Sophos Safeguard

[the_adrick]

Hi,

 

I use Sophos Safeguard to encrypt my laptop. Recently I ran a scan and noticed a unknown.rootkit.MBR showing up. Upon quarantining my laptop would no longer boot. It seems that Malwarebytes is seeing my Safeguard install as a rootkit.

 

To get my laptop booting to windows again I had to boot using the safeguard bootdisk and restore my MBR.

 

Is there a way to update the program or hard code an exception for Safeguard so I do not have this problem?

 

Or is the fix to just uncheck 'scan for rootkits'?

[David H. Lipman]

< removed post content due to inapplicability of information in reference to the problem noted >

[shadowwar]

Please ignore David's instructions this is a special case being its a MBR.

 

I am getting in touch with the devs to see what info we need to get this corrected. Will be back in touch shortly.

 

What may help in the mean time is if possible to run our MBAR utility with the /v switch.

 

Let me know if you need more specific instructions.

 

https://www.malwarebytes.org/antirootkit/

 

and attaching the system.log.txt here.

 

Just dont select to fix it or remove. at the end of the scan.

 

Basically we need a dump of the MBR to start off with.

 

Thanks.

[shadowwar]

This may be fixed. Can you please update mbam and retry the scan?

 

Thanks.

[the_adrick]

Looks like it's no longer getting detected.

 

Thanks guys.

[shadowwar]

Thanks for the confirmation!