Solved

Suspected false positive for Nook Demo


Webroot is reporting a trojan infection of Nook Demo (com.customermobile.bn.nook.v1). I initially selected remove, but webroot reported it was not able to remove it. Investigating on-line, I learned this component is baked into the Nook HD+ Android OS and that McAfee has also been known to incorrectly flag it.
 
I installed Malwarebytes to get a second opinion, and its scan did not report any problems.
 
Please provide an email addres for me to send the collected data and logs.
 
Best regards,
 
Curt
icon

Best answer by Rakanisheu Retired 26 May 2014, 12:05

View original

4 replies

Userlevel 7
I am working on this at the moment I will update as soon as I have more information.
Userlevel 7
Hi curts
 
Welcome to the Community Forums.
 
EDIT: Ah, I see that Roy has beaten me to it...so the information is for future reference...as it would have gotten the information to the Threat Researcher...but they have it already. :D 
 
Have done a bit of checking based on the information that you have provided and would concur with your view that it is most like an FP.  Also, as this affects an OS componenet then WSA will not be able to remove, and you should not try to by other means as you could well damage the OS irreparably and therefore have to reinstall it.
 
The best thing that you can do is to Open a Support Ticket including either the link to this thread or by repating all the information provided here so that the Support Team can pick this up, invetsigate and confirm that it is an FP and then whitelist the file concerned.
 
The ticket submission automatically upload the latest Scan Log to the Support Teamn and from that they should be able to isolate the file and investigate.  Let me know if you need/would like to know how to look at the Scan Log (for future reference) and I will be pleased to advise. :D
 
Regards
 
 
Baldrick
Support ticket succesfully submitted and false positive status confirmed.
 
Best regards,
 
Curt
Userlevel 7
Hi curts
 
Thanks for the feedback.  As soon as Roy (one of Webroot's professional Threat Researchers, as well as a Mod here) advised he was on it there was probably no further need to submit the ticket...but no harm done.  In the circumstances it was the right thing to do...and in the end the same result has occurred.
 
Regards
 
 
Baldrick

Reply