Security → Malwarebytes and IME - False Positive?

I'm on a Windows 8 PC, and updated to the latest definitions from Malwarebytes last night. I was surprised when Malwarebytes found two items in the IME folder(system 32 folder). One was imtcui.dll, and another folder. Something about a Trojan.Agent.BDAVgen bit. I did a Google Search, and there was no hits/trace of that name.

Of course I uploaded the .dll to Virus Total, and Malwarebytes was the only one to flag it. I also ran scans with Eset, Spybot, Kaspersky, and Windows Defender, and nothing came up. imtcui was listed as last being modified/used on 7/25/2012. Malwarebytes seemingly cleaned both instances, and not the imtcui.dll file is back, but everything registers it as clean.

I keep Malwarebytes and my other programs updated daily, and since this file has been sitting on my computer since I bought it earlier this year, it has never been flagged. Only with the most recent Malwarebytes definitions did it get flagged. Nothing else has come up or been out of the ordinary on my computer, aside from that hit.

I know I'm rambling, but is this a False Positive?

I tried to scan it for you on my windows 8 system, but I don't have office 2007 installed and it appears that imtcui.dll is part of office 2007.

That's the thing. I don't have Office installed on my system, as I bought a prebuilt. I have an IME folder though, and everything checks out fine. My concern was that this file/folder had been on my system since activation, and through hundreds of scans from Malwarebytes, Windows Defender, Spybot and etc. over those months, nothing came up.

Only after a Malwarebytes definition update, did it flag both files, and Malwarebytes was the only one to pick something up, according to VirusTotal. The last item I installed was an Adobe Flash update on the 14th(from Adobe's site, the usual). I'm trying to get down to the bottom of it, as the file is back, and everything registers it as clean and it's a MS file.

I do have Malwarebytes running a full scan as admin, I'll post back if it finds it.

Malwarebytes Anti-Malware 1.75.0.1300
Database version: v2013.05.23.11

edit: scan found nothing.
System win8pro64

OK I found it:

Did some searches and I do have under this dir on Win8pro64:
C:\Windows\System32\IME\IMETC\imtcui.DLL

Malwarebytes does NOT trigger on it on my system.

size: 605 KB (619,520 bytes) sod: 608 KB (622,592 bytes)

You can check here at Malwarebytes' False Positive Forum to see if it is a FP:

»forums.malwarebytes.org/ ··· forum=42

Or, if you still are unsure:

»Security Cleanup FAQ »Mandatory Steps Before Requesting Assistance

Thank you for the link lordpuffer. There is nothing on the Malwarebytes site, and programs listed in the second have found nothing either.

I think I'm going to chock this up as a False Positive, as nothing else has found an issue among many tools, different scanners, and Malwarebytes being the only thing to pick it up after months of it sitting as a normal file on my PC.

tom servo, you need to discuss this issue with malwarebytes.. if it is a false-positive, malwarebytes needs to know about it so that they can fix it..

> One was imtcui.dll

Where, in what directory, was it found?

> appears that imtcui.dll is part of office 2007

Perhaps, but certainly not solely.

> I uploaded the .dll to Virus Total

Link to your submittal?

As it is, I have it here, C:\Windows\System32\IME\IMETC10\imtcui.DLL.

Win7 x64, 421,888 bytes, 07/13/2009.
SHA1: 123c08aed9154f0885e482e8f35b864f4dc624f85402349012f763f0c913d62a

I made an account and posted, just to be safe, on the Security Cleanup forum. When I try to click on my topic, it's listed as "locked" for me. Should I repost it, or is this normal?

you said that the file was automatically restored, right? and apparently malwarebytes is no longer flagging it, right? so just let it go..

i wouldn't worry about your post's being locked, in the "security cleanup" forum.. in the future, if you need help, in the "security cleanup" forum, just go ahead and start a new thread, there..

is it normal for a post to be locked, in the "security cleanup" forum? yes, under certain circumstances..

at the top of the "security cleanup" forum, there is a message, "mandatory steps before requesting assistance".. you need to read that before posting in the "security cleanup" forum..

I agree with redwolfe_98 . If Malwarebytes is no longer flagging it, then it had something to do with the definitions at the time. If it were me, I would feel safe at this point.

What is or was being detected is what the heuristics picked up that must have matched a similar trait or string or thread.
The gen suggests a generic detection, in other words "behavior was similar to" type detection.

At least is is usually how the detection by heuristics is labelled with most A/V software, I don't see that there would need to be a change in MBAM's labeling.

Trojan detection,
BDAV, Win32.

Ref: »[Trojan] Possible Infection/Peace of Mind