Page 1 of 2 12 LastLast
Results 1 to 10 of 17

Thread: mfc40.dll

  1. #1
    Junior Member
    Join Date
    Apr 2010
    Posts
    3

    Default mfc40.dll

    Having problems with mfc40.dll . Is this a false positive or is it really infected? There seems to be no problem caused so far but I'm still really worried. It's been 4 weeks and file is still detected on the heuristic portion. Cannot be deleted as the file is recreated even if secure shredder was used to delete it, probably because it is a critical Windows file. Really need help here.
    Last edited by tashi; 2010-11-25 at 08:07. Reason: Split off from different topic

  2. #2
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,662

    Default

    Hello Ravic,

    Please see How to report possible False Positives

    Best regards.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  3. #3
    Senior Member Yodama's Avatar
    Join Date
    Oct 2005
    Location
    Buchenheim
    Posts
    1,110

    Default

    It is not a critical system file in any case. If you have Visual C++ installed, the file may belong to that.
    It is best to follow the instructions linked by Tashi above and send in the file to detections@spybot.info with a reference to this thread.
    born in the shadow to die in the shadow, that is the fate of the shinobi

    Spybot S&D Downloads

    Please help us improve Spybot and download our distributed testing client.

  4. #4
    Junior Member
    Join Date
    Nov 2010
    Posts
    1

    Default Same here

    I can report the same issue since yesterdays update. SBI $DB0322C4.

  5. #5
    Junior Member
    Join Date
    Nov 2010
    Posts
    1

    Default False Positive: mfc40.dll

    Started seeing this with he latest update of S&D. Had me spooked, it's been a few years since I did a fresh install of Windows, so now was as good of time as any; mfc40.dll still shows, has to be a false positive of some type. When I did a fresh install I also did some repartitioning, so I know there is nothing left of the old file system at all.
    • Operating System: Windows XP Professional, fully updated
    • Browser and Version: FireFox v3.6.12
    • Version of Spybot S&D and Date: 1.6.2.46, 11/24/2010
    • Where did the false positive occur: Scan result


    Virtumonde.dll: [SBI $4792FFB9] Library (File, nothing done)
    C:\WINDOWS\system32\mfc40.dll
    Properties.size=924432
    Properties.md5=8F4CE043F4F6401EB05D21E8EC16D566
    Properties.filedate=1091620800
    Properties.filedatetext=2004-08-04 07:00:00

    If you need more info, please let me know.

  6. #6
    Junior Member
    Join Date
    Nov 2010
    Posts
    2

    Default Same Issue

    After updating yesterday and running scan - reports as a "Virtumonde.dll" in C:\Windows\System 32\mfc40.dll. Heuristic - Trojan c-05.

    Spybot - offers to refix - and reboot ....but after doing that, on re-scan it show up again.

    None of my other malware programs show it.
    Last edited by tashi; 2010-11-26 at 02:24. Reason: Merged Ironcleaver's topic

  7. #7
    Junior Member
    Join Date
    Nov 2010
    Posts
    1

    Default

    I can also report this same issue ($DBO322C4), happened immediately after I had Spybot updated today. Prior scan just before the update did not show this.

  8. #8
    Junior Member DarkGuyver's Avatar
    Join Date
    Nov 2010
    Posts
    6

    Default

    I've experienced the same problem since updating yesterday as well, also Spybot Search & Destroy has stated that my registry has been corrupted since I turn-off the Automatic Update Alert Me option on the Security Center on Windows XP.

    Also mfc40.dll is not an trojan, it is an genuine microsoft application which should not be deleted. Check here for more details: http://www.processlibrary.com/directory/files/mfc40/

  9. #9
    Retired
    Join Date
    Oct 2005
    Posts
    566

    Default

    Hello,
    I can confirm that this is a false positive that will be fixed with our next update scheduled for Wednesday

    Best regards,
    Markus
    Team Spybot

  10. #10
    Junior Member hemingray's Avatar
    Join Date
    Dec 2008
    Location
    Auburn, CA
    Posts
    14

    Default

    Could those of us who deleted it get some instructions on restoring it?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •