Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Rkill found one process to terminate, but MBAM and MSE show clean


  • Please log in to reply
2 replies to this topic

#1 Computronprob

Computronprob

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:12:52 PM

Posted 02 April 2014 - 02:39 PM

As the title says, I'm getting a clean report from MBAM and MSE, but when I run rkill, it is terminating the process:

 

C:\Windows\SysWOW64\ACEngSvr.exe (PID: 4916) [WD-HEUR]

 

Just curious whether this means anything?



BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • Moderator
  • 13,255 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:09:52 PM

Posted 02 April 2014 - 03:26 PM

Heur is the keyword there for questioning whether it is malware or a false-positive.

 

From the net.....The average file size is about 169.29 KB. The file is a digitally signed and issued to ASUSTeK Computer Inc. by VeriSign.

The programs ASUS Splendid Video Enhancement Technology, NVIDIA Stereoscopic 3D Driver and USBCharge+ have been observed as

installing specific variations of acengsvr.exe.

 

Most likely a false-positive if you have any of the products mentioned. You can also go to the file and verify the size.

You can submit the file to VirusTotal - Free Online Virus and Malware Scan  to be scanned by 50 security programs for further analysis.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,592 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:10:52 PM

Posted 03 April 2014 - 06:24 AM

Expanding on what buddy215 said

While RKill is primarily designed to terminate common malicious processes, RKill also always terminates the following by design:
1. Explorer whether you are clean or not.
2. Executable files running from a user profile, from any Temporary Internet file, or from the Windows folder (Windir) without a digital signature.

HEUR Malware is a heuristic detection routine designed to detect common malware characteristics...and generaly is reported when a program "seems to contain suspicious functionality".

Heuristic analysis is the ability of an anti-virus program to detect possible new variants of malware before the vendor can get samples and update the program's definitions for detection. Heuristics uses non-specific detection methods to find new or unknown malware which allows the anti-virus to detect and stop if before doing any harm to your system. Heuristic scanning methods vary depending on the vendor. Some claim to allow emulation of the file's activities in a virtual sandbox. Others scan the file more intensively, searching line by line inspecting the code in a file to see if it contains virus-like characteristics.

The disadvantage to using heuristics is that it is not as reliable as signature-based detection (blacklisting) and can potentially increase the chances that a non-malicious program is flagged as malicious. With heuristics, there is always a potential risk for a "false positive" when the heuristic analysis flags a file as suspicious or infected that contains no malware.

With HEUR detections, it's best to submit the file for anlaysis online and get a second opinion.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users