1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: Malwarebytes' "false positive?"

Discussion in 'General Security' started by redoak, Jan 28, 2011.

Thread Status:
Not open for further replies.
Advertisement
  1. redoak

    redoak Gone but never forgotten Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    6,782
    "Malwarebytes" says that "Broken.Open Command" is malware. This is in the Registry of "XP Pro." "AVG" and "Super Antispyware" do not.

    This item has appeared three consecutive times during my weekly scans.

    Is this a false positive?

    {redoak}
     
  2. Phantom010

    Phantom010 Trusted Advisor

    Joined:
    Mar 9, 2009
    Messages:
    34,796
    Is this the report you get?

    HKEY_CLASSES_ROOT\scrfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("%1" %*) Good: ("%1" /S) -> No action taken.

    If that's what you see, click Start > Run > type regedit.

    Go to:

    HKEY_CLASSES_ROOT\scrfile\shell\open\command

    In the right-hand pane, change the value "%1" %* for "%1" /S.


    If something similar, please give me the exact information.
     
  3. Byteman

    Byteman Gone but Never Forgotten

    Joined:
    Jan 24, 2002
    Messages:
    17,742
    Moving to General Security

    Probably others have been seeing this error.....thank you.
     
  4. redoak

    redoak Gone but never forgotten Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    6,782
    See the attached for the full registry reference.

    {redoak}
     

    Attached Files:

  5. Phantom010

    Phantom010 Trusted Advisor

    Joined:
    Mar 9, 2009
    Messages:
    34,796
    I would have prefered seeing the text report. It would have been more complete.

    Again, click Start > Run > type regedit

    Browse to:

    HKEY_CLASSES_ROOT\piffile\shell\open\command

    In the right-hand pane, make sure the value is "%1" %* and not ||"%1" %*

    Change accordingly.
     
  6. redoak

    redoak Gone but never forgotten Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    6,782
    I believe this is what you desired:
    HKEY_CLASSES_ROOT\piffile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: () Good: ("%1" %*) -> No action taken.

    I will proceed as you directed, if this confirms your diagnosis.

    Many thanks,
    {redoak}
     
  7. Phantom010

    Phantom010 Trusted Advisor

    Joined:
    Mar 9, 2009
    Messages:
    34,796
    OK, seeing your text report, I now understand why your screenshot was showing ||. The text report shows () (Bad). Therefore, it must mean that you don't have an entry in the right-hand pane of that registry key. So, you'll need to insert the (Good) "%1" %* and you should be all set. :)
     
  8. redoak

    redoak Gone but never forgotten Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    6,782
    "P-010":
    See the attachment. My Registry doesn't follow your example. Note "shellex," not simply "shell."

    {redoak} :confused:
     

    Attached Files:

  9. Phantom010

    Phantom010 Trusted Advisor

    Joined:
    Mar 9, 2009
    Messages:
    34,796
    Then, you'll have to create the registry key:

    Browse to: HKEY_CLASSES_ROOT\piffile

    Right-click on piffile.

    Click New > Key

    Type shell.

    Then, right-click shell and click New > Key.

    Type open.

    Right-click open and click New > Key

    Type command.

    In the right-hand pane, double-click the default entry and type "%1" %*.

    Exit the registry editor and you should be all set. You may have to reboot though for changes to take effect.
     
  10. Phantom010

    Phantom010 Trusted Advisor

    Joined:
    Mar 9, 2009
    Messages:
    34,796
    So, redoak, getting the hang of it? :)
     
  11. Phantom010

    Phantom010 Trusted Advisor

    Joined:
    Mar 9, 2009
    Messages:
    34,796
    Looks like you've solved your problem. Glad you did! [​IMG]

    You're quite welcome!
     
  12. redoak

    redoak Gone but never forgotten Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    6,782
    Yes! After creating the key from your detailed instructions, a Malwarebytes scan just now ran flawlessly.

    I did have to use the right-click menu item "Rename" before I could put in the names of the new sub-keys. When I went directly to typing in the name, I was sent to a key alphabetically in the huge list of keys.

    Once again, many thanks,
    {redoak}

    This was delayed when some one came to visit as I was drafting it following clicking "solved."
     
  13. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/977550

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice