ASUS driver detected as trojan.zloader

[AlexLeadingEdge]

Hi guys,

I'm not sure if this is a false positive, but would like this checked out as it seems important.

Threat name    Category    Type    Endpoint    Location    Date
Trojan.ZLoader    Malware    file    LT-ASUS-FX506CHB.REDACTED.local    C:\ESUPPORT\EDRIVER\SOFTWARE\WIN32APP\ASUS\ASUS SMART DISPLAY CONTROL\1.4.8\13598\ASUSSMARTDISPLAYCONTROL.EXE    2023-07-22 06:00:02 AM

[cli]

Do you have detection log? Thanks.

[AlexLeadingEdge]

14 minutes ago, cli said:

Do you have detection log? Thanks.

As requested.

MWB_LT-ASUS-FX506CHB.jdm.local_Diag_2023_07_24_11_09_02.zip

[AlexLeadingEdge]

And here is the file. Malwarebytes Business Support wanted me to restore the file back to the workstation and upload it to them.

I'm not happy that I'm potentially putting an infected file back onto a workstation, this seems like a really dumb practice.

Surely Malwarebytes should be able to upload a file from the local quarantine with (1) restoring the file back to its original location and (2) not interrupting the end user by jumping onto their machine to zip up the file and upload it?

ASUSSmartDisplayControl.zip

Edited July 23, 2023 by AlexLeadingEdge

[cli]

Thanks for reporting, this was a false positive and will be fixed in the next update.

[AlexLeadingEdge]

Thanks CLI.