Advice Request Driver from Lenovo identified as virus. False positive?

[Jay44]

The "Sabsik.FL.A!ml" detection's on Microsoft Defender is a detection by AI Machine Learning.
Even if the recognized AVs (Kaspersky, GDATA, Bitdefender, F-Secure etc.) do not detect it, I can't say that it is 100% clean... (given the detection Sophos / Malwarebytes)
But on the other hand, Symantec/Norton has removed the detection....

The most likely hypothesis is that Lenovo uses a confuser (to protect source codes) that has potentially been used by a malware, hence the "PowerShell" detections...

If someone has a download link to run it on a virtual machine, I take

Thanks for reply.
Because I don't know if I can post link here, I DM you the driver's information page, whink includes a download link.
Thanks for your kindly help again!

 

[SeriousHoax]

Microsoft is fast at fixing false positive when reported to them. Though in this case of this driver, Lenovo themselves should contact Microsoft and sort it out quickly and should even pause the delivery of the driver for now. But TBH, Lenovo should have checked this beforehand. Even our resident developer on this forum Andy Ful submits his apps to security vendors prior to releasing a new version to make sure popular AV products don't detect his tools after releasing.

Submit a file for malware analysis - Microsoft Security Intelligence

Submit suspected malware or incorrectly detected files for analysis. Submitted files will be added to or removed from antimalware definitions based on the analysis results.

www.microsoft.com

 

[Jay44]

Microsoft is fast at fixing false positive when reported to them. Though in this case of this driver, Lenovo themselves should contact Microsoft and sort it out quickly and should even pause the delivery of the driver for now. But TBH, Lenovo should have checked this beforehand. Even our resident developer on this forum Andy Ful submits his apps to security vendors prior to releasing a new version to make sure popular AV products don't detect his tools after releasing.

Submit a file for malware analysis - Microsoft Security Intelligence

Submit suspected malware or incorrectly detected files for analysis. Submitted files will be added to or removed from antimalware definitions based on the analysis results.

www.microsoft.com

I want to report to Microsoft at first, but they force me to uploaded file.
BTW, I report to Lenovo psirt this week, they said they have a team on this issue, but don't have results to share yet.

 

[Shadowra]

Hello guys!

After testing, I can give you a verdict.
He sent me the link, I was able to download it and test it.

Result : It's a 100% false positive

Already, the file is about 780Mb (I downloaded it very quickly, I have fiber optics).
Then, it is signed, but that means nothing, you can also sign a malware you will say...

Well, nothing happened. The installation went smoothly

Here are the screenshots.

He used PowerShell once, probably to replace a driver.

Spoiler: Installation

Spoiler: NPE Scan

Spoiler: Malwarebytes

Nothing has been detected and the virtual amchine is doing very well.
It is a false positive of the antivirus

 

[Jay44]

Hello guys!

After testing, I can give you a verdict.
He sent me the link, I was able to download it and test it.

Result : It's a 100% false positive

Already, the file is about 780Mb (I downloaded it very quickly, I have fiber optics).
Then, it is signed, but that means nothing, you can also sign a malware you will say...

Well, nothing happened. The installation went smoothly

Here are the screenshots.

He used PowerShell once, probably to replace a driver.

Spoiler: Installation

Spoiler: NPE Scan

Spoiler: Malwarebytes

Nothing has been detected and the virtual amchine is doing very well.
It is a false positive of the antivirus

Actually, I downloaded MB at first, and MB detect 11F3.exe as trojan Powershell.

Maybe the new database fixed it?

 

[Shadowra]

Actually, I downloaded MB at first, and MB detect 11F3.exe as trojan Powershell.

Maybe the new database fixed it?

I think a member must have sent it to Malwarebytes and reported it as a false positive.
I had no detection on my side

 

[ForgottenSeer 69673]

Not that it matters but I have uploaded many files to VT that the installed of Malwarebytes version detects as malware, but the VT Malwarebytes does not detect.

This is why Malwarebytes is detecting the file: CVE-2021-3971

Lenovo Notebook BIOS Vulnerabilities - Lenovo Support US

support.lenovo.com

 

[roger_m]

This is why Malwarebytes is detecting the file: CVE-2021-3971

It should be unrelated, as a video driver in unrelated to a BIOS update.

 

[ForgottenSeer 69673]

It should be unrelated, as a video driver in unrelated to a BIOS update.

If you say so but I was just assuming the driver included WITH the NIOS update was why MB was flagging it. Please read again.

CVE-2021-3971: A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable.

 

[roger_m]

If you say so but I was just assuming the driver included WITH the NIOS update was why MB was flagging it. Please read again.

The detection "Trojan.PowerShell" is in no way related to a BIOS vulnerability. It seems that the download is just for the video driver anyway.

 

[ForgottenSeer 69673]

Ok was posted, then removed. Backdoor

Lenovo issues fixes for laptop backdoors | Malwarebytes Labs​

https://blog.malwarebytes.com/exploits-and...

Apr 21, 2022 · Lenovo issues fixes for laptop backdoors UEFI. UEFI is a specification that defines

But yes you are correct, the OP downloaded the driver and it was not because his computer was shipped with the backdoor .

Lenovo laptops open to attack — what to do right now

ContentsThree vulnerabilities foundCheck If Your Lenovo Laptop Is Affected And What To DoMore information Security firm ESET today announced that three vulnerabilities in hundreds of Lenovo laptops could potentially leave millions of users at risk. These vulnerabilities allow hackers to inject...

en.viknews.com

 

[SeriousHoax]

I submitted it to Microsoft today, and now they have removed the detection. So the false positive is gone.
But it also shows how incompetent or careless the people at Lenovo are. They couldn't even submit a false positive report.

 

[Jay44]

I submitted it to Microsoft today, and now they have removed the detection. So the false positive is gone.
But it also shows how incompetent or careless the people at Lenovo are. They couldn't even submit a false positive report.
View attachment 266103

Thank you for your help
I contact to Lenovo Twitter, Lenovo website support, and ask them if they can report to Microsoft.
Seem they did't do this.

 

[Jay44]

Lenovo psirt said this is only a package issue, not a virus. They will repackage the driver.
Looks like @Shadowra is right.