Detected Data1.cab as malware ?

Message

newthinker · #1 Post by **newthinker** » Thu Jun 16, 2011 2:00 pm

Hi,

My Antivirus detected these two items as malware "pck themida"

C:\Program Files\MLPS\apps\DMFSD\Data1.cab
C:\SWTOOLS\APPS\DMFSD\Data1.cab

I just did some search on SWTOOLS and this MLPS directory and found a link to Lenovo's site. So are these files related to Lenovo and are they harmless?

Laptop: L512, Win 7 pro

ozzymud · #2 Post by **ozzymud** » Thu Jun 16, 2011 4:30 pm

most likely a false positve considering Lenovo files... but, to be totally safe, run them past http://virusscan.jotti.org/en

Is your AV detecting the virus INSIDE the cab? cab files are just archives of other files, like a ZIP file... if it is detecting the .CAB as a virus, it is for sure a false positive. If detecing on a file inside the cab, you can extract it, and check it on jotti. (may need to disable your virus engine 1st, as long as you don't run the exe/dll or open the doc/pdf/whatever... your safe. I generally don't use virus software (rely on common sense and jotti)... ain't had a virus since my workstation at work got the "I Love You" virus back in the 90's

If jotti shows on more then a few, it's a virus (some engines pick up certain legit tools as a virus, just gotta look up the virus if only a few see it as one). Virii with "gen" in the name are often harmless. I've seen anti virus show virii on files that I personally compressed with UPX. It's hit on certain command line tools as a PUP (potentially unwanted program)... You can't totally rely on anti virus apps.

newthinker · #3 Post by **newthinker** » Thu Jun 16, 2011 4:59 pm

Just like you i think it's false positive.
the cab file located in SWTOOLS directory is 253 MB, you can forget about uploading such a big file to virus total or jotti sites. The AV scanner detects the cab file itself as malware , not indicating any files inside the CAB file.

Still i would like to know more details about these files/directories, if other thinkpad users have them as well i suppose it can be trusted. Don't think Lenovo would install some malware on their products

ozzymud · #4 Post by **ozzymud** » Thu Jun 16, 2011 5:16 pm

this is "Corel DVD MovieFactory"... look inside the setup.ini located in the same directory

Detected Data1.cab as malware ?

Detected Data1.cab as malware ?

Re: Detected Data1.cab as malware ?

Re: Detected Data1.cab as malware ?

Re: Detected Data1.cab as malware ?

Who is online