Rootkit Activity

[Richard_Shirey]

During the past week, when I boot my computer, sometimes Malwarebytes reports it cannot load the Rootkit driver. Also some of the protections are also turned off. I reboot as suggested by Malwarebytes, after the reboot, everything loads, Malwarebytes runs a scan and finds nothing. Also of note, I have McAfee Security Center Version 16.0.5 installed on my computer.

Do I need to change the Windows Action Center settings like what was suggested to LostHearts, or do I have another issue?

 

Thanks In Advance,

Rich S.

[Porthos]

Go ahead and change it, It will not affect the protection of MB.

[Richard_Shirey]

Hi Porthos, Thank you for the quick response. I'll give that a try.

 

Cheers,

Rich S.

 

[Porthos]

Just now, Richard_Shirey said:

I'll give that a try.

I would like you to add these files to your Anti-Virus exclusions list as mentioned in this FAQ HERE (my list below includes the exe files as well)
 

• C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
• C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
• C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
• C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
• C:\Windows\system32\Drivers\farflt.sys
• C:\Windows\System32\drivers\mbae64.sys
• C:\Windows\System32\drivers\mbam.sys
• C:\Windows\System32\drivers\MBAMChameleon.sys
• C:\Windows\System32\drivers\MBAMSwissArmy.sys
• C:\Windows\System32\drivers\mwac.sys

Also please exclude the following folders too: (The complete folder)

• C:\Program Files\Malwarebytes\Anti-Malware
• C:\ProgramData\Malwarebytes\MBAMService

[daman1]

13 hours ago, Richard_Shirey said:

During the past week, when I boot my computer, sometimes Malwarebytes reports it cannot load the Rootkit driver. Also some of the protections are also turned off. I reboot as suggested by Malwarebytes, after the reboot, everything loads, Malwarebytes runs a scan and finds nothing. Also of note, I have McAfee Security Center Version 16.0.5 installed on my computer.

Do I need to change the Windows Action Center settings like what was suggested to LostHearts, or do I have another issue?

 

Thanks In Advance,

Rich S.

Had a similar issue,  try doing a clean then re- install using MB-clean tool.

 

[Richard_Shirey]

On 12/16/2017 at 8:58 AM, daman1 said:

Had a similar issue,  try doing a clean then re- install using MB-clean tool.

Thank you Daman1 and Respinoza for the suggestions. It appears after running the MB Clean tool, everything is back to normal.

As per the instructions in the MB Clean program, here is the mb-clean-results file.

Cheers,

Rich S.

 

 

mb-clean-results.zip

[daman1]

Glad to hear Rich any problems report back here someone will asset you.

[CraigS]

I have Porthos (15) Exclusions for ESET EIS and periodically get the "Can't Load DDA Rootkit Driver" popup. Re-Start or Install latest Ver Over Current has always worked.

The LostHearts Thread appeared to end with Chk "Never Register MBAM in Win Action Ctr" and RS was "fixed" with the Clean utility.

CAN the Win Action Ctr Setting be a Permanent Strategy to Minimize chances of the Rootkit Drvr Popup?