PLP Posted September 13, 2016 ID:1061627 Share Posted September 13, 2016 Hello, got a bunch of alerts this morning showing the following path is infected with Ransom.Petya. Is this a false positive and is anyone else seeing this today? Ransom.Petya Quarantined C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe Link to post Share on other sites More sharing options...
millertek2001 Posted September 13, 2016 ID:1061629 Share Posted September 13, 2016 Exact same thing here, I have received 16 messages from the console: C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe Quarantined Ransom.Petya The false positives over the last couple of week are going to give me a heart attack. I sure hope an engineer will chime in. The latest version of the DB I show is v2016.09.13.07. Link to post Share on other sites More sharing options...
PLP Posted September 13, 2016 Author ID:1061630 Share Posted September 13, 2016 My DB version is also showing v2016.09.13.07; my system updated at 6:46 AM EST and I got my first alert at 7:01 AM EST. As the clients update, I am getting more and more alerts. I too hope an engineer chimes in to tell us if this is real or a false positive and how to resolve this. The mdm.exe file at C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\ is getting quarantined on my endpoints. Link to post Share on other sites More sharing options...
millertek2001 Posted September 13, 2016 ID:1061633 Share Posted September 13, 2016 Yeah, I still have the notifications coming in, over and over. I investigated the mdm.exe (Machine Debug Manager) file and the file date on it is 10/26/2006 so this must certainly be a false positive. The Console is reporting that the .exe file and associated registry keys are being quarantined and deleted upon reboot which is not good. So my major concern after hearing that this is confirmed to be a false positive by a MB engineer is that even if they produce an update how am I going to reverse the deleting of these files without having to touch what is up to 50 endpoints right now? Link to post Share on other sites More sharing options...
Mmatiasn Posted September 13, 2016 ID:1061635 Share Posted September 13, 2016 Same I got this notification this morning. Would love some insight on this. Link to post Share on other sites More sharing options...
KBeck Posted September 13, 2016 ID:1061639 Share Posted September 13, 2016 We have it too. Same file, same location, same original date. Hoping it's a false positive. Link to post Share on other sites More sharing options...
millertek2001 Posted September 13, 2016 ID:1061640 Share Posted September 13, 2016 This is going on and on and on... Link to post Share on other sites More sharing options...
jlewiscp Posted September 13, 2016 ID:1061641 Share Posted September 13, 2016 Same here. mdm.exe 10/26/2006 2:40 PM We have about 5 instances of it this morning. We are using mbam management console. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted September 13, 2016 Staff ID:1061663 Share Posted September 13, 2016 Hi, This was fixed already since more than 2 hours ago as of db 2016.09.13.08. We're sorry for the inconvenience. Please update your database to latest build (as of db 2016.09.13.08 and up). Link to post Share on other sites More sharing options...
GenericUser5901 Posted September 13, 2016 ID:1061665 Share Posted September 13, 2016 Thanks Mieke Link to post Share on other sites More sharing options...
PLP Posted September 13, 2016 Author ID:1061678 Share Posted September 13, 2016 2 hours ago, millertek2001 said: This is going on and on and on... Thank you Mieke for the update. Link to post Share on other sites More sharing options...
Xord Posted September 15, 2016 ID:1062028 Share Posted September 15, 2016 Getting these same alerts right now - exact issue as on Tuesday.... Clients are running signatures v2016-09-15.09 It's gotta be a false positive! Anyone else? Link to post Share on other sites More sharing options...
PLP Posted September 15, 2016 Author ID:1062029 Share Posted September 15, 2016 Xord, you beat me to the punch, I was about update the forum that I am getting the same alerts about ransom.petya that we saw on Tuesday. Link to post Share on other sites More sharing options...
JonZ Posted September 15, 2016 ID:1062030 Share Posted September 15, 2016 Started again @ 2:08 Central - do we tweak Elmo, above, for updates? Link to post Share on other sites More sharing options...
thisisu Posted September 15, 2016 ID:1062032 Share Posted September 15, 2016 Hello, Can you please attach the file in question and/or provide your log so we can investigate if this a false positive or not? Guide available here: Link to post Share on other sites More sharing options...
PLP Posted September 15, 2016 Author ID:1062033 Share Posted September 15, 2016 Got my first one today at 2:44 PM EDT. I have spoken to my account manager and he is going to look into what is going on. Hopefully someone from MB support will update the forum with information soon. Link to post Share on other sites More sharing options...
thisisu Posted September 15, 2016 ID:1062034 Share Posted September 15, 2016 We've disabled a rule that we suspect may have caused this. Can you let us know if updating to database version v2016.09.15.10 has stopped the alerts? In any case, we would still like to review the file that was quarantined. Link to post Share on other sites More sharing options...
djhatchell Posted September 15, 2016 ID:1062035 Share Posted September 15, 2016 My organization is experiencing this today. We have had over 50 notifications. The computers are on database version 2016.09.15.09. Has the problem been reintroduced? Link to post Share on other sites More sharing options...
millertek2001 Posted September 15, 2016 ID:1062036 Share Posted September 15, 2016 I am getting them again as well v2016.09.15.09 Link to post Share on other sites More sharing options...
thisisu Posted September 15, 2016 ID:1062037 Share Posted September 15, 2016 4 minutes ago, djhatchell said: My organization is experiencing this today. We have had over 50 notifications. The computers are on database version 2016.09.15.09. Has the problem been reintroduced? 3 minutes ago, millertek2001 said: I am getting them again as well v2016.09.15.09 Please update to 2016.09.15.10 which is available now. We disabled a rule that we suspected caused this. Link to post Share on other sites More sharing options...
millertek2001 Posted September 15, 2016 ID:1062038 Share Posted September 15, 2016 Just now, thisisu said: Please update to 2016.09.15.10 which is available now. We disabled a rule that we suspected caused this. Updating now, thanks Link to post Share on other sites More sharing options...
Xord Posted September 15, 2016 ID:1062039 Share Posted September 15, 2016 FYI: I'm not waiting... I have excluded this file from scanning on all clients (and un-quarantined it to all). Gee... this is the third false positive this month! Whatthehell?!? Does Malwarebytes not have QA on their signatures? ... losing faith here. 2016-09-15 Ransom.Petya - C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe 2016-09-15 Ransom.Petya - C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe 2016-09-02 Ransom.Crysis - C:\Program Files\Microsoft Office\Office12\ORGCHART.EXE Link to post Share on other sites More sharing options...
PLP Posted September 15, 2016 Author ID:1062040 Share Posted September 15, 2016 13 minutes ago, PLP said: Got my first one today at 2:44 PM EDT. I have spoken to my account manager and he is going to look into what is going on. Hopefully someone from MB support will update the forum with information soon. I have uploaded a log file from one of the endpoints with the alert. archived2522-protection-log-2016-09-15.zip Link to post Share on other sites More sharing options...
thisisu Posted September 15, 2016 ID:1062044 Share Posted September 15, 2016 10 minutes ago, PLP said: I have uploaded a log file from one of the endpoints with the alert. archived2522-protection-log-2016-09-15.zip Thank you Link to post Share on other sites More sharing options...
thisisu Posted September 15, 2016 ID:1062053 Share Posted September 15, 2016 (edited) Is anyone able to attach the mdm.exe file that was detected? We'd like to examine this file. Edited September 15, 2016 by thisisu Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now