ApplicUnsaf.Win32.Adware.cinmus.207[at]112438220

[Guest]

[john411]

Hey guys, hope you can help me out here,

I just installed Windows 7 home premium on a new rig (core i5 2500K) and when I wanted to install Adobe Flash Player the following occurred:

- Downloaded install_flashplayer10_mssd_aih.exe from get.adobe.com ; WOT green
- Scanned with Comodo AV as standard procedure
- Ran as administrator (context menu from user account) to install
- Grey install box pops up stating "Initializing"

Here comes the 'fun' part:

The file then mysteriously disappears in the download folder, Adobe spits out "Failed to Initialize" and Comodo tells me a trojan has been found: ApplicUnsaf.Win32.Adware.cinmus.207[at]112438220. I double checked the site I downloaded from. Checked my hosts file to see if it had somehow been tampered with; not the case. So I try again from a different flavor of Adobe's many sub sites (but still *.adobe.com!) and get a slightly different filename to download essentially the same product, but no go : same error.

Comodo Antivirus Events window:
C:\Users\<Username>\Appdata\Local\Solid State Networks\Host.<bunch of numbers>\downloader.dll.partial\ApplicUnsaf.Win32.Adware.cinmus.207[at]112438220

GMER:
 [Rootkit/Malware] tab:
     File : C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Temp -- 0 bytes
     File : C:\Program Files\COMODO\COMODO Internet Security\Quarantine\baseupd -- 0 bytes

So as far as GMER is concerned, no rootkit is actually installed but it does mention these 2 files, which is suspicious to say the least. I've run GMER on other rigs and never seen these entries before.

What's going on? This is a new comp with Windows installed only hours ago, Windows update until no more important updates remained after many reboots. I don't expect silly issues like this especially with something as common as an antivirus program (needed) and something as popular as Flash player (pretty much needed if you like Youtube, etc).

Any help is appreciated,
John

[Siketa]

False positive:

http://www.virustotal.com/file-scan/report.html?id=dd226f7174198abbbdfc87a64d278e4edc4493b87c13c412d35130cfb9f43d21-1310754113

EDIT: Weird...after 3 attempts, 2 installations were successful and 1 failed with cinmus AV detection.

[Ionel]

Hi,

We've identified the issue, a fix will be available soon. We'll get back to you when the update is live.

Thanks,
Ionel

[mengze.lin]

False positive:

http://www.virustotal.com/file-scan/report.html?id=dd226f7174198abbbdfc87a64d278e4edc4493b87c13c412d35130cfb9f43d21-1310754113

EDIT: Weird...after 3 attempts, 2 installations were successful and 1 failed with cinmus AV detection.

Hi siketa,
This FP has been fixed.Please check in virus signature database 9400.
Thanks and Regards,
Lin mengze

[Tags:]