Solved MalwareByte Scan Report

[wanchoo]

After updating MalwareBytes Database, I did a quick scan today. It identified one malicious item as follows.

Registry Keys Detected: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\itunes.exe (Security.Hijack) -> No action taken.

Of course I ignored it but why is an iTunes Registry entry being identified as a malicious item? I have been using my iTunes for ever but MalwareBytes had never identified this entry as malicious earlier.

Could someone please give me an answer.

 

[Maguscreed]

IFEO's, which is what this is, aren't always bad. In fact what triggered this is fairly commonplace in both good and bad apps.

In this particular case if itunes is working properly I wouldn't be too worried about it.

 

[EzioAuditore]

Of course I ignored it but why is an iTunes Registry entry being identified as a malicious item

Because many malware use this as a loop hole to launch themselves at startup. Its just a general mechanism of redirecting what application gets launched, so, lets take notepad.exe for example. I can make a key named notepad.exe but have it pointed to badapp.exe . Now everytime you try to launch notepad, instead of it, that badapp.exe will open.

But in this case, if this is the only thing your getting from the scan, then its most likely just a false positive.

You can do an online scan with Eset or Kaspersky if you want also if you've any doubts..

 

[wanchoo]

Thank you Maguscreed and EzioAuditore. Incidentally what is IFFO. Checked in Google but didn't get any satisfactory information.

 

[Maguscreed]

kind of hard to explain to someone really.
It would help if you googled the right acronym though.
IFEO

 

[wanchoo]

Thanks Maguscreed. Earlier I had mistyped. After getting your message I typed correctly, googled and found out.

kind of hard to explain to someone really.
It would help if you googled the right acronym though.
IFEO