samsung kies false postives. help please

LGG_2

malwarebytes appears to be showing kies as a false positive after looking through google so there seems to be no issue but can someone advise on the volume information restore at the bottom of the text. is that connected to klies. i did another scan and all the kies issues were gone but the 12 info restore issues came up again. please can someone advise

below are my first and second scan logs


Malwarebytes' Anti-Malware 1.50.1.1100
https://www.malwarebytes.org

Database version: 6443

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

25/04/2011 21:41:08
mbam-log-2011-04-25 (21-41-08).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 214330
Time elapsed: 53 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 12
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 24

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KiesHelper (Trojan.Agent) -> Value: KiesHelper -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\SAMSUNG\KIES\KIES.EXE (Trojan.Agent) -> Value: KIES.EXE -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\SAMSUNG\KIES\COMMON\KIES.COMMON.MEDIADB.DLL (Trojan.Agent) -> Value: KIES.COMMON.MEDIADB.DLL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\SAMSUNG\KIES\COMMON\KIES.COMMON.PIMS.DLL (Trojan.Agent) -> Value: KIES.COMMON.PIMS.DLL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\SAMSUNG\KIES\COMMON\KIES.COMMON.UTIL.DLL (Trojan.Agent) -> Value: KIES.COMMON.UTIL.DLL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\SAMSUNG\KIES\COMMON\KIES.TEST.PIMS.DLL (Trojan.Agent) -> Value: KIES.TEST.PIMS.DLL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\SAMSUNG\KIES\PLUGINS\ASTORE\ASTOREPLUGIN.DLL (Trojan.Agent) -> Value: ASTOREPLUGIN.DLL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\SAMSUNG\KIES\PLUGINS\DEVICEHOST\SYNCPROVIDER.DLL (Trojan.Agent) -> Value: SYNCPROVIDER.DLL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\SAMSUNG\KIES\PLUGINS\DISCRIPPING\DISCRIPPING.DLL (Trojan.Agent) -> Value: DISCRIPPING.DLL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\SAMSUNG\KIES\PLUGINS\MUSICSTORE\MUSICSTORE.DLL (Trojan.Agent) -> Value: MUSICSTORE.DLL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\SAMSUNG\KIES\PLUGINS\PHONEBOOK\PHONEBOOK.DLL (Trojan.Agent) -> Value: PHONEBOOK.DLL -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\SAMSUNG\KIES\PLUGINS\PHOTOMANAGER\PHOTOMANAGER.DLL (Trojan.Agent) -> Value: PHOTOMANAGER.DLL -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\program files\Samsung\Kies\kieshelper.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\Samsung\Kies\Kies.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\Samsung\Kies\Common\kies.common.mediadb.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\Samsung\Kies\Common\kies.common.pims.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\Samsung\Kies\Common\kies.common.util.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\Samsung\Kies\Common\kies.test.pims.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\Samsung\Kies\Plugins\AStore\astoreplugin.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\Samsung\Kies\Plugins\devicehost\syncprovider.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\Samsung\Kies\Plugins\discripping\discripping.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\Samsung\Kies\Plugins\musicstore\musicstore.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\Samsung\Kies\Plugins\phonebook\phonebook.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\Samsung\Kies\Plugins\photomanager\photomanager.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1086\A0140299.rbf (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1086\A0140340.rbf (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1086\A0140342.rbf (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1086\A0140344.rbf (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1086\A0140346.rbf (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1086\A0140614.rbf (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1086\A0140636.rbf (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1086\A0140641.rbf (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1086\A0140649.rbf (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1086\A0140650.rbf (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1086\A0140651.rbf (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1086\A0140785.exe (Trojan.Agent) -> Quarantined and deleted successfully.


second log


Malwarebytes' Anti-Malware 1.50.1.1100
https://www.malwarebytes.org

Database version: 6443

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

25/04/2011 23:49:17
mbam-log-2011-04-25 (23-49-17).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 212387
Time elapsed: 1 hour(s), 44 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 12

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1089\A0141221.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1089\A0141222.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1089\A0141223.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1089\A0141224.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1089\A0141225.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1089\A0141226.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1089\A0141227.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1089\A0141228.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1089\A0141229.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1089\A0141230.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1089\A0141231.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\RP1089\A0141232.dll (Trojan.Agent) -> Quarantined and deleted successfully.

closed

turn system restore off and back on

LGG_2

how do i do that and is this system volume info restore apart of the kies F.P? and theres nothing to worry about. thanks

LGG_2

ok i googled turning system restore off and got the below. b4 i go ahead can someone advise on what i have to do to create new restore points when i turn it back on. thanks


Disabling System Restore in Windows XP

Note: Turning off System Restore deletes all previous restore points. You must create new restore points once you turn System Restore back on.

1. Log on as the Administrator or with the details of the user that has administrator rights.
2. Close all open programs.
3. Right-click My Computer on Windows desktop.
4. Select Properties.
5. Click System Restore.
6. Check Turn off System Restore checkbox.
7. Click Apply and then Yes to delete all existing restore points.
8. Click OK and restart the computer.

To reactivate System Restore option

1. Follow the steps above, but in the step 4, uncheck "Turn off System Restore" checkbox.
2. Click Apply and then OK.
3. Click Yes, when you are prompted to restart Windows.

victor2

The system will create restore points as it deems necessary. However, you can manually create one if you wish. See http://support.microsoft.com/kb/948247

LGG_2

thanks. so no need to do anything then interms of creating restore points

LGG_2

just done another scan with malware and its come back all clear. even though ive yet to turn the system restore off and back on again. should i still go ahead and do this.will the system volume info keep poping up every so often during a scan if i dont or is it totally gone

victor2

If you switch off/on system restore it will clear what's in there, which includes copies of the trojan. If you don't, they will eventually disappear as the old restore images get overwritten.
If you do a restore from one of the infected images, it will come back, so I'd finish the job and get rid of them. You'll have no means of restoring to an eariler date if you do that though, so make sure you're happy with what you've now got, or have an alternative way to completely reset the machine should the need arise.

LGG_2

ok thanks for your help wil do a restore now