CCC_1 Posted January 16, 2020 ID:1356271 Share Posted January 16, 2020 Hello, a Windows system file which is signed by LunarG, Inc. and Microsoft Windows Hardware Compatibility Publisher was flagged by Malwarebytes this morning on one user PC. The file has been there for several months at this path C:\Windows\System32\vulkan-1.dll and I will include a sample with this post (File Extension has been changed to "EXE" so I can attach it). I have run the file through several online databases and it comes back clean every time. Is it possible this is a false positive caused by a recent definitions update? vulkan-1.txt Link to post Share on other sites More sharing options...
Staff miekiemoes Posted January 16, 2020 Staff ID:1356272 Share Posted January 16, 2020 Hi, Thanks for reporting This will get fixed in next database update Link to post Share on other sites More sharing options...
CCC_1 Posted January 16, 2020 Author ID:1356273 Share Posted January 16, 2020 So, I take it you are confirming this is a false positive? Link to post Share on other sites More sharing options...
Staff miekiemoes Posted January 16, 2020 Staff ID:1356274 Share Posted January 16, 2020 Yes, it is Link to post Share on other sites More sharing options...
CCC_1 Posted January 16, 2020 Author ID:1356275 Share Posted January 16, 2020 Great, thank you so much for the quick response! Link to post Share on other sites More sharing options...
nitramz Posted January 16, 2020 ID:1356277 Share Posted January 16, 2020 Any action required for clients which already quarantined the file? Link to post Share on other sites More sharing options...
Staff miekiemoes Posted January 16, 2020 Staff ID:1356278 Share Posted January 16, 2020 They can unquarantine the file again. Link to post Share on other sites More sharing options...
RBTX Posted January 16, 2020 ID:1356311 Share Posted January 16, 2020 Can you tell us when the next database update is scheduled to be released? Link to post Share on other sites More sharing options...
Staff miekiemoes Posted January 16, 2020 Staff ID:1356313 Share Posted January 16, 2020 (edited) Hi, This has been released already and fixed in: MB2 Version: v2020.01.16.06MB3 Version: 1.0.14367 MB4 Version: 1.0.17806 Edited January 16, 2020 by miekiemoes Link to post Share on other sites More sharing options...
RBTX Posted January 16, 2020 ID:1356316 Share Posted January 16, 2020 Thank you for the prompt response. Link to post Share on other sites More sharing options...
jp18 Posted January 16, 2020 ID:1356330 Share Posted January 16, 2020 Hello. I am currently am running database version : v2020.01.16.06 and I see the above-mentioned vulkan dll's listed in quarantined. Also, I checked another system running v2020.01.16.07 and these items are also quarantined. Will I need to manually un-quarantine these or take other steps to resolve? Thanks, J Link to post Share on other sites More sharing options...
Staff miekiemoes Posted January 16, 2020 Staff ID:1356331 Share Posted January 16, 2020 Hi, All you need to do is to manually unquarantine these. Link to post Share on other sites More sharing options...
Porthos Posted January 16, 2020 ID:1356345 Share Posted January 16, 2020 (edited) Quarantine or restore items with Malwarebytes for Windows v4 Edited February 21, 2020 by AdvancedSetup updated links Link to post Share on other sites More sharing options...
jp18 Posted January 16, 2020 ID:1356348 Share Posted January 16, 2020 (edited) Thanks Porthos, but this works a little bit different for me. I use Connectwise Automate with the MBAM Plugin. Edited February 21, 2020 by AdvancedSetup removed unneeded quoting Link to post Share on other sites More sharing options...
Porthos Posted January 16, 2020 ID:1356349 Share Posted January 16, 2020 Just now, jp18 said: Thanks Porthos, but this works a little bit different for me. I use Connectwise Automate with the MBAM Plugin. Oh, Sorry. Managed client. Answer will be forthcoming from someone that supports the business products. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted January 16, 2020 Staff ID:1356360 Share Posted January 16, 2020 (edited) Hi @jp18, Please see here for Connectwise Automate with the malwarebytes plugin: Edited to add - it might show different in your case - so for that, please refer to the documentation here: https://marketplace.connectwise.com/malwarebytes#documentation (access after login) Edited January 16, 2020 by miekiemoes Link to post Share on other sites More sharing options...
jp18 Posted January 16, 2020 ID:1356366 Share Posted January 16, 2020 Perfect thank you! Looking to take this a step further by adding to the global ignore list for now. I've gone ahead and posted to the business form. Thanks, Mieke! Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now