False positive on ESET file?

[ac4482]

not sure exactly what is going on with this one

 

Windows Defender/ESET dont detect the file that MBAM is detecting and the only .exe with a matching name on the system is ECMDS.EXE(ESET Command Line Interface) which is related to ESET Internet Security

File also does not show up in the Quarantined Items list in MBM only in the scan history even if you tell MBM to not do anything

 

at a bit of a loss with this one,

Thanks

mbam-log.txt

[thisisu]

Hi,

We're investigating. Without being able to compare the files, we can't be sure. But here is the intended target: https://www.virustotal.com/gui/file/7f090424b7bff748d55955790f9e39e0505db6ca1fc81bd60acbbe51f7e907e2/detection

If someone is able to attach the different file, other than MD5: 48AFC1F06F8EACA41BE7CC52C55D3783, we can thoroughly check what may be wrong and if it's a false positive.

Thank you

[ac4482]

Just added a screenshot to this post,

 

no idea how i can get it to show me where the file was found originally, if i tell MBAM to delete it on reboot it finds it again anyway

[ac4482]

also forgot to add the ESET file named identically, so i have no clue if its actually what is being detected or not though

 

ecmds.zip

[miekiemoes]

Hi,

Can you zip and attach the MBAMService.LOG, this so I can have a look why it was detected.

You can find this log in the following folder: C:\ProgramData\Malwarebytes\MBAMService\LOGS

 

[ac4482]

let me know if you need anything else

MBAMService.log.txt

[miekiemoes]

Hi,

It looks like it detected while copying the files to the malwarebytes directory for further analysis by the rootkitscanner (since this is enabled) where it couldn't properly read the files anymore. Note, this only affected the files in that directory and didn't affect the ECMDS.EXE file itself. Normally you shouldn't have this detection anymore.

[ac4482]

well if i tell MBAM to delete it on reboot it redetects it on the next scan aswell

 

Windows Defender/Trend Micro/ESET dont seem to detect it for whatever reason either

[Paszu]

14 hours ago, thisisu said:

Hi,

We're investigating. Without being able to compare the files, we can't be sure. But here is the intended target: https://www.virustotal.com/gui/file/7f090424b7bff748d55955790f9e39e0505db6ca1fc81bd60acbbe51f7e907e2/detection

If someone is able to attach the different file, other than MD5: 48AFC1F06F8EACA41BE7CC52C55D3783, we can thoroughly check what may be wrong and if it's a false positive.

Thank you

here is mine emcds.exe from ESET Internet Security 15.2.11.0 no detection 0/69

https://www.virustotal.com/gui/file/fb343885ae8b4b47ac3a6a89cb588320cd15e1fb5ff879102df294081f1f1d04

Edited July 13, 2022 by Paszu

[miekiemoes]

Can you disable the rootkit scanner, reboot malwarebytes, then update and enable rootkit scanning again and see if it's still detected?

[ac4482]

just disbaled rootkit > rebooted mbam > updated > reenabled rootkit > full scan no detection

then restarted my system rescanned no detection again

 

thanks heaps and awesome turn around time

[miekiemoes]

Thanks for the heads up!