gmshedd Posted December 20, 2020 ID:1428204 Share Posted December 20, 2020 Today, for the first time, MB 4.2.1.89 identified my 7-Zip executable and its install file, 7z1900 to be Trojan.SmokeLoader. They've been installed on the laptop for years. No word about it on here or anywhere else on the internet. Scanned as ok with Windows Defender. Quarantined them for the moment. BTW, noticed that MB has a 7Z.dll in its program directory. Two other odd things: MB is "Unable to contact license server", and repeatedly fails to install a new update, even after I explicitly added the license for the affected laptop to my account by logging in on the same laptop (testmy.net shows download speed of 40 Mb and upload at 6 Mb). I downloaded a new install for MB and will try installing fresh and then rescanning the 7Z files. Link to post Share on other sites More sharing options...
OctoberRaven Posted December 20, 2020 ID:1428206 Share Posted December 20, 2020 I have also experienced this. Downloaded 7-zip v. 19.00 x86 again just to be sure, and it comes up again. 64-bit versions of 7zip don't get flagged though. Link to post Share on other sites More sharing options...
OctoberRaven Posted December 20, 2020 ID:1428207 Share Posted December 20, 2020 Clarifying (no edit function on the forum, apologies for double post: I got the false positive but not the update issue. Link to post Share on other sites More sharing options...
Staff Atribune Posted December 20, 2020 Staff ID:1428208 Share Posted December 20, 2020 Could you please share the scan results? Link to post Share on other sites More sharing options...
OctoberRaven Posted December 20, 2020 ID:1428210 Share Posted December 20, 2020 scan1.txt<- Original result from my routine daily scan scan2.txt<- Test scan of a known-good redownload of 7zip v 19.00 32-bit 1 Link to post Share on other sites More sharing options...
Staff Atribune Posted December 20, 2020 Staff ID:1428211 Share Posted December 20, 2020 Thanks, this is a false positive and will be fixed in the next update. 2 Link to post Share on other sites More sharing options...
gmshedd Posted December 20, 2020 Author ID:1428214 Share Posted December 20, 2020 Thanks for the quick work on the 7Z false + OctoberRaven and Atribune. I'll work on the License server/failed install through support if it persists after I reinstall MB. Link to post Share on other sites More sharing options...
gmshedd Posted December 21, 2020 Author ID:1428361 Share Posted December 21, 2020 I succeeded in getting the latest version (4.3.0) of MB to install on my 32-bit Windows 10 laptop by turning off Defender, but MB is still not showing under Virus & threat protection after rebooting, and I don't see any option to make MB the virus protector under Manage Providers in Windows Security. This information applies to a 32-bit Windows 10 system. My 64-bit systems don't have this problem; they show MB as the active virus protection. However, neither bit version can connect to the license server when I click on Account in the MB Settings. Link to post Share on other sites More sharing options...
Porthos Posted December 21, 2020 ID:1428370 Share Posted December 21, 2020 On 12/21/2020 at 2:37 PM, gmshedd said: However, neither bit version can connect to the license server when I click on Account in the MB Settings. Can you please collect and upload as an attachment the diagnostic data using our MBST? Download and run the Malwarebytes Support Tool Accept the EULA and click Advanced tab on the left (not Start Repair) Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply Link to post Share on other sites More sharing options...
gmshedd Posted December 23, 2020 Author ID:1428805 Share Posted December 23, 2020 Ultimately, the fix seemed to be to change the MB security setting to "Always register MB in the Windows Security Center." Of course, this allowed MB to appear in Windows Security settings as the Virus & Threat Protection, as you would expect, but it also allowed MB to connect to the license server (when selecting "Account" in MB settings), which I didn't expect. I think, if MB isn't registered with Windows Security Center, then Windows Defender interferes with MB attempts to install updates and contact the license sever. Link to post Share on other sites More sharing options...
Porthos Posted December 23, 2020 ID:1428806 Share Posted December 23, 2020 On 12/23/2020 at 12:26 PM, gmshedd said: I think, if MB isn't registered with Windows Security Center, then Windows Defender interferes with MB attempts to install updates and contact the license sever. That is not correct. I and 100's of my clients have no issues with Malwarebytes not being registered in the security center. It is my standard setup. Link to post Share on other sites More sharing options...
gmshedd Posted December 23, 2020 Author ID:1428807 Share Posted December 23, 2020 Sorry to double up here. One more thing: I'm not sure how or why MB wasn't registering with Windows Security Center on this particular PC. I have 5 seats of MB and this was the only one that wasn't registering--maybe because it's the only 32-bit system? Maybe Windows 32-bit acts differently, or the MB 32-bit acts differently. Link to post Share on other sites More sharing options...
Porthos Posted December 23, 2020 ID:1428808 Share Posted December 23, 2020 On 12/23/2020 at 12:29 PM, gmshedd said: Sorry to double up here. One more thing: I'm not sure how or why MB wasn't registering with Windows Security Center on this particular PC. I have 5 seats of MB and this was the only one that wasn't registering--maybe because it's the only 32-bit system? Maybe Windows 32-bit acts differently, or the MB 32-bit acts differently. Cant say. I have not seen a 32bit system in about 10 years. Link to post Share on other sites More sharing options...
gmshedd Posted December 23, 2020 Author ID:1428810 Share Posted December 23, 2020 On 12/23/2020 at 12:31 PM, Porthos said: Cant say. I have not seen a 32bit system in about 10 years. Like many issues, it happened after an update--either of Windows or of MB. Everything has worked fine for a year, with consistent Windows and MB updates being applied, and then, bang, an update happens and a problem appears. At least that's my surmise. Problem has been solved. Thanks for your help. 1 Link to post Share on other sites More sharing options...
Porthos Posted December 23, 2020 ID:1428812 Share Posted December 23, 2020 Good you have the issue solved. Best wishes. Link to post Share on other sites More sharing options...
rollingtatoo22 Posted December 27, 2020 ID:1429453 Share Posted December 27, 2020 I've had this false positive too on the same day. I'd like to precise that in my case, the suspicious 7z.exe wasn't my main one, but one bundled to Sourcetree in its Program Files (x86) directory. Is there any chance that it wasn't a false positive, but that the Trojan would have morphed and/or moved somewhere else in my system? I'm probably being paranoid, but reading a little on SmokeLoader, i thought it was the kind of tactic it would be able to do. Might have misunderstood what i've read. Link to post Share on other sites More sharing options...
OctoberRaven Posted January 9, 2021 ID:1431370 Share Posted January 9, 2021 Another 7zip false positive scanagain.txtFetching info... Link to post Share on other sites More sharing options...
Porthos Posted January 9, 2021 ID:1431371 Share Posted January 9, 2021 On 1/9/2021 at 5:42 PM, OctoberRaven said: Another 7zip false positive scanagain.txt 1.4 kB · 3 downloads Quote Components Version: 1.0.1130 I suggest updating and re-scanning. 1.0.1134 does not detect the file. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now