MBAR picking up files when Trend Micro open

[npiotrowski]

Hi,

Have a machine that was infected with ransomware. I have used EaseUS secure erase to wipe out the whole drive and reinstall WIndows 10 pro on it, have even done a destory partitions, format, reinstall windows 10.


Whenever I run MBAR scan with Trend running I get these detections, even after a fresh install.

Done!
Infected: c:\users\defaultuser0\appdata\roaming\pidloc.txt --> [Trojan.Agent.Trace]
Infected: c:\google\googleupdate.a3x --> [Worm.Rowmanti]
Infected: c:\google --> [Worm.Rowmanti]
Infected: c:\skypee\googleupdate.a3x --> [Worm.Rowmanti.E]
Infected: c:\skypee --> [Worm.Rowmanti.E]
Infected: c:\users\defaultuser0\appdata\local\temp\updatea.vbs --> [Trojan.Agent.VBS]
Infected: c:\users\user\appdata\local\temp\updatea.vbs --> [Trojan.Agent.VBS]
Infected: c:\users\default\appdata\local\temp\updatea.vbs --> [Trojan.Agent.VBS]
Scan finished


If i close Trend Micro and run scan again, these detections don't occur.

I'm not sure if this is a false positive due to Trend, or there actually somehow is still remnants of this malware? Even though it can't be seen in Windows Safemode, with hidden files showing, not through explorer or the cmd prompt, system restore turned off. Tried other Antivirus scanners and no pickups. Looked up cleaning Worm.Rowmanti.E and no files or entries in registry.

I added a second hard drive and installed Windows 10 on it and get no detections if running MBAR scan with Trend open. It's only on this NVMe SSD disk that it happens.

I'm thinking of buying a new nvme drive to see if that matters, these detections don't occur until Scanning Registry and Directory Data happen in MBAR.

If this isn't a false positive, I'm thinking somehow the SSD is reporting to MBAR that these files once existed on the drive but would have thought a secure erase through EaseUS would of fixed that but it hasn't. The thing is I have Trend installed on other computers and when run MBAR it come back clean.

[1PW]

Hello @npiotrowski and

You have started this topic in the Malwarebytes Anti-Exploit (MBAE) Beta sub-forum.

Did you mean to post in the Malwarebytes Anti-Rootkit (MBAR) BETA Support sub-forum or the Malwarebytes Anti-Ransomware (MBARW) Beta sub-forum?

Thank you.

Edited September 4, 2020 by 1PW

[exile360]

Greetings,

It appears these may be false positives from Malwarebytes Anti-Rootkit Beta which are being caused by Trend Micro as you suspect.  Please try temporarily disabling or removing Trend to see if that makes any difference and let us know. Apologies, I just saw where you already mentioned that disabling Trend did indeed eliminate the detections.

Thanks

Edited September 4, 2020 by exile360

[sfoxaum]

Hello, we use Malwarebytes and Trend Micro at my company and we have the same issue!

I do think this is a false positive, but are we sure this is a false positive? I do think it is, but is there a way to confirm 100%?

9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Worm.Rowmanti   < No action taken >     c:\google
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Worm.Rowmanti.E < No action taken >     c:\skypee
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Trojan.Agent.Trace      < No action taken >     c:\users\admin\appdata\roaming\pidloc.txt
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Worm.Rowmanti   < No action taken >     c:\google\googleupdate.a3x
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Worm.Rowmanti.E < No action taken >     c:\skypee\googleupdate.a3x
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Trojan.Agent.VBS        < No action taken >     c:\users\admin\appdata\local\temp\updatea.vbs
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Trojan.Agent.VBS        < No action taken >     c:\users\default\appdata\local\temp\updatea.vbs
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Trojan.Agent.VBS        < No action taken >     c:\users\usera\appdata\local\temp\updatea.vbs
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Trojan.Agent.VBS        < No action taken >     c:\users\userb\appdata\local\temp\updatea.vbs
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Trojan.Agent.VBS        < No action taken >     c:\users\userc\appdata\local\temp\updatea.vbs
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Trojan.Agent.VBS        < No action taken >     c:\users\userd\appdata\local\temp\updatea.vbs
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Trojan.Agent.VBS        < No action taken >     c:\users\usere\appdata\local\temp\updatea.vbs
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Trojan.Agent.VBS        < No action taken >     c:\users\userf\appdata\local\temp\updatea.vbs
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Trojan.Agent.VBS        < No action taken >     c:\users\userg\appdata\local\temp\updatea.vbs
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Trojan.Agent.VBS        < No action taken >     c:\users\userh\appdata\local\temp\updatea.vbs
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Trojan.Agent.VBS        < No action taken >     c:\users\useri\appdata\local\temp\updatea.vbs
9/25/2020 12:05:29 PM   COMPUTERNAME       192.168.202.120 Trojan.Agent.VBS        < No action taken >     c:\windows\temp\updatea.vbs

We cannot find these files. We've scanned the system with about six different anti-virus, anti-rootkit, and anti-malware products and none of them detect anything. The only thing I can think of it both Trend and MBAM kick off a scan at the same time and this happens.

[exile360]

If disabling Trend Micro eliminates the detections then it is indeed due to the known issue/false positive between the two applications.