Malwarebytes Premium Threat Scan Found Two Threats Overnight: ZAMGUARD64

[TheThornWithin]

Daily threat scan found two threats:  Exploit.cve202131728 C:\Windows\system32\DRIVERS\ZAMGUARD64.SYS and Registry Key HKLM\SYSTEM\CURRENT\CONTROLSET\SERVICES\ZAM_GUARD

FRST.txt Addition.txt FRST.txt

[Porthos]

4 minutes ago, TheThornWithin said:

Daily threat scan found two threats: 

Does this computer have Zemana AntiMalware?

[TheThornWithin]

No.

[Porthos]

Have you ever used it at any time?

[TheThornWithin]

No sir.

[Porthos]

Please attach the detection log and the zipped detected file.

 

[TheThornWithin]

I don't understand.

[Porthos]

2 minutes ago, TheThornWithin said:

I don't understand.

Lets start with a log showing the detection.

You can find Scan and Protection logs within the Malwarebytes 4 program in the following location

 

 

RTP stands for Real-Time Protection and is where automatic protection operations would normally be logged

 

 

If you click on the View option you should get something similar to the following with other options available.

 

 

 

 

Thank you

[TheThornWithin]

I don't understand the zipped file part. Hope this detection log is what you're requesting.

detection.txt

[Porthos]

1 minute ago, TheThornWithin said:

I don't understand the zipped file part. Hope this detection log is what you're requesting.

This is good, I want research to check this out before we hassle with "malware removal" at this point.

Staff can get the rest of what is needed from the following report.

https://www.virustotal.com/gui/file/543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91?nocache=1

[wolnavi]

Hi I am also facing the same issue, daily scan showed up this.. Usually I will just quarantine threats but now I'm not sure if is it safe to quarantine driver files? 

drivers.zip mb_det_log_20230607_1.txt

[shadowwar]

These were added on purpose do to the drivers being abused to kill antivirus software. 

Please see here:

 

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-31728

 

[Porthos]

@shadowwar

If both users or other users with this issue quarantine the items is that going to be the end of the issues? As it will be mitigated?

[shadowwar]

Yes. I believe the later versions arent vulnerable. 

 

[shadowwar]

We actually have evidence of this occuring to shut us down. 

[shadowwar]

 

 

[TheThornWithin]

So, is this the resolution? We've reached a consensus? "Quarantine the items"? (I didn't know you could quarantine a registry key.) We don't need to "hassle with 'malware removal'"? My PC is no longer compromised? I don't understand what the exploit is or how it came to affect my computer.

[shadowwar]

You may want to visit our malware removal forum and have someone just look over a frst log to make sure you are clean. The older version of the drivers are vulnerable to be misused by malware. They could end up on your system legitimately by someone who may have worked on your computer before or by malware. We have no way to tell how they got there. 

[TheThornWithin]

Hello? This is the malware removal forum. Porthos is supposed to be helping me.

Edited June 7, 2023 by TheThornWithin

[David H. Lipman]

Your thread was moved from; Windows Malware Removal Help & Support to; 

Malwarebytes for Home Support  ---> False Positives    ---> File Detections

 

 

[TheThornWithin]

So I have to start all over again in the Malware Removal forum? I'm just trying not to do anything wrong or confusing.

[Porthos]

1 minute ago, TheThornWithin said:

So I have to start all over again in the Malware Removal forum? I'm just trying not to do anything wrong or confusing.

Please do.

[TheThornWithin]

All righty. On my way. Thank you.