chedbe_EMA Posted October 26, 2017 ID:1176008 Share Posted October 26, 2017 With MBAM database version 2017.10.25.11 we are seeing c:\program files\rhinoceros 5 (64-bit)\plug-ins\rdk.rhp being detected as Spyware.Pony and Quarantined. I'm suspicious that this is a false-positive. The scan log and sample are attached. The log file was generated using mbam.exe /developer. The log file says "no action taken" but the file was quarantined. Please advise. MBAM-log-2017-10-25 (19-15-53)_.txt rdk.zip Link to post Share on other sites More sharing options...
Staff blender Posted October 26, 2017 Staff ID:1176010 Share Posted October 26, 2017 Hello, Indeed this is a false positive. It will be fixed next update. Thank you for reporting! Link to post Share on other sites More sharing options...
chedbe_EMA Posted October 26, 2017 Author ID:1176114 Share Posted October 26, 2017 Thank you Tammy. I verified that the 2017.10.26.# definitions do not detect the rdk.rhp file as malicious. Link to post Share on other sites More sharing options...
Staff blender Posted October 26, 2017 Staff ID:1176115 Share Posted October 26, 2017 Thank you for reporting back. Good to hear. Link to post Share on other sites More sharing options...
chedbe_EMA Posted October 26, 2017 Author ID:1176240 Share Posted October 26, 2017 Hey Tammy or whomever is listening, The problem is back. We were doing well until v2017.10.26.06. With that version of the definitions the file is getting quarantined again but flagged for Delete on Reboot. Spyware.Pony delete-on-reboot C:\Program Files\Rhinoceros 5 (64-bit)\Plug-ins\rdk.rhp Please advise! Link to post Share on other sites More sharing options...
Staff blender Posted October 26, 2017 Staff ID:1176242 Share Posted October 26, 2017 Can you post your log please @chedbe_EMA ? Link to post Share on other sites More sharing options...
Staff blender Posted October 26, 2017 Staff ID:1176280 Share Posted October 26, 2017 You may also have to reboot. Then you can ensure MBAM is up to date & you can then dequarantine the file. It should not be detected again. Link to post Share on other sites More sharing options...
chedbe_EMA Posted October 26, 2017 Author ID:1176308 Share Posted October 26, 2017 Hi Tammy, I'm working on getting you that log file. The scan to produce it is taking a while. When I tested this morning on a couple of computers and no longer had the false-positive detection the computers had db version 2017.10.26.3 and I think .2. When computers started receiving v2017.10.26.6 we started seeing the false-positive again along with the new statement of "Delete-on-Reboot". Thanks again for your replies. Link to post Share on other sites More sharing options...
chedbe_EMA Posted October 27, 2017 Author ID:1176370 Share Posted October 27, 2017 Here is the log file. mbam-log-2017-10-26 (16-44-08)_.txt Link to post Share on other sites More sharing options...
Staff blender Posted October 27, 2017 Staff ID:1176380 Share Posted October 27, 2017 Are you still seeing the detection? The log is not showing anything. Link to post Share on other sites More sharing options...
chedbe_EMA Posted October 31, 2017 Author ID:1177876 Share Posted October 31, 2017 Sorry for not closing the loop on this sooner. The false-positive went away, again, after computers started receiving signature db version greater than v2017.10.26.6. We seem to be good now. Thanks for you assistance. Link to post Share on other sites More sharing options...
Staff blender Posted November 1, 2017 Staff ID:1178004 Share Posted November 1, 2017 Good to hear. Thanks for the update! Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now