Rootkit found in Malwarebytes' Anti-Malware: hidden Service MBAMSwissArr

[YvesStrassburg]

What do you think about this here?

http://img809.images...arr20130107.jpg

http://imageshack.us...rr20130107.jpg/

When installing Malwarebytes' Anti-Malware 1.70.0.1100, i get this:

ROOTKIT FOUND

A suspicuous object (Rootkit) has been found on your system. This could be a hint to a malware-infection. The object should be deleted instantly.

ROOTKIT-INFORMATION

Filename Rootkit-name

SVC: MBAMSwissArr Rootkit: Hidden service

ACTIONS WHEN FOUND

Delete now (recommended)

Other OK

I deleted it, and Malwarebytes' Anti-Malware 1.70.0.1100 seems to run fine.

But what's about that rootkit in Malwarebytes' Anti-Malware 1.70.0.1100 ?

[AdvancedSetup]

I think it's a False Positive and you should report it to avast as a user of their product. By deleting the driver you have crippled the program and you show now reinstall the program if you wish to use it properly.

Thank you

[YvesStrassburg]

Thank you for your fast answer, AdvancedSetup.

Hm, Malwarebytes' Anti-Malware 1.70.0.1100 seems to run fine here.

The only thing that i observe is, that Malwarebytes' Anti-Malware has no longer a startup-entry (for mbamgui.exe) as my old Malwarebytes' Anti-Malware 1.62.0.1300 had it, but Malwarebytes' Anti-Malware 1.70.0.1100 is starting automatically and showing its icon in the system tray, like that one of Malwarebytes' Anti-Malware 1.62.0.1300 before, blue colour icon now instead of red colour before, of course.

What's the hidden service "MBAMSwissArr" is doing exactly ?

[AdvancedSetup]

I'm sorry but we don't go into great detail on how the internal program works. The file though is a driver we use for removing malware.

As I said you have crippled the program and it will not work properly anymore. That was an old method that is no longer used by our program and normally I'd recommend a clean removal and reinstall however I see you have other posts on the forum so you should probably work on those as you have some different things going on.

Thanks

[YvesStrassburg]

Sorry, i didn't get your last sentence "I see you have other posts on the forum, so you should probably work on those as you have some different things going on."

There is actually only just one other post, where i already got an answer, and where the solution is clear.

[Wide_Glide]

This issue Reported to the Avast Forum. Awaiting Reply. Thread HERE

I've got the same detection, except action taken=Ignore

[Jekko]

This issue Reported to the Avast Forum. Awaiting Reply. Thread HERE

I've got the same detection, except action taken=Ignore

What version of Avast! was this on? Was this from upgrading from a previous version of Malwarebytes' Anti-Malware or installing it fresh without any previous version being installed? Also, what OS are you using?

[Wide_Glide]

Malwarebytes' Antimalware 1.70 BETA had been installed since it was released for Public trial run. Installed on Windows Vista and installed on Windows 7 Mounted in VirtualBox

Avast 7 Free version on both also

Emailed report to Virus lab of Avast, no reply as of yet

[Jekko]

Wide Glide,

Is Avast catching MBAMSwissArr through any kind of scan or is it from one of their real-time shields? Also, in what order did you install each software?

Thank you for being so cooperative

[Wide_Glide]

Avast detected this through a Scheduled scan. Running a quick scan or full scan with Avast comes up clean. Avast would have been the last installed. Used to have MSE. I have been running Malwarebytes' since version 1.2 something on all my machines.

Thank you for being so cooperative

Anything I can do to help get this sorted out, just ask,

NOTE: All exclusions added to Avast and Mbam. Re-set scheduled scan to 17:15 hrs or 5:15 pm CST to try to dupilicate this.

[Jekko]

Wide Glide,

Did you change any settings for that scheduled scan (for example, Heuristics Sensitivity)? What kind of scheduled scan was it (quick or full)?

Again, thank you for your cooperation.

[Wide_Glide]

Sensitivity is the only change and set to High. Quick Scan

NOTE:Scan in progress as I post. Waiting on scan to start in Win 7 in the VB

Scan in VIsta HP 64 bit Complete---CLEAN

Scan in Win 7 HP 32 bit in a VB Complete--CLEAN