Prevx FP killed my Rollback Rx & deleted all my snapshot!!!

i hate to say this but his is BS!!

what the heck Prevx delete all my 15 snapshot!

i'm very dissapointed with this kind of FP (if it's FP)....i really dont know that this is FP or not with the rootkit.MBR message.

 

You knew it was an FP yet you pressed cleanup now why?

 

I thought the Rollback issue had been previously fixed following earlier reports of MBR detections.

I'm surprised you ran cleanup without first getting the file analysed to check whether it's indeed a FP.

 

dissapointing FP from Prevx... but nothing is perfect.

but not much of a ISR program if the sector mapping is not backuped somewhere else for recovery

 

reminds me of this......https://www.wilderssecurity.com/showthread.php?t=239719.................

absolutely right..........

 

I'm sure you could have right clicked it and chosen to exclude it.

 

you guys are diehard fans with your reply....

let me clear it for you guys, a month ago this Rollback-Prevx "FP" is already fixed...i dont know that this FP still exist. Is this standard that every other month FP will exist (re: Rollback-Prevx FP)?

this is BS!

 

Hmm The Rollback Rx false positive should have been corrected but they do use the exact same techniques as a rootkit to hide their MBR changes so it is impossible to automatically whitelist any new version of theirs.

We're sorry for the false positive but there is little that we can do to automatically trust the Rollback Rx MBR. If you could send a scan log to report@prevxresearch.com we will ensure that we correct this ASAP.

 

That is why you make sure it's a false positive before you clean it up then you would not have this problem. If I ever came across something that look fishy I would ask for help here first before messing with anything in the MBR. And another thing is that all security programs have false positives and that's the way it is sorry to say.

TH

 

Prevx detected the same thing just right now. Please FIX the FP.

 

Can you please send me a scan log to report@prevxresearch.com so that I can fix the FP?

 

Also note that Prevx shouldn't have actually deleted any snapshots - all that it would be cleaning is the 512 byte master boot record. You may want to try reinstalling Rollback Rx to see if that would restore the view of the snapshots.

 

I put a ticket in via support on Prevx awhile back with exactly the same FP.

But to date it has never been fixed and they have received my scan logs.

Hopefully one day it will be, otherwise one of the programs will have to go.!

 

Joe what happens when u run clean up is that Rollback rx does not work any more and reverts back to the installation backup, ie the 1st one when the software was installed. That could be a week or two or far longer..

 

Here you go Joe.
View attachment prevx.log

 

Why on earth are you guys complaing?

Rollback-RX and Eaz-Fix are rootkits. For heaven's sake they hide not only the mbr but their whole file system.

PrevX is only doing it's job and it's going it pretty well.

Instead of complaining to PrevX, you should complain to HorizonDatasys because Rollback fails to protect the mbr!

@PrevXhelp
can you pm me? Maybe I can help on how to "overide" this detection.

Panagiotis

 

The FP should be corrected - try running a scan when you are online (so that it gets the updated signature) and it should show "clean/secure" now.

If not, please let me know!

 

Scan - done, fixed. Thanks Joe.

 

when my computer restart after the BSOD message, Prvex & Rollback is uninstalled already. it's like i rollback my system where i don't have anything.

now i know why AV Comparative give big penalty to FP on their test.

I would rather be infected and let my KIS kill that malware. damn FP!

 

Every AM/AV vendor suffers false positives from time to time, including KIS & PrevX. Admittedly some cope better than others.

This is the problem when using behaviours, generics and heuristics as a means of detection. There is no great panacea to all of this other than creating a signature for every known instance, but that is time consuming given the amount of malware in existence hence why other methods are employed, but they ain't foolproof as we see occasionally.

As for getting infected and letting KIS deal with it, that's fine as long as they are able to detect it and deal with it, and this goes for any antimalware program, PrevX included.

 

I still disagree that this is a FP Rollback Rx <is> using a rootkit on the MBR to hide the sectors. We are able to scan extremely low in the system to get at the real data which other antirootkit programs cannot do currently.

If the other antirootkit programs were able to scan as low as we are, they would have the same FP. And the fact that we are able to clean the system out from under Rollback Rx shows that they have a major flaw in that they don't block all writes to the disk which means that malware could do the same

 

In that case, those that are concerned about this should contact the developers of Rollback Rx/Eaz-Fix as suggested by pandlouk, and provide them with details of what is happening when using programs like Prevx.

As an interim measure, could Rollback Rx be added under Detection Overrides?

 

The FP is already fixed so it shouldn't be a problem now (but yes, you can use Detection Overrides or right click on the file and Report as a False Positive)

 

The same thing happened to me in May & I ended up with my system as it was in November! Luckily I had data backups etc. This Forum came a month too late!

I kept getting their dire messages over several weeks so I finally let it clean up (I did so fearfuly I admit!).

Hey I know I should have checked the issue out more but I also no idea that the result would be so catastrophic. Some commentors here in this thread have been overly harsh on those of us who sprang for the FP.

One of my peeves about Prevx was that they had no forums (they do here...now!) where I could have found others who were experiencing this. There's surprisingly precious little self help material of any kind on their website (Well now they've added a link to this (new) Forum. All a cust can do (til now) is send an email asking about a FP.

The Prevx Edge software seems to have only 2 options: clean up or declare it a false positive for good. There's no tools for investigating online (Other than a link to the website--"Help & Support").

I posted a ticket with them in May but they never got back to me (not that they could help me after the fact).

Horizon Data Systems' forums (they keep disappearing & being reborn) are also not helpful. We are reduced to posting about Rollback ad hoc at Wilders--or poaching in the FDISR forum. [Google searches on the issues recommended too).

For Your Info: I switched to my trusty FDISR (knowing there's a decent forum for it & also having decided not to buy the Rollback 9 upgrade) & kept Prevx Edge (for now).