Possible False Positive DBUtil.sys in Windows Temp folder

[eliuri]

The following Windows/Temp/DBUtil .sys file was detected in MB real time detection today.

Attached find zipped files of this detection as well as MB .txt file of the event

Neither file was found as malware by VirusTotal after release from Quarantine

Nor did i download/install anything from Dell in a very long time

Please evaluate possibility of false positive

Thank you

eliuri

Windows 7 SP1

Malwarebytes Premium 4.3.0

af397ef28e484961ba48646a5d38cf54.db.zip af397ef28e484961ba48646a5d38cf54.zip dbutil-log-malwarebytes-jan 17.txt

[eliuri]

I think this is the zipped file thats relevant

af397ef28e484961ba48646a5d38cf54.zip

[Porthos]

10 minutes ago, eliuri said:

Please evaluate possibility of false positive

Dell dbutil_2_3. sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. ... This driver may have been installed on to the Windows operating system of your Dell Client platform by one or more impacted products or components.

https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerability

This detection is not a FP.

Personally I would remove all Dell utilities from the computer and let Malwarebytes remove the rest.

Edited January 17, 2022 by Porthos

[Porthos]

@eliuri

https://blog.malwarebytes.com/detections/exploit-cve202121551/

[eliuri]

I've only seen it as a Temp file in Windows folder--only detected today.  I re-quarantined it and did full scan. No malware

[Porthos]

2 minutes ago, eliuri said:

I re-quarantined it and did full scan. No malware

Good. The Dell software will put it back if used so be aware.

[eliuri]

Thank you, Porthos...

Yes, I do get detection notices of this every few days now. AFAIK I havent downloaded or installed anything from Dell in years.

 

"Summary: Dell has released remediation for a security vulnerability affecting the dbutil_2_3.sys driver packaged with Dell Client firmware update utility packages and other products."

https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerability

 

This is baffling,  since I cant find this vulnerable driver:

dbutil_2_3.sys

anywhere on my laptop

Would you kindly elucidate why i keep getting this exploit notification in spite of quarantine of that .Temp file?

How is Dell installing/ reinstalling  it?

Thank you

eliuri

 

[Porthos]

6 minutes ago, eliuri said:

How is Dell installing/ reinstalling  it?

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

 

[eliuri]

I ran the FRST within the past 10 days and uploaded it, and its still on my desktop. Hopefully, this is what you now need

mbst-grab-results.zip

[Porthos]

10 minutes ago, eliuri said:

How is Dell installing/ reinstalling  it?

Is this the same Dell 1545? If so, You need to uninstall all of the following.

Dell SupportAssist

Dell Update

Dell Dock

Dell Edoc Viewer

Dell Getting Started Guide

QualxServ Service Agreement

[eliuri]

Yes, it is that same Dell 1545

Can I simply disable the relevant services to stop it from doing this?

I'm mostly concerned that some of those programs you're suggesting I uninstall might actually be needed. Since it's an outdated Dell laptop,I'd have no way of getting those back if I simply uninstall...

********************************

It's odd that only one out of all those 64 detection engines at virus total--including Malwarebytes-- flags that file when I upload it 

 

[Porthos]

2 minutes ago, eliuri said:

I'm mostly concerned that some of those programs you're suggesting I uninstall might actually be needed. Since it's an outdated Dell laptop,I'd have no way of getting those back if I simply uninstall...

Those programs were not needed the day the laptop was made and they are not needed now. No Dell NEEDS those apps. I have been removing them from every Dell I have ever serviced in my career.

I do the same for other brand name computers as well.