1PW Posted January 26, 2016 ID:1014812 Share Posted January 26, 2016 Hello Pedro: With MBARW 0.9.4.299 installed on a W8.1x64Home system, I have received reproducible false positive pop-ups for an ESET NODE32 Service executable:C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exeThe MBARW pop-up states that ekrn.exe has been placed in its quarantine but I fail to see GUI evidence of any files in the MBARW quarantine. In the meantime I have entered the above pathname into MBARW's Exclusions. Attached is a copy of C:\ProgramData\Malwarebytes\Malwarebytes Anti-Ransomware zipped and the VirusTotal report of that system's ekrn.exe Malwarebytes Anti-Ransomware.ziphttps://www.virustotal.com/en/file/829d8093d77f0bc863a801102c693fd8aaa22a7121771fe481c9a32e64b50e04/analysis/Thank you. Link to post Share on other sites More sharing options...
Decrypterfixer Posted January 26, 2016 ID:1014816 Share Posted January 26, 2016 Thanks for the information! I will be looking into this ASAP! Link to post Share on other sites More sharing options...
1PW Posted January 26, 2016 Author ID:1014826 Share Posted January 26, 2016 Thank you Nathan and welcome to our little corner of the world sir. Link to post Share on other sites More sharing options...
puff_m_d Posted January 26, 2016 ID:1014834 Share Posted January 26, 2016 Hello, Just to add...I get the same false positive except with ESET Smart Security 9.0.349.14 (64-bit) on a Windows 10 Pro 64-bit Version 1511 (OS Build 10586.63).C:\Program Files\ESET\ESET Smart Security\ekrn.exeMBARW tried to quarantine the file but the ESS self-protection module blocked it as the file did not show up in the MBARW quarantine. The MBARW service started using about 25 % CPU. The only way to stop this was to add the ESS file to the MBARW exclusion list and reboot. After this, the MBARW CPU usage went back down. On a side note: On a reboot, MBARW appears both in the system tray and minimized to the task bar. I have to open MBARW from the task bar and then close the window to have it appear only in the system tray. I would think that the desired action here would be for MBARW to start minimized to the system tray only, not also to the task bar. For the time being, I have removed the MBARW beta as with this first release there seems to be to many false positive/quarantine issues. I will install the next build when it is released to test further. If you need any further information to help you troubleshoot this issue, please let me know and I will install this version again if needed. MBARW looks very promising but it is a bit early in the beta stage to run it full time on a production machine. Link to post Share on other sites More sharing options...
Decrypterfixer Posted January 27, 2016 ID:1014948 Share Posted January 27, 2016 1PW can u please also upload the EXE that we detected on? and thanks for the warm welcome Link to post Share on other sites More sharing options...
Decrypterfixer Posted January 27, 2016 ID:1014949 Share Posted January 27, 2016 Puff, Can you please follow these steps and post the results here? Thanks! https://forums.malwarebytes.org/index.php?/topic/177810-how-to-report-a-false-positive/ Link to post Share on other sites More sharing options...
Staff pbust Posted January 27, 2016 Staff ID:1014977 Share Posted January 27, 2016 Nathan, I downloaded it from VirusTotal and already processed. Link to post Share on other sites More sharing options...
1PW Posted January 27, 2016 Author ID:1014978 Share Posted January 27, 2016 1PW can u please also upload the EXE that we detected on? and thanks for the warm welcome Hello Nathan: Attached please find ekrn.zip ekrn.zip HTH Link to post Share on other sites More sharing options...
Decrypterfixer Posted January 27, 2016 ID:1015268 Share Posted January 27, 2016 Thanks, this FP should now be fixed. Link to post Share on other sites More sharing options...
puff_m_d Posted January 27, 2016 ID:1015279 Share Posted January 27, 2016 Hello, I see you have the NOD32 version of ekrn.exe. If you need it, attached you will find the ESS version of ekrn.exe.I will get the program data files for MBARW later today when I reinstall MBARW. Please let me know if you still need them.(I realize that fixing the false positive for NOD32 may have also fixed it for ESS but wanted to be sure you do not still need more information from me)ekrn.7z Link to post Share on other sites More sharing options...
Decrypterfixer Posted January 27, 2016 ID:1015325 Share Posted January 27, 2016 From what i can see this is now fixed. It would be great if you could verify this. Thanks! Link to post Share on other sites More sharing options...
Decrypterfixer Posted January 27, 2016 ID:1015414 Share Posted January 27, 2016 Malwarebytes Anti-Ransomware Beta 2 has been released, download or update now!(If you have MBARW installed it should prompt to update)Information:Malwarebytes Anti-Ransomware (BETA) 0.9.5Improvements:• Improved rules to prevent false positives on legitimate softwareIssues Fixed:• Fixed issue that interfered with proper detection of latest CryptoWall 4 variant Link to post Share on other sites More sharing options...
puff_m_d Posted January 28, 2016 ID:1015534 Share Posted January 28, 2016 Hello Nathan, I can verify that the issue is fixed... Thanks! Link to post Share on other sites More sharing options...
1PW Posted January 28, 2016 Author ID:1015554 Share Posted January 28, 2016 Hello Nathan: Back up okay with MBARW 0.9.5.304 after a conventional uninstall of v0.9.4.299. Previously required exclusion is not required for ESET's ekrn.exe now. Please show this thread as [sOLVED] if you wish. Thank you. Link to post Share on other sites More sharing options...
Grendizer Posted February 3, 2016 ID:1017406 Share Posted February 3, 2016 Hi everyone, This is my first post.I would like to point out that like the others in this thread, I am running ESET NOD32 (I was).After updating MB to latest beta, I noticed that my ESET icon was no longer in the taskbar.I tried launching the application manually but nothing happens. I then proceeded to try and repair the installation.This is where I got insufficient provileges messages for various components and files belonging to ESET.I found this strange but then remembered that MB had tagged ekrn as a risk. It seems that ESET and all components have been blocked. I am now without antivirus, am unable to repair the installation let alone uninstall it and ESET informed me that I need to get in touch with you guys to unlock the files. Fantastic! MB doesn't have anything in the quarantine list, which seems odd considering it has already deemed ekern as a security risk. I tried uninstalling MB but that didn't help. All the ESET files are now locked and can't be used. I need assistance as soon as possible. I will not reformat this machine to get it to work. Link to post Share on other sites More sharing options...
1PW Posted February 3, 2016 Author ID:1017427 Share Posted February 3, 2016 Hello Grendizer and Until a staffer weighs in on this issue, please take no further actions so as to allow the possible capture of volatile & pertinent data. Does the system in question contain viable System Restore Points (SRP)? Has the system been recently imaged? Similar? Thank you. Link to post Share on other sites More sharing options...
Decrypterfixer Posted February 5, 2016 ID:1017567 Share Posted February 5, 2016 Hello,Beta 4 has been released for download only. Please download and update MBARW and see if your problem persists after the updates. Thanks!https://forums.malwarebytes.org/index.php?/topic/177751-introducing-malwarebytes-anti-ransomware/ Link to post Share on other sites More sharing options...
Grendizer Posted February 5, 2016 ID:1017672 Share Posted February 5, 2016 Here's what I did. - attempted to do a repair of ESET and get the following error: - cancelled the repair then uninstalled MBARW and rebooted- attempted to repair the ESET installation. Same error message as above- attempted to uninstall ESET installation. Same error message as above - Attempted to do a system restore and got the following error: - left the domain and logged in as local administrator, thinking it was a permissions issue.- Rebooted system then performed a system restore as local administrator. This time it worked.- attempted to repair/uninstall ESET, still no dice. MBARW initially deemed ESET to be risky and did *something* to it. What did it do exactly and why has it not been reverted when MBARW was uninstalled? Link to post Share on other sites More sharing options...
Grendizer Posted February 5, 2016 ID:1017680 Share Posted February 5, 2016 I am available for a remote session if an engineer would like to do some diagnostics... Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now