Unknown.Rootkit.Driver

[SKIBA]

As a topic, I submit to you the false alarms rootkits. I enclose a screenshot.   I would add that these are the original files from Microsoft.

[blender]

Hello,

 

By any chance are you using Rollback RX or similar program?

And... what Operating system are you running?

 

I may need you to run our stand-alone antirootkit to get additional detailed logs. You OK with this?

 

Thanks!

[SKIBA]

Hello,

 

By any chance are you using Rollback RX or similar program?

And... what Operating system are you running?

 

I may need you to run our stand-alone antirootkit to get additional detailed logs. You OK with this?

 

Thanks!

Yes, I use Rolback RX PC, but installed it three months ago and only recently the program detected it as rootkits. Had the program modified the files to Microsoft? Of course this is a false alarm.

 

PS. The basis on which the program detects rootkits in them?

[blender]

Thank you for the update.

 

RollbackRX is indeed the issue. It has to do with the way Rollback caches drivers as Miekemoes explained here:

https://forums.malwarebytes.org/index.php?/topic/165846-false-rootkit-driver-detection/#entry946167

 

Another user had a similar issue.. (last 3 posts explain best):

https://forums.malwarebytes.org/index.php?/topic/158749-malwarebytes-quarantining-its-own-files/page-2#entry891059

 

For now, the solution is to uninstall RollbackRX, reboot, re-install RollbackRX & next scan should come up clean.

One of our upcoming MBAM program updates will have a fix for this so it shouldn't happen any more.