MBAM False Positive

Viruses and worms
1

Howdy malware fighters,

After updating and installing a new version of MBAM it alerted for Trjan.Agent Registry Value
HKEY_LOCAL_MACINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sispower
Value Sispower
SiSPower.dll is located in the folder C:\Windows\System32. Known file sizes on Windows XP are 49152 bytes (98% of all occurrence), 53248 bytes.
The program has a visible window. Program is loaded during the Windows boot process (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run). File SiSPower.dll is not a Windows system file. SiSPower.dll seems to be a compressed file. Therefore the technical security rating is 22% dangerous, however also read the users reviews.
Some malware camouflage themselves as SiSPower.dll, particularly if they are located in c:\windows or c:\windows\system32 folder. Thus check the SiSPower.dll process on your pc whether it is pest against virustotal…http://www.virustotal.com/analisis/57a151106224a29e17a628672ec336b7

So according to me a FP,

polonus

2

Thanks very much indeed Pol, I just updated and scanned,after reading your post.
I too get this false positive.Had I not read your post first, I would have panicked.Have posted on MBAM forum with others. Cheers :slight_smile:

3

They are usually very quick to correct any reported/confirmed FP, I recall sending an email and also registering and reporting it on their forum. Got a response on the email confirmation and correction via the forum also.

4

I had that False Positive on my XP Home system but the latest Update resolved it.

See:
http://www.malwarebytes.org/forums/index.php?showtopic=11210