Reply to thread

Message

<blockquote data-quote="WiseVector" data-source="post: 884071" data-attributes="member: 76851">Hi,&quot;MEMRAY&quot; belongs to WiseVector StopX&#039;s memory protection module. Which means WiseVector StopX found hidden code or hidden modules in process. And the code or module is detected as malware by our AI based memory scanner.We have analysed all memory logs generated today. We only found one false positive and we have fixed it. The problem is caused by programs come from <a href="http://www.essentialobjects.com" target="_blank">www.essentialobjects.com</a>. We don&#039;t know what exactly the product is. The program will call &quot;rundll32.exe&quot; to load a Dll, then the Dll (&quot;eoloader.dll&quot;) will load two another Dlls directly in memory. The two Dlls only exists in memory you can&#039;t see them in hard disk. Our memory scanner detected the Dlls as malware. Anyway, if you have used any product from essentialobjects.com, you should know it is a FP and we have fixed it.By the way, after V2.63 was released, we have spent a lot of time to analyse the memory logs from our users who have enabled &quot;Help fight malware by providing threat statics&quot; ( really appriciate for their help and trust. We got tons of memory logs. Note, we don&#039;t know who sent these logs, If you are interested in what&#039;s in the logs, please refer to the page: <a href="https://www.wisevector.com/en/en-privacy/" target="_blank">https://www.wisevector.com/en/en-privacy/</a>). Most in-memory threats will cause system process being alarmed,&nbsp; and we know well that this might make our users feel WiseVector StopX is aggressive, so we spend lots of time to analyse to ensure the detection is correct. We find 98% of them are malicious. Once a system process is detected as &quot; MEMRAY: MalThread&quot; or&quot; MEMERAY: MalCode.&quot;, please pay special attention. You&#039;d better do a full system scan immidiatly or contact us directly. It&#039;s difficult to explain memory threat to our users. Since it is just code in memory without files in hard disk. We are trying to figure out a better way to help users understand this.</blockquote>

[QUOTE="WiseVector, post: 884071, member: 76851"] Hi, "MEMRAY" belongs to WiseVector StopX's memory protection module. Which means WiseVector StopX found hidden code or hidden modules in process. And the code or module is detected as malware by our AI based memory scanner. We have analysed all memory logs generated today. We only found one false positive and we have fixed it. The problem is caused by programs come from [URL='http://www.essentialobjects.com']www.essentialobjects.com[/URL]. We don't know what exactly the product is. The program will call "rundll32.exe" to load a Dll, then the Dll ("eoloader.dll") will load two another Dlls directly in memory. The two Dlls only exists in memory you can't see them in hard disk. Our memory scanner detected the Dlls as malware. Anyway, if you have used any product from essentialobjects.com, you should know it is a FP and we have fixed it. By the way, after V2.63 was released, we have spent a lot of time to analyse the memory logs from our users who have enabled "[B]Help fight malware by providing threat statics" ( really appriciate for their help and trust. We got tons of memory logs. Note, we don't know who sent these logs, If you are interested in what's in the logs, please refer to the page: [/B][URL='https://www.wisevector.com/en/en-privacy/'][B]https://www.wisevector.com/en/en-privacy/[/B][/URL][B]). [/B]Most in-memory threats will cause system process being alarmed, and we know well that this might make our users feel WiseVector StopX is aggressive, so we spend lots of time to analyse to ensure the detection is correct. We find 98% of them are malicious. Once a system process is detected as " MEMRAY: MalThread" or" MEMERAY: MalCode.", please pay special attention. You'd better do a full system scan immidiatly or contact us directly. It's difficult to explain memory threat to our users. Since it is just code in memory without files in hard disk. We are trying to figure out a better way to help users understand this. [/QUOTE]

Verification