squire Posted January 21, 2015 ID:931285 Share Posted January 21, 2015 These are the same 4 files detected in the last 2 monthly scans by mbam, and this afternoon. I quarantine them and after reboot they are back. 3 of them are mbam files.In normal operations, Avast says nothing about them, Rubotted says nothing.2 of the files have been scanned again by avast, and superantispyware: nothing found.the whole \driver folder has been scanned by Housecall: nothing found. the log and copies of the 4 files are attached. the scan log is from earlier today, at which time the four files were detected.when I ran the scan again, from run, per web site instructions, no log file was produced and only 2 of the files were detected: mrxdav.sys, and tdx.sys. I had rebooted and all four files were copied from the \driver folder while the scan was running, so I know that they were there during the scan. I am interested to hear the results of your investigation. Jeffreymbam.zipmrxdav.zipmwac.ziptdx.zipmbam scan log.txt Link to post Share on other sites More sharing options...
Staff miekiemoes Posted January 21, 2015 Staff ID:931291 Share Posted January 21, 2015 Hi, The Malwarebytes rootkit scanning sees a mismatch between reads from the kernel and windows API here, so malwarebytes detects them correctly because of this behavior, however, in this case, the files aren't infected. So basically, you can ignore these detections.Some 3rd party programs are causing this, (causing a misread). Any chance you have Rollback installed? Because this one causes these misreads as well.Also see here: https://forums.malwarebytes.org/index.php?/topic/158749-malwarebytes-quarantining-its-own-files/?hl=mbam.sys where a reinstall of Rollback fixes it. Link to post Share on other sites More sharing options...
squire Posted January 21, 2015 Author ID:931294 Share Posted January 21, 2015 wow, that is a quick response. good guess, yes I have Rollback installed. Thing is, Rollback has been installed for several years. this problem just started a couple of months ago. In dec if I remember correctly. How would one know if a detection is false positive or something that needs action? I guess "unknown" in the label is a clue. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted January 21, 2015 Staff ID:931295 Share Posted January 21, 2015 For the "Unknown RootKit Drivers", there's always a possibility of being a false positive - hence the "unknown" indeed.Note that Malwarebytes restores/replaces these files with a "clean copy", so no harm is done anyway. If it always comes back (unknown rootkit driver), then it might be a misread in most cases caused by a 3rd party program. Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 21, 2015 Staff ID:931375 Share Posted January 21, 2015 If this is still detected, You can uninstall rollback rx. Reboot Then reinstall rollback rx and it should fix the issue. Link to post Share on other sites More sharing options...
squire Posted January 21, 2015 Author ID:931457 Share Posted January 21, 2015 I take that confidance is high that it is false positives and the files that I sent aren't going to be reviewed? If problem continues i'll try the rollback uninstall. probably won't happen right away. I'll report back eventually. Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 21, 2015 Staff ID:931465 Share Posted January 21, 2015 There is nothing we can fix files or defintion wise with this. This is do to the way rollbackrx handles the caching of the files. Its a behaviour based def and doesnt matter on the content of the files themselves. If doing what i said doesnt fix your issue please let us know. I have seen this a lot and that usually fixes it. Link to post Share on other sites More sharing options...
squire Posted January 21, 2015 Author ID:931471 Share Posted January 21, 2015 ok. I was only trying to clarify if I was still to expect a response regarding the particuar files that I sent. I guess not. I let you know about further results. Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 21, 2015 Staff ID:931479 Share Posted January 21, 2015 I looked at the files and they are not infected. They are the normal original MBAM files and Microsoft file. All zero hits including MBAM. https://www.virustotal.com/en/file/7cae59aa6ca9cbbd70bbd707a155fb169bf3f71096275bf7c0f415b6a092c671/analysis/https://www.virustotal.com/en/file/f5fd6b61f896104c20dfc43fee2fce6930b73f78df876bd19a333eabb9139c6d/analysis/https://www.virustotal.com/en/file/fa38dd035b2c4fc82b60868f49d45a39fbbc96096aad5a2c8bd752a250255ba7/analysis/https://www.virustotal.com/en/file/f80c806417a68047ffb3d63214bc4ae5445315219ac594e043293006b704a63d/analysis/ Link to post Share on other sites More sharing options...
squire Posted January 21, 2015 Author ID:931503 Share Posted January 21, 2015 great. thank you. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now