Jump to content

Search the Community

Showing results for tags 'mbae64.sys'.



More search options

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Announcements
    • Malwarebytes News
    • Beta Testing Program
  • Malware Removal Help
    • Windows Malware Removal Help & Support
    • Mac Malware Removal Help & Support
    • Mobile Malware Removal Help & Support
    • Malware Removal Self-Help Guides
  • Malwarebytes for Home Support
    • Malwarebytes for Windows Support Forum
    • Malwarebytes for Mac Support Forum
    • Malwarebytes for Android Support Forum
    • Malwarebytes for iOS Support
    • Malwarebytes Browser Guard
    • False Positives
    • Comments and Suggestions
  • Malwarebytes for Business Support
    • Malwarebytes Endpoint Protection
    • Malwarebytes Incident Response (includes Breach Remediation)
    • Malwarebytes Endpoint Security
    • Malwarebytes Business Products Comments and Suggestions
  • Malwarebytes Tools and Other Products
    • Malwarebytes AdwCleaner
    • Malwarebytes Junkware Removal Tool Support
    • Malwarebytes Anti-Rootkit BETA Support
    • Malwarebytes Techbench USB (Legacy)
    • Malwarebytes Secure Backup discontinued
    • Other Tools
    • Malwarebytes Tools Comments and Suggestions
  • General Computer Help and Security Updates
    • BSOD, Crashes, Kernel Debugging
    • General Windows PC Help
  • Research Center
    • Newest Rogue-Ransomware Threats
    • Newest Malware Threats
    • Newest Mobile Threats
    • Newest IP or URL Threats
    • Newest Mac Threats
    • Report Scam Phone Numbers
  • General
    • General Chat
    • Forums Announcements & Feedback

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


AIM


MSN


Website URL


ICQ


Yahoo


Jabber


Location


Interests

Found 3 results

  1. I recently added new RAM to my PC and since, I've been getting some BSOD's even though I used memtest and got no errors. Anyway, I was using the Driver Verifier as instructed here. My PC then wouldn't boot due to BSOD's, after fixing that, I ran WhoCrashed to determine why that happened and it returned that MBAE64.sys was the cause. I've googled the file name and I can't seem to find any way to update it and I'm running a fully updated Malwarebytes Premium 3.4.5..
  2. Hitman Pro is flagging c:\windows\system32\drivers\mbae64.sys as a suspicious file. I'm posting here because that's an MBAM file, and I think an MBAM expert might be able to confirm it's not really a problem. My reason for thinking this follows. I've scanned the file with MBAM and Norton (both in safe mode), and with three online meta-scanners like Virus Total. All of them say the file is fine. Hitman Pro only flags mbae64.sys when I run Windows in Safe Mode. Here's what I suspect: in Safe Mode, some MBAM service/process doesn't start. That service would normally keep other AV programs from flagging mbae64.sys, so this isn't really a problem. But I'm not sure and am a little concerned. Can anyone confirm whether my Safe Mode explanation sound correct, or possibly confirm the file has a valid hash (below)? Here's why Hitman Pro says mbae64.sys is suspicious: Properties Name mbae64.sys Location C:\WINDOWS\system32\drivers Size 75.6 KB Time 25.8 days ago (2017-08-28 18:17:45) Authenticode Valid Entropy 6.4 RSA Key Size 2048 Service ESProtectionDriver SHA-256 CA3EB6AB127A01311DA1C7CE3A2F4C2C3E3641F45718CFCA0F8AED7235BE910D Scoring (24.0) The file is completely hidden from view and most antivirus products. It may belong to a rootkit. Authors name is missing in version info. This is not common to most programs. Version control is missing. This file is probably created by an individual. This is not typical for most programs. Program starts automatically without user intervention. The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities. Starts automatically as a service during system bootup. The file is a device driver. Device drivers run as trusted (highly privileged) code. Program is code signed with a valid Authenticode certificate. Startup HKLM\SYSTEM\ControlSet001\Services\ESProtectionDriver\
  3. Hi. Nearly 1 weeks ago suddenly Malwarebytes(Trial) started to Pop-up me a message about a blocked webpage I never visited. It always happened when I used Firefox and I use uBlock Origin(nothing happened with chorme yet). Always the same page was blocked so I run malwarebytes, adwcleaner, ,win defender, eset, Zemana and neither found anything. Hitmanpro found some non dangerous tracking cookies and I deleted them. Still the pop-up continued. Once it stopped without Finding anything. Before the stop I run Ccleaner and clear everything however I dont know the last pop up was before or after the clear. My computer turned on slow so I deleted both eset and Malwarebytes and bit later installed Mba again. A week passed and during browsing the same page started to pop up once again. I run again malware, adwcleaner and they found nothing again. At last Hitmanpro found mbae64.sys as a suspicious item. Here is one of the log from Mba Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 17/02/2018 Protection Event Time: 16:26 Log File: db95b2bb-13f6-11e8-9f51-08606e7eb1ef.json Administrator: Yes -Software Information- Version: 3.3.1.2183 Components Version: 1.0.262 Update Package Version: 1.0.3962 Licence: Trial -System Information- OS: Windows 10 (Build 16299.248) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Category: Unspecified Domain: go.pub2srv.com IP Address: 78.140.191.74 Port: [51361] Type: Outbound File: C:\Program Files\Mozilla Firefox\firefox.exe
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.