System files tagged

[gadager]

I got this when I checked the computer this A.M.

 

Files: 0
(No malicious items detected)
Unknown.Rootkit.Driver, C:\WINDOWS\SYSTEM32\drivers\gpuenergydrv.sys, , [ba2455d93bd57989a04fe4094aa6f941],
Unknown.Rootkit.Driver, C:\WINDOWS\SYSTEM32\drivers\hdaudbus.sys, , [c277a49f8a8295840debc9240b75a282],
Unknown.Rootkit.Driver, C:\WINDOWS\SYSTEM32\drivers\rmcast.sys, , [d05726c00594552000ab5e02a54d061f],
Unknown.Rootkit.Driver, C:\WINDOWS\SYSTEM32\drivers\usb8023.sys, , [d1250271d1502fed928f4133acf96ec1],

 

I clicked quarantine and it told me that it so successfully.

 

What am I to believe?

 

John

[thisisu]

Hi,

 

Thank you for reporting this.

 

"it told me that it so successfully." the files were quarantined successfully?

 

Can you please post the full report and/or let us know which database version you are using.

Also, can you attach said files for review please?

 

Thanks!

[blender]

In addition to what thisisu asked for, can you tell me please if you are using an application such as "GoBack" or similar?

 

Thanks!

[gadager]

Hi,

Yes I have been using Rollback Home for a month or so now.  My everyday Malwarebytes scan never complained until 2 days ago.

 

Today I did another scan (of course) and all the data is attached here. Database is: v2015.12.11.4

 

It told me again that 4 files were flagged as rootkit files. I tried to quarantine them but was told that 0 files were successfully quarantined.

 

 

MAlWare Bytes found.txt

flagged as rootkit 4 files.zip

[blender]

Thank you for the updated info.

It is Rollback that is causing MBAM rootkit engine to trigger this alarm.

See here for an explanation:
https://forums.malwarebytes.org/index.php?/topic/165846-false-rootkit-driver-detection/#entry946167

 

Solution is to uninstall Rollback> reboot> reinstall Rollback & the next scan should run clean.

 

Let me know your results.

 

Thanks!

[gadager]

Will do. Thank you.

[afrin]

I was going to report similar issue, but i guess Rollback RX is to blame for 'forging; the drivers - took a long run thru every sandbox online available just to be sure.. but no infections were found and no 'malware-like' actions on the behalf of those drivers, so i was going for false positive report when i found the problem with rollback/freeze softwares..

I know this question is not for here, but do i bother to contact RollbackRX with the issue or they have been already contacted and it just the way the software works and that's it. Is there another way of doing the 'recovery' so we can suggest that to them so it won't trigger rootkit detectors.

Thank you.

[shadowwar]

Its the way they protect the drivers that is very similiar to rookit activity. I will pursue with our dev people but i dont think following up with them will help in this matter.