REGITDept Posted June 19, 2020 ID:1389015 Share Posted June 19, 2020 Dear Malwarebytes, One of our client today suddenly unable to use anything Office 2016. I take a look and it seems like it is a false positives. Please help me take a look into it to make sure that it is a false positives and nothing malicious. Thanks. Quarantine.zip logs.zip Link to post Share on other sites More sharing options...
Porthos Posted June 19, 2020 ID:1389016 Share Posted June 19, 2020 I have asked for your post to be moved to the FP section so it will get noticed quicker. Link to post Share on other sites More sharing options...
Staff cli Posted June 19, 2020 Staff ID:1389035 Share Posted June 19, 2020 (edited) Hi, can you provide the files detected and mbamservicelogs? Edited June 19, 2020 by cli Link to post Share on other sites More sharing options...
Porthos Posted June 19, 2020 ID:1389036 Share Posted June 19, 2020 @cli Do any of the logs in the first post help. This is an endpoint client. Link to post Share on other sites More sharing options...
Staff cli Posted June 19, 2020 Staff ID:1389038 Share Posted June 19, 2020 No, it only gives me the detection name and file name and from the quarantine folder, I was able to recover only some of the files. Link to post Share on other sites More sharing options...
Porthos Posted June 19, 2020 ID:1389039 Share Posted June 19, 2020 Just now, cli said: No, it only gives me the detection name and file name and from the quarantine folder, I was able to recover only some of the files. Just trying to assist the user. Guess we have to wait for the OP to respond. Link to post Share on other sites More sharing options...
Staff cli Posted June 19, 2020 Staff ID:1389040 Share Posted June 19, 2020 No worries, thanks for trying. While we wait, I'm trying to see if I can find information I need using alternative methods. Link to post Share on other sites More sharing options...
REGITDept Posted June 19, 2020 Author ID:1389043 Share Posted June 19, 2020 35 minutes ago, cli said: Hi, can you provide the files detected and mbamservicelogs? Dear cli, Here are the files that was quarantined. Thanks. Quarantined.zip Link to post Share on other sites More sharing options...
REGITDept Posted June 19, 2020 Author ID:1389044 Share Posted June 19, 2020 1 hour ago, Porthos said: I have asked for your post to be moved to the FP section so it will get noticed quicker. Thank you Porthos 😀 Link to post Share on other sites More sharing options...
REGITDept Posted June 19, 2020 Author ID:1389045 Share Posted June 19, 2020 41 minutes ago, cli said: Hi, can you provide the files detected and mbamservicelogs? cli, Where is this mbamservicelogs that you needed? Thanks. Link to post Share on other sites More sharing options...
Staff cli Posted June 20, 2020 Staff ID:1389047 Share Posted June 20, 2020 I believe it's located at "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs". Thanks. Link to post Share on other sites More sharing options...
REGITDept Posted June 20, 2020 Author ID:1389048 Share Posted June 20, 2020 4 minutes ago, cli said: I believe it's located at "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs". Thanks. cli, I have included that in the initial post. Thanks. Link to post Share on other sites More sharing options...
Staff cli Posted June 20, 2020 Staff ID:1389053 Share Posted June 20, 2020 21 minutes ago, REGITDept said: cli, I have included that in the initial post. Thanks. I thought there might be additional logs in there. Also, it's odd because I scanned the files in Quarrantined.zip and not seeing any of them being detected. For example, windows_wlan.exe - Backdoor.RevengeRAT.MSILhttps://www.virustotal.com/gui/file/da77035d3363da6f57ae6cce593a6cd77ac630f3aff1c94f35df4ea31e3aea71/detection Excel.exe - Trojan.Malpack.VB https://www.virustotal.com/gui/file/fa70b41c7e3c7a9122132524a5db3b2f48da9568c36bd97b71e78bc523d2a146/detection I'm going to continue digging. Link to post Share on other sites More sharing options...
REGITDept Posted June 20, 2020 Author ID:1389054 Share Posted June 20, 2020 3 minutes ago, cli said: I thought there might be additional logs in there. Also, it's odd because I scanned the files in Quarrantined.zip and not seeing any of them being detected. For example, windows_wlan.exe - Backdoor.RevengeRAT.MSILhttps://www.virustotal.com/gui/file/da77035d3363da6f57ae6cce593a6cd77ac630f3aff1c94f35df4ea31e3aea71/detection Excel.exe - Trojan.Malpack.VB https://www.virustotal.com/gui/file/fa70b41c7e3c7a9122132524a5db3b2f48da9568c36bd97b71e78bc523d2a146/detection I'm going to continue digging. Yes, very weird because it only happened once to only this one client. Thanks. Link to post Share on other sites More sharing options...
Staff cli Posted June 20, 2020 Staff ID:1389057 Share Posted June 20, 2020 Can you have that client do another DB update and rescan? Thanks. Link to post Share on other sites More sharing options...
REGITDept Posted June 20, 2020 Author ID:1389058 Share Posted June 20, 2020 1 minute ago, cli said: Can you have that client do another DB update and rescan? Thanks. After I restored the files, it's not picking up again. Databases is already up to date. Link to post Share on other sites More sharing options...
Staff cli Posted June 20, 2020 Staff ID:1389062 Share Posted June 20, 2020 (edited) Oh I see. The client might have had a corrupt database since it was limited to just that client and I wasn't able to reproduce the detection. However, please let us know if you're seeing the detection again. Thanks. Edited June 20, 2020 by cli Link to post Share on other sites More sharing options...
REGITDept Posted June 24, 2020 Author ID:1390053 Share Posted June 24, 2020 That was an odd issue. Case closed for now. Thanks for all the help guys 😀 Link to post Share on other sites More sharing options...
Staff shadowwar Posted June 25, 2020 Staff ID:1390131 Share Posted June 25, 2020 Just a tip. May want to see about upgrading to the latest available version. Whitelisting and protection are greatly improved and things like this should not happen with the latest version available. Link to post Share on other sites More sharing options...
REGITDept Posted June 30, 2020 Author ID:1391240 Share Posted June 30, 2020 On 6/25/2020 at 5:16 AM, shadowwar said: Just a tip. May want to see about upgrading to the latest available version. Whitelisting and protection are greatly improved and things like this should not happen with the latest version available. shadowwar, There is a newer version under the Malwarebytes Endpoint Security? Thanks. Link to post Share on other sites More sharing options...
Staff shadowwar Posted July 1, 2020 Staff ID:1391514 Share Posted July 1, 2020 You may want to talk to your business rep but i believe you would have to upgrade to the cloud version. Link to post Share on other sites More sharing options...
REGITDept Posted July 3, 2020 Author ID:1391902 Share Posted July 3, 2020 On 7/1/2020 at 10:34 AM, shadowwar said: You may want to talk to your business rep but i believe you would have to upgrade to the cloud version. shadowwar, But isn't this more of a different product than an upgrade? One is cloud-based, and one is on premise based? We would like to see an update to the on premise. Thanks. Link to post Share on other sites More sharing options...
Porthos Posted July 3, 2020 ID:1391908 Share Posted July 3, 2020 23 minutes ago, REGITDept said: We would like to see an update to the on premise. Are these just standalone workstations, how many, or is there a server involved? Link to post Share on other sites More sharing options...
Staff shadowwar Posted July 4, 2020 Staff ID:1392176 Share Posted July 4, 2020 Please see here: https://www.malwarebytes.com/upgrade/mbes-to-ep or https://www.malwarebytes.com/upgrade/mbes-to-teams I am just in research so i dont really have the sales knowledge. The product has a client that runs on the machine but is cloud managed. Malwarebytes Endpoint Security product will be discontinued/end of life on August 4, 2021 Link to post Share on other sites More sharing options...
REGITDept Posted July 6, 2020 Author ID:1392463 Share Posted July 6, 2020 On 7/2/2020 at 5:47 PM, Porthos said: Are these just standalone workstations, how many, or is there a server involved? We are using Malwarebytes Endpoint Security which involved a dedicated on premise server. Thanks. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now