2010.06.16 Trojan.BAT.Delete

(All others did not detect anything)

Opinions?

I believe it says a trojan, since the .bat file changes the system files(explorer.exe). You must be safe when MSSE and MBAM is guarding your computer.

Yes and the virutotal report has shown that the most reliable anti virus programs think that it is clean. I wouldn't worry about it.

If I were you, I would remove emisoft and just remain with MSE and MBAM, these two should protect your system sufficiently.

Tom

It appears to be a false positive.

Emsisoft are known for their very high detection rate at a cost to a high false positive rate.

tom982 said:

Yes and the virutotal report has shown that the most reliable anti virus programs think that it is clean. I wouldn't worry about it.

If I were you, I would remove emisoft and just remain with MSE and MBAM, these two should protect your system sufficiently.

Tom

Click to expand...

"remove emsisoft" ?
why ?
sometimes you get a false positive, that happens with other antivirus-programs too...
yes, if Virustotal says those files are clean , then don´t worry about them.

RoloDman: what Emsisoft-program are using ?
if you are using a-squared, then add those 2 detected programs to the "whitelist".
problem solved...

malexous: "Emsisoft are known for their very high detection rate at a cost to a high false positive rate."

yes, a-squared has a very good detection-rate.
but where did you read about "high false positive rate" ?

on my computer a-squared has a very low false positive detection-rate, it only detected 1 single false positive,
my other A/V-programs detects a lot more.
i have some (safe) securitytest-programs in a folder that fx. makes MSE scream...

if you get too many false positives, then you can reduce the sensitivity,
and if you are worried it misses something, then you can also enhance the sensitivity.

hackerman1 said:

tom982 said:

Yes and the virutotal report has shown that the most reliable anti virus programs think that it is clean. I wouldn't worry about it.

If I were you, I would remove emisoft and just remain with MSE and MBAM, these two should protect your system sufficiently.

Tom

Click to expand...

"remove emsisoft" ?
why ?
sometimes you get a false positive, that happens with other antivirus-programs too...
yes, if Virustotal says those files are clean , then don´t worry about them.

RoloDman: what Emsisoft-program are using ?
if you are using a-squared, then add those 2 detected programs to the "whitelist".
problem solved...

malexous: "Emsisoft are known for their very high detection rate at a cost to a high false positive rate."

yes, a-squared has a very good detection-rate.
but where did you read about "high false positive rate" ?

on my computer a-squared has a very low false positive detection-rate,
it only detected 1 single false positive,
my other A/V-programs detects a lot more.
i have some (safe) securitytest-programs in a folder that fx. makes MSE scream...

if you get too many false positives, then you can reduce the sensitivity,
and if you are worried it misses something, then you can also enhance the sensitivity.

Click to expand...

I am using A-Squared Free version 4.5.0.27. I white listed the detections as you said. Thank you.

RoloDman: you are welcome.
thanks for the rep.

perhaps you already know that a-squared has won a lot of awards ?
if not, then take a look at Emsisoft...
it´s very good at detecting, it also works very well together with other antivirus-programs.
previously i used a2-FREE together with Avira, but now i´m using a2-FULL,
actually it´s the only antivirus-program that i´ve used for the last couple of months.

i also have Avast & MSE installed, but their realtime-protection is temporarily turned off,
as i wanted to see if i detected any difference in performance.
i regularly scan with Avast, MSE & MBAM just to see if a2 has missed something.

some info about a-squared, which i posted in another thread a few days ago:

"actually, a-squared (a2) has a lot better detectionrate than MBAM....
Whis is the Best? A-squared Free Vs Malwarebytes' Anti-Malware
Which is the Best? MBAM vs A-squared Part 2
"
"get both MBAM & a2.
no antivirus / antimalware-program can detect everything,
that´s why it´s a very good idea to use several different programs to scan your computer."

for more info about security-programs take a look at my signature...

hackerman1 said:

tom982 said:

Yes and the virutotal report has shown that the most reliable anti virus programs think that it is clean. I wouldn't worry about it.

If I were you, I would remove emisoft and just remain with MSE and MBAM, these two should protect your system sufficiently.

Tom

Click to expand...

"remove emsisoft" ?
why ?
sometimes you get a false positive, that happens with other antivirus-programs too...
yes, if Virustotal says those files are clean , then don´t worry about them.

RoloDman: what Emsisoft-program are using ?
if you are using a-squared, then add those 2 detected programs to the "whitelist".
problem solved...

malexous: "Emsisoft are known for their very high detection rate at a cost to a high false positive rate."

yes, a-squared has a very good detection-rate.
but where did you read about "high false positive rate" ?

on my computer a-squared has a very low false positive detection-rate, it only detected 1 single false positive,
my other A/V-programs detects a lot more.
i have some (safe) securitytest-programs in a folder that fx. makes MSE scream...

if you get too many false positives, then you can reduce the sensitivity,
and if you are worried it misses something, then you can also enhance the sensitivity.

Click to expand...

Because MSE and MBAM are better.

Tom

tom982: have you read my post above ?
"actually, a-squared (a2) has a lot better detectionrate than MBAM....
Whis is the Best? A-squared Free Vs Malwarebytes' Anti-Malware
Which is the Best? MBAM vs A-squared Part 2
"

anyway, also posted above: "no antivirus / antimalware-program can detect everything, that´s why it´s a very good idea to use several different programs to scan your computer."

so even IF a2 had less detectionrate then fx. MBAM, there is no need to remove a2.
although a2 is better i also have MBAM installed, i regularly scan with Avast, MSE & MBAM just to see if a2 has missed something.
don´t remove a2 just because it has detected a false positive, keep both a2 & MBAM.

going by your logic i should remove MSE, because it detects a lot more false positives then a2,
and then when Avast detects a FP, i should remove Avast....

of course it must be better to have an active antivirus-program that detects a few positives instead of a sleeping antivirus-program that misses 1 REAL virus / malware ?

hackerman1 said:

tom982: have you read my post above ?
"actually, a-squared (a2) has a lot better detectionrate than MBAM....
Whis is the Best? A-squared Free Vs Malwarebytes' Anti-Malware
Which is the Best? MBAM vs A-squared Part 2
"

anyway, also posted above: "no antivirus / antimalware-program can detect everything, that´s why it´s a very good idea to use several different programs to scan your computer."

so even IF a2 had less detectionrate then fx. MBAM, there is no need to remove a2.
although a2 is better i also have MBAM installed, i regularly scan with Avast, MSE & MBAM just to see if a2 has missed something.
don´t remove a2 just because it has detected a false positive, keep both a2 & MBAM.

going by your logic i should remove MSE, because it detects a lot more false positives then a2,
and then when Avast detects a FP, i should remove Avast....

of course it must be better to have an active antivirus-program that detects a few positives instead of a sleeping antivirus-program that misses 1 REAL virus / malware ?

Click to expand...

Yes I did read your post above, but you can't believe what you read in one article which for all we know could have been written by a squared.

If I were you, I would remove emisoft and just remain with MSE and MBAM, these two should protect your system sufficiently.

Click to expand...

Did you read my post above? Please note the "If I were you" part, it means that it is my personal preference.

Tom

hi !

tom982 said:

hackerman1 said:

tom982: have you read my post above ?
"actually, a-squared (a2) has a lot better detectionrate than MBAM....
Whis is the Best? A-squared Free Vs Malwarebytes' Anti-Malware
Which is the Best? MBAM vs A-squared Part 2
"

anyway, also posted above: "no antivirus / antimalware-program can detect everything, that´s why it´s a very good idea to use several different programs to scan your computer."

so even IF a2 had less detectionrate then fx. MBAM, there is no need to remove a2.
although a2 is better i also have MBAM installed, i regularly scan with Avast, MSE & MBAM just to see if a2 has missed something.
don´t remove a2 just because it has detected a false positive, keep both a2 & MBAM.

going by your logic i should remove MSE, because it detects a lot more false positives then a2,
and then when Avast detects a FP, i should remove Avast....

of course it must be better to have an active antivirus-program that detects a few positives instead of a sleeping antivirus-program that misses 1 REAL virus / malware ?

Click to expand...

Yes I did read your post above, but you can't believe what you read in one article which for all we know could have been written by a squared.

If I were you, I would remove emisoft and just remain with MSE and MBAM, these two should protect your system sufficiently.

Click to expand...

Did you read my post above? Please note the "If I were you" part, it means that it is my personal preference.

Tom

Click to expand...

well, if you take a good look at those 2 links, you will see who wrote the article: Donna Buenaventura,
and WE know who she is, which YOU obviously don´t....
she is a well known and respected member of the "security-community" !

our own security-expert Corrine knows Donna, so i suggest you ask Corrine regarding Donna´s article about MBAM & a2.

and yes, i read your post, that´s why i asked "why remove emsisoft ?"...
and of course it´s YOUR "personal preference", who else´s ?

hackerman1 said:

"actually, a-squared (a2) has a lot better detectionrate than MBAM....
Whis is the Best? A-squared Free Vs Malwarebytes' Anti-Malware
Which is the Best? MBAM vs A-squared Part 2
"

Click to expand...

hackerman1 said:

well, if you take a good look at those 2 links, you will see who wrote the article: Donna Buenaventura,
and WE know who she is, which YOU obviously don´t....
she is a well known and respected member of the "security-community" !

our own security-expert Corrine knows Donna, so i suggest you ask Corrine regarding Donna´s article about MBAM & a2.

Click to expand...

Yes, I know and respect Donna. She is a Microsoft MVP, site owner of Calendar of Updates, has her own blog and also provides (paid) reviews for Brighthub.

Note: The Brighthub reviews are from last October. The way malware evolves as well as the way programs like Emisoft and MBAM respond to that evolution adds a question to an old review. Point of fact, MBAM released Version 1.46 on April 29, 2010 and Emisoft released version 5.0 on May 10, 2010. Thus, I would not put so much weight on those reviews.

I know a lot of people who prefer Emisoft and also know that Donna has supported (but does not work for) A-2 since its inception (some time around 2004). I also know what I use and what I see security experts tending to use in the forums. (Take a look at the public Bleeping Computer Virus, Spyware, & Malware Removal Guides .)

Let's just say that just as years ago some people preferred AAW and others SBSD, today others feel the same way about MBAM, SAS, Emisoft and other similar programs.

The important thing is to use the program that you are comfortable with. If you don't like the way the settings work or it seems to miss things, then it is time to look around. If it works for you, works well with your other software programs, has good support, frequent updates, etc. then that is the right program for you.

Full Disclosure: I tried A-2 when it was first released and it did not work well on my computer (I believe Windows XP at the time). I also participated in a private beta program for A-2 on the old Castle Cops site. I had problems with it and was working with Christian. Unfortunately, he got involved elsewhere and the problem(s) were never resolved. So, in truth, A-2 has never been high on my list.

Corrine: "Note: The Brighthub reviews are from last October. The way malware evolves as well as the way programs like Emisoft and MBAM respond to that evolution adds a question to an old review. Point of fact, MBAM released Version 1.46 on April 29, 2010 and Emisoft released version 5.0 on May 10, 2010. Thus, I would not put so much weight on those reviews.
"

Corrine: yes, you are correct, that test was done a while ago, of course things might well have changed since then.
but, until we see another (newer) test about MBAM vs. a2, this is the last known facts....
that was my point on the subject that "MBAM is better then a2".
i´m really looking forward to see another comparison between MBAM & a2.

as you pointed out yourself above: "Emisoft released version 5.0 on May 10, 2010"
if you haven´t tried a2 since the first release when you used XP, then perhaps you should ?
a2 (now EAM) v5 it´s working well on both W7 & Windows Server 2008.

for those that don´t know, take a look at my signature: i also use MBAM...
actually, i scanned a file with a2, MSE, Avast and MBAM an hour ago...

update
i added a missing line: "as you pointed out yourself above: "Emisoft released version 5.0 on May 10, 2010" "
edited: if you haven´t tried a2 since the first release when you used XP, then perhaps you should ?

Sorry, it was just my personal opinion. And i certainly didn't mean to insult Donna at all, I was only making a point.

Tom

Corrine: i wrote "well, if you take a good look at those 2 links, you will see who wrote the article: Donna Buenaventura,
and WE know who she is, which YOU obviously don´t....
she is a well known and respected member of the "security-community" !"
"our own security-expert Corrine knows Donna, so i suggest you ask Corrine regarding Donna´s article about MBAM & a2."

i made a small mistake.
actually i was thinking about your friend, the teacher at the college / university, i can´t remember her name right now.
but i believe you know who i mean...

hackerman1 said:

{Snip}

update
i added a missing line: "as you pointed out yourself above: "Emisoft released version 5.0 on May 10, 2010" "
edited: if you haven´t tried a2 since the first release when you used XP, then perhaps you should ?

Click to expand...

I also pointed out that MBAM was updated.

I'm perfectly happy with what I have on my computers now so see no need to play with other programs.

tom982 said:

Sorry, it was just my personal opinion. And i certainly didn't mean to insult Donna at all, I was only making a point.

Tom

Click to expand...

tom982 said:

Sorry, it was just my personal opinion. And i certainly didn't mean to insult Donna at all, I was only making a point.

Tom

Click to expand...

Hi, Tom.

Please don't be concerned. In no way did you insult Donna.

hackerman1 said:

Corrine: i wrote "well, if you take a good look at those
i made a small mistake.
actually i was thinking about your friend, the teacher at the college / university, i can´t remember her name right now.
but i believe you know who i mean...

Click to expand...

Sorry, my mind is blank but it is of no matter.

Edit note: I know who you mean now, thanks.

Corrine;795998[QUOTE="tom982 said:

Sorry, it was just my personal opinion. And i certainly didn't mean to insult Donna at all, I was only making a point.

Tom

Click to expand...

tom982 said:

Sorry, it was just my personal opinion. And i certainly didn't mean to insult Donna at all, I was only making a point.

Tom

Click to expand...

Hi, Tom.

Please don't be concerned. In no way did you insult Donna.
[/QUOTE]

Well thats good to know I've only been here a few weeks, so making an enemy wouldn't be a good start.

Tom

hackerman1 said:

but where did you read about "high false positive rate" ?

Click to expand...

Different users at different websites. It appears that the false positive rate has improved over the last year but is still a concern for some.

Review released yesterday:
Emsisoft Anti-Malware Review - Emsisoft Anti-Malware Download - Softpedia

Further testing revealed that there is a high probability for the app to pick up innocent items and mistake them for malware.

Click to expand...