Adlice forum

General Category => Malware removal help => Topic started by: Pkshadow on August 03, 2018, 05:05:23 AM

Title: Continued False Positive
Post by: Pkshadow on August 03, 2018, 05:05:23 AM

Continued False Positive of Firefox.  Submitted last time and was told prob went to a site that had EICAR on it.

Unfortunately I do not think that is the case.  I may do Support for Firefox but not been to many sites today
That could possibly have done that to Firefox.exe and it is marking all Processes 7 as Eicar.
Norton Internet Security full system scan today, Malwarebytes early eve daily and uploaded to Virus Total.
Nothing found.

 

Title: Re: Continued False Positive
Post by: Curson on August 03, 2018, 12:21:55 PM

Hi Pkshadow,

Welcome to Adlice.com Forum.
Could you please clear Firefox Cache, then redo a scan and check if the detection is still present ?

Regards.

Title: Re: Continued False Positive
Post by: Pkshadow on August 04, 2018, 02:16:49 AM

Hi, Cache cleaned 2 x's already, cookies cleaned 2x's.
Ms Disk Cleanup run.
Norton Utilities Privacy scan & empty done.

Found again.

Title: Re: Continued False Positive
Post by: Curson on August 04, 2018, 02:22:48 AM

Hi Pkshadow,

We need to retrieve more information.
Please follow the following process :

• Download Process Explorer (x64) (http://live.sysinternals.com/procexp64.exe) and save it to your desktop.
  
• Click on the setup file (procexp64.exe) and select Run as Administrator to start the tool.
  
• Locate the process named firefox.exe, do a right click on it and select Create Dump > Create Full Dump...
  
• Save the dump on your desktop and compress it.
• Upload it to Dropbox, Google Drive or similar services and share the link in your next reply.

Regards.

Title: Re: Continued False Positive
Post by: Pkshadow on August 04, 2018, 02:55:05 AM

Hi, you can close this. It is memory resident, same as last time.  Gone after reboot, open Firefox then close, and then scan and is clear.

Has to be some site am not suspecting as did not travel far.  Thanks

Title: Re: Continued False Positive
Post by: Curson on August 04, 2018, 07:11:45 PM

Hi Pkshadow,

Thanks for your feedback.
You are very welcome.

Regards.