Mal/EncPk-AAK.. Should I be concerned?

[fairm010]

SEC has just flagged up to one of the machines having Mal/EncPk-AAK with the path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb.

 

Is this a cause for concern or a false positive, I cant find anything on the web at all!

[fairm010]

Anyone?

[fairm010]

Can anyone help on this one?

[kmount]

I'd just clean it / rebuild the machine.

 

Plenty of mention of this particular infection on the internet suggesting it's legit so worth cleaning up and moving on.

[psydii]

Looks like to this: http://www.sophos.com/en-us/support/knowledgebase/118310.aspx

 

Also F Secure: have a similar article: http://www.f-secure.com/v-descs/other_w32_generic.shtml

 

I'm pretty sure that this is a false positive. A Trojan is unlikely to be trying to hide out as a JET database.... That is more of an APT style subterfuge.

Edited March 16, 2014 by psydii

[kmount]

Good call on the link there @psydii

[fairm010]

I was convinced it was a false pos but thought I'd ask. I'll probably just re image anyway.

[synaesthesia]

tmp.edb in that location is legitimate - I would hazard a guess at being part of the windows search indexing system. False positive, don't rebuild; you'll be rebuilding *all* your systems if you check anything on win7+ for that file!

[Alis_Klar]

Got this on weekly scan. Interesting that it found in 2Simple Collection. Really annoys me that sophos info pages about viruses invariably are devoid of any usefull information.

 

File "C:\Program Files (x86)\2Simple Software\2Simple collection\2Type\Admin Settings\reportTool.exe" belongs to virus/spyware 'Mal/EncPk-AAK'.

 

Registry value "HKU\S-1-5-21-555032959-2862063602-2195562804-3888\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun" belongs to virus/spyware 'Mal/EncPk-AAK'.

 

Registry value "HKU\S-1-5-21-555032959-2862063602-2195562804-3613\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun" belongs to virus/spyware 'Mal/EncPk-AAK'.

 

Virus/spyware 'Mal/EncPk-AAK' has been removed.

[fairm010]

I'm getting it on more than just the tmp.edb. Getting it on various other bits of software now!

[psydii]

Have you submitted samples to Sophos for evaluation? At the very least it should help them tweak the detection to avoid the false positive.

 

Also here is an update to recommended exclusions, with a copy-paste list (it's so easy now to import into Sophos!)

 

http://configmgrblog.com/2012/05/09/anti-virus-scan-exclusions-for-configuration-manager-2012/

Edited June 29, 2015 by psydii

[fairm010]

I've not, as I have no idea how.

[psydii]

https://www.sophos.com/en-us/support/knowledgebase/11490.aspx