DVDguy Posted May 29 ID:1639632 Share Posted May 29 Hello and greetings, currently running a offline scan with windows defender atm as I type this. I was doing a random scan and it mentions system.dll was detected. out of confusion, I did just update malwarebytes. I will try to scan with a few more processes here in a few, but I wanted to see if this was a new thing popping up or mentioned from anyone else here. Thank you. Danny Link to post Share on other sites More sharing options...
Porthos Posted May 29 ID:1639633 Share Posted May 29 @DVDguy Could you provide the log from Malwarebytes? Link to post Share on other sites More sharing options...
DVDguy Posted May 29 Author ID:1639640 Share Posted May 29 8 minutes ago, Porthos said: @DVDguy Could you provide the log from Malwarebytes? Sure thing here it is. Malwarebytes Scan Report 2024-05-29 114543.txt Link to post Share on other sites More sharing options...
DVDguy Posted May 29 Author ID:1639641 Share Posted May 29 It is a odd one, windows defender itself does not see it as a threat, but malwarebytes is the only one noticing it. Link to post Share on other sites More sharing options...
Porthos Posted May 29 ID:1639642 Share Posted May 29 (edited) 3 minutes ago, DVDguy said: but malwarebytes is the only one noticing it. You need to turn off rootkit scanning. https://www.virustotal.com/gui/file/b6598384c5ace05924dfa987b9b47777b64d121a023aa2eee65a96781c01a8c1?nocache=1 Given you had rootkit scanning enabled, that might be the reason since this reads user mode with kernel-mode version and when a file is in use at the time, it might see a difference here. This doesn't mean it's a rootkit though. This might just happen when the file is in use. Sometimes this also gives unpredictable results as that engine works slightly different. This is exactly why rootkit scanning is disabled by default when you install Malwarebytes. Also, our current engines are powerful enough already to deal with rootkits even when rootkit scanning is disabled. Rootkit scanning is not enabled by default. You may want to disable that unless you think you have a rootkit infection. Rootkit scanning is really aggressive and does ignore some whitelisting which can result in false positives. If you decide to keep rootkit scanning on, just be aware of the possibility of false positives. Edited May 29 by Porthos 1 Link to post Share on other sites More sharing options...
DVDguy Posted May 29 Author ID:1639644 Share Posted May 29 4 minutes ago, Porthos said: You need to turn off rootkit scanning. https://www.virustotal.com/gui/file/b6598384c5ace05924dfa987b9b47777b64d121a023aa2eee65a96781c01a8c1?nocache=1 Given you had rootkit scanning enabled, that might be the reason since this reads user mode with kernel-mode version and when a file is in use at the time, it might see a difference here. This doesn't mean it's a rootkit though. This might just happen when the file is in use. Sometimes this also gives unpredictable results as that engine works slightly different. This is exactly why rootkit scanning is disabled by default when you install Malwarebytes. Also, our current engines are powerful enough already to deal with rootkits even when rootkit scanning is disabled. Rootkit scanning is not enabled by default. You may want to disable that unless you think you have a rootkit infection. Rootkit scanning is really aggressive and does ignore some whitelisting which can result in false positives. If you decide to keep rootkit scanning on, just be aware of the possibility of false positives. ok, so nothing to really worry about? I installed dr web trial for now to see if it notices anything going on as well. Link to post Share on other sites More sharing options...
DVDguy Posted May 29 Author ID:1639645 Share Posted May 29 windows defender offline mode detected nothing as well, i did recently update windows to. Link to post Share on other sites More sharing options...
Staff blender Posted May 29 Staff ID:1639662 Share Posted May 29 Hello, It is an odd place for that file and not a common location for it at all. Probably from extracting an installer to the root of your system drive. Usually it lives in whatever %programfiles% directories that use it, in randomish named temp directories when the installer is run and contents extracted, and buried in several Assembly directories if they require specific versions of that dll. So there will be multiple versions all over the system. Just rarely ever in root of system drive. If you know what put it there then you can have MBAM ignore it. It is a super old rule detecting it by path. Not malicious in itself, so nothing to worry about. 1 1 Link to post Share on other sites More sharing options...
DVDguy Posted May 29 Author ID:1639663 Share Posted May 29 sorry for the crude snapshot, i noticed a older program i used msi afterburner was giving me a warning, so i removed it, then this popped up scanning with dr web doing a offline scan. Link to post Share on other sites More sharing options...
DVDguy Posted May 29 Author ID:1639664 Share Posted May 29 I swapped to fancontrol as msi afterburner over time began to fizzle out a bit, but forgotten to uninstall it anyway. uninstalling msi afterburtner caused this to happen? sorry my anxiety is highly up at the moment. Link to post Share on other sites More sharing options...
Porthos Posted May 29 ID:1639666 Share Posted May 29 (edited) 4 minutes ago, DVDguy said: sorry my anxiety is highly up at the moment. You need to take a breath and stop scanning with every program you can get your hands on. You are going to make things worse for both your computer and your mental health. Edited May 29 by Porthos 1 Link to post Share on other sites More sharing options...
DVDguy Posted May 29 Author ID:1639670 Share Posted May 29 4 minutes ago, Porthos said: You need to take a breath and stop scanning with every program you can get your hands on. You are going to make things worse both for your computer and your mental health. Sorry, is this file considered malware? I am learning about alot of this more recently. the file date is 2/16/2015, and is around 103kb. Link to post Share on other sites More sharing options...
DVDguy Posted May 29 Author ID:1639671 Share Posted May 29 or the image posted above** Link to post Share on other sites More sharing options...
Porthos Posted May 29 ID:1639673 Share Posted May 29 3 minutes ago, DVDguy said: is this file considered malware? Probably not considering the software it is related to. Link to post Share on other sites More sharing options...
DVDguy Posted May 29 Author ID:1639677 Share Posted May 29 Just now, Porthos said: Probably not considering the software it is related to. Ok thank you and sorry again, I will try to do a clean update of windows, and call it a day. i noticed my c drive was losing more space over time, I wanted to try to figure out why suddenly it was edging closer to 6.16 out of 111GB. Then this rabbit hole. haha. I usually have a routine of updating my software Link to post Share on other sites More sharing options...
DVDguy Posted May 29 Author ID:1639680 Share Posted May 29 Apparently from the log or what I could understand, and from googling it a recent ms security update is goofed up, causing it to loop. Or fail to download. Explaining why i am prob seeing my drive shorting slowly in space. I just need to figure out how to remove any unneeded files from it after. DANNYSPC_stat-29052024_140403.csv Link to post Share on other sites More sharing options...
Porthos Posted May 29 ID:1639682 Share Posted May 29 16 minutes ago, DVDguy said: I wanted to try to figure out why suddenly it was edging closer to 6.16 out of 111GB. 111 gigs is usually close to what a 120 gig formats to. That is small for running Windows. Link to post Share on other sites More sharing options...
DVDguy Posted May 29 Author ID:1639690 Share Posted May 29 looks like my windows borked. :( I am in tears atm from all of this, sorry again for all of this drama from me. all of my hardwork into what i do is now possibly done, it tells me a "grub" error as i boot up into the drive. this was a donation from my brother. he used to use linux, and for me to see this error means windows 10 pro borked. Link to post Share on other sites More sharing options...
Porthos Posted May 29 ID:1639691 Share Posted May 29 (edited) 1 hour ago, Porthos said: You need to take a breath and stop scanning with every program you can get your hands on. You are going to make things worse for both your computer and your mental health. I am sorry you have more issues now. I did warn you. Do you have another computer you could build a Windows USB with? Edited May 29 by Porthos Link to post Share on other sites More sharing options...
DVDguy Posted May 29 Author ID:1639692 Share Posted May 29 2 minutes ago, Porthos said: I am sorry you have more issues now. I did warn you. Do you have another computer you could build a Windows USB with? currently installing it atm on this flash drive with my laptop. windows 10 i can not remember if i needed a serial key to activate it with this or not. Link to post Share on other sites More sharing options...
Porthos Posted May 29 ID:1639693 Share Posted May 29 Just now, DVDguy said: i can not remember if i needed a serial key to activate it with this or not. No, it will reactivate on its own when you get online. 1 Link to post Share on other sites More sharing options...
DVDguy Posted May 29 Author ID:1639699 Share Posted May 29 looks like it wont recover anything from the drive, so i might have to do a fresh install in this instance. sadly. Link to post Share on other sites More sharing options...
Porthos Posted May 29 ID:1639705 Share Posted May 29 13 minutes ago, DVDguy said: looks like it wont recover anything from the drive, so i might have to do a fresh install in this instance. sadly. There are ways to use a Linux boot disk but I do not know your skill level. Link to post Share on other sites More sharing options...
Porthos Posted May 29 ID:1639706 Share Posted May 29 (edited) Also, https://www.diskpart.com/windows-10/fix-mbr-windows-10-0708.html https://www.easeus.com/partition-manager-software/free-mbr-repair-tool.html Edited May 29 by Porthos Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now