Search the Community
Showing results for tags 'mbae64.sys'.
Found 3 results
I recently added new RAM to my PC and since, I've been getting some BSOD's even though I used memtest and got no errors. Anyway, I was using the Driver Verifier as instructed here. My PC then wouldn't boot due to BSOD's, after fixing that, I ran WhoCrashed to determine why that happened and it returned that MBAE64.sys was the cause. I've googled the file name and I can't seem to find any way to update it and I'm running a fully updated Malwarebytes Premium 3.4.5..
Hitman Pro is flagging c:\windows\system32\drivers\mbae64.sys as a suspicious file. I'm posting here because that's an MBAM file, and I think an MBAM expert might be able to confirm it's not really a problem. My reason for thinking this follows. I've scanned the file with MBAM and Norton (both in safe mode), and with three online meta-scanners like Virus Total. All of them say the file is fine. Hitman Pro only flags mbae64.sys when I run Windows in Safe Mode. Here's what I suspect: in Safe Mode, some MBAM service/process doesn't start. That service would normally keep other AV programs from flagging mbae64.sys, so this isn't really a problem. But I'm not sure and am a little concerned. Can anyone confirm whether my Safe Mode explanation sound correct, or possibly confirm the file has a valid hash (below)? Here's why Hitman Pro says mbae64.sys is suspicious: Properties Name mbae64.sys Location C:\WINDOWS\system32\drivers Size 75.6 KB Time 25.8 days ago (2017-08-28 18:17:45) Authenticode Valid Entropy 6.4 RSA Key Size 2048 Service ESProtectionDriver SHA-256 CA3EB6AB127A01311DA1C7CE3A2F4C2C3E3641F45718CFCA0F8AED7235BE910D Scoring (24.0) The file is completely hidden from view and most antivirus products. It may belong to a rootkit. Authors name is missing in version info. This is not common to most programs. Version control is missing. This file is probably created by an individual. This is not typical for most programs. Program starts automatically without user intervention. The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities. Starts automatically as a service during system bootup. The file is a device driver. Device drivers run as trusted (highly privileged) code. Program is code signed with a valid Authenticode certificate. Startup HKLM\SYSTEM\ControlSet001\Services\ESProtectionDriver\
Hi. Nearly 1 weeks ago suddenly Malwarebytes(Trial) started to Pop-up me a message about a blocked webpage I never visited. It always happened when I used Firefox and I use uBlock Origin(nothing happened with chorme yet). Always the same page was blocked so I run malwarebytes, adwcleaner, ,win defender, eset, Zemana and neither found anything. Hitmanpro found some non dangerous tracking cookies and I deleted them. Still the pop-up continued. Once it stopped without Finding anything. Before the stop I run Ccleaner and clear everything however I dont know the last pop up was before or after the clear. My computer turned on slow so I deleted both eset and Malwarebytes and bit later installed Mba again. A week passed and during browsing the same page started to pop up once again. I run again malware, adwcleaner and they found nothing again. At last Hitmanpro found mbae64.sys as a suspicious item. Here is one of the log from Mba Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 17/02/2018 Protection Event Time: 16:26 Log File: db95b2bb-13f6-11e8-9f51-08606e7eb1ef.json Administrator: Yes -Software Information- Version: 188.8.131.523 Components Version: 1.0.262 Update Package Version: 1.0.3962 Licence: Trial -System Information- OS: Windows 10 (Build 16299.248) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Category: Unspecified Domain: go.pub2srv.com IP Address: 184.108.40.206 Port:  Type: Outbound File: C:\Program Files\Mozilla Firefox\firefox.exe