BobSoul Posted June 2, 2023 ID:1570383 Share Posted June 2, 2023 Hi Got the following detections on my nebula endpoints detecting cyberlink media suite registry entries and uninstall file - Which is present on most dell system. Category: Malware Group name: ITmachines Public endpoint IP: Endpoint name: OS platform: Windows OS release name: Microsoft Windows 10 Pro Location: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS|C:\PROGRAM FILES (X86)\CYBERLINK\SHARED FILES\RICHVIDEOUNINSTALL.EXE Policy name: ITmachines Report time: June 2nd 2023, 11:10:16 UTC Scan time: June 2nd 2023, 11:01:00 UTC Action taken: Quarantined Threat name: Malware.AI.2019312709 Type: reg_value Category: Malware Group name: ITmachines Public endpoint IP: Endpoint name: OS platform: Windows OS release name: Microsoft Windows 10 Pro Location: C:\PROGRAM FILES (X86)\CYBERLINK\SHARED FILES\RICHVIDEOUNINSTALL.EXE Policy name: ITmachines Report time: June 2nd 2023, 11:10:16 UTC Scan time: June 2nd 2023, 11:01:00 UTC Action taken: Quarantined Threat name: Malware.AI.2019312709 Type: file The diagnostics zip file is to large to upload if you need it let me know which file in the zip to send. I did attach file though richvideouninstall.zip Link to post Share on other sites More sharing options...
BobSoul Posted June 2, 2023 Author ID:1570393 Share Posted June 2, 2023 Did an update and restored and then re ran - it still detected but also removed an additional file - as well as the zip file The machine run scans every 4 hours everyday and prior scans were fine no detection on same files Category: Malware Group name: ITmachines Public endpoint IP: Endpoint name: OS platform: Windows OS release name: Microsoft Windows 10 Pro Location: C:\USERS\NFHRA\APPDATA\ROAMING\Microsoft\Windows\Recent\richvideouninstall.lnk Policy name: ITmachines Report time: June 2nd 2023, 12:14:57 UTC Scan time: June 2nd 2023, 12:06:10 UTC Action taken: Quarantined Threat name: Malware.AI.2019312709 Type: file Ran a scan against the file with EMSISOFT and it came back as clean Link to post Share on other sites More sharing options...
Staff blender Posted June 2, 2023 Staff ID:1570394 Share Posted June 2, 2023 Thank you for the report. This is fixed now. Link to post Share on other sites More sharing options...
BobSoul Posted June 2, 2023 Author ID:1570396 Share Posted June 2, 2023 Thank You ! Link to post Share on other sites More sharing options...
BobSoul Posted June 2, 2023 Author ID:1570412 Share Posted June 2, 2023 I am still getting this across several machines just now 11:14 am eastern - I am updating all endpoints manually and then will see how it goes - maybe the update hasnt trickled down to all my endpoints Link to post Share on other sites More sharing options...
BobSoul Posted June 2, 2023 Author ID:1570416 Share Posted June 2, 2023 Even After updating the endpoint agent and protection files -- still detects these after I restore when I rescan-- Its happening across about 100 machines - ( all not on same network ) Should I wait longer to try again? Link to post Share on other sites More sharing options...
BobSoul Posted June 2, 2023 Author ID:1570422 Share Posted June 2, 2023 Some endpoints appear to grab the updated and scan fine others dont even after restarts... Any suggestions? Link to post Share on other sites More sharing options...
BobSoul Posted June 2, 2023 Author ID:1570444 Share Posted June 2, 2023 Still detecting on several endpoints -- I'm just removing now since I cant seem to get them to see the update -- unless only stand alone got the update and not Nebula endpoints - So far still getting detections on this file -- I know its a false ID Emsisoft and others are seeing it clean -- and its always the preinstalled dell version that is getting detected. Yesterday and all through the night scans went fine still the update this morning. Any suggestions on getting these endpoints to actually see the correction ? Link to post Share on other sites More sharing options...
Staff blender Posted June 2, 2023 Staff ID:1570457 Share Posted June 2, 2023 Sorry for delay... possible there is another MD5? Can you grab the MD5 from a couple more endpoints? Files too if possible. Link to post Share on other sites More sharing options...
BobSoul Posted June 2, 2023 Author ID:1570460 Share Posted June 2, 2023 I'll try to get it from last one - I have just been removing the software from each workstation as I have so many to deal with. It appears its the 2020 - 2021 version of the Cyber link Media suite that being detected. Link to post Share on other sites More sharing options...
Staff blender Posted June 2, 2023 Staff ID:1570461 Share Posted June 2, 2023 I disabled the rule totally so there shouldn't be any more hits. A couple more files with different MD5 if possible would be good so we can strengthen our fp prevention on this. Give it a few minutes and push out another update to your endpoints. Let me know. Link to post Share on other sites More sharing options...
BobSoul Posted June 2, 2023 Author ID:1570462 Share Posted June 2, 2023 Ok got one from a machine I didnt restore from richvideouninstall.zip Link to post Share on other sites More sharing options...
BobSoul Posted June 2, 2023 Author ID:1570463 Share Posted June 2, 2023 I will have another one I hope with a different MD5 - from the last machine that has been getting hits Link to post Share on other sites More sharing options...
BobSoul Posted June 2, 2023 Author ID:1570472 Share Posted June 2, 2023 Ok Heres the second one i grabbed -- running scans now to see if any further false hits richvideouninstall.zip Link to post Share on other sites More sharing options...
Staff blender Posted June 2, 2023 Staff ID:1570474 Share Posted June 2, 2023 Indeed was a unique MD5. Thanks. I'll watch in case you have any more. I don't think you will see any more though. Link to post Share on other sites More sharing options...
BobSoul Posted June 2, 2023 Author ID:1570481 Share Posted June 2, 2023 Thanks Just ran scan on one that was always hitting and it came out clean Link to post Share on other sites More sharing options...
Staff blender Posted June 2, 2023 Staff ID:1570482 Share Posted June 2, 2023 Good to hear. Again, thanks for reporting this. Please don't hesitate to reach out again if there are any further issues. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now