Vipre ate my Rollback

[Tullius]

I was trying out the latest version of Vipre Antivirus last night. Within minutes of its first scan it had identified a serious rootkit problem in my mbr and would require a reboot to fix it.
Well, it looks like the "rootkit" was RollBack RX because it obliterated the pre-Windows program and all my snapshots bar the starting snapshot.
I would have thought that RollBack was protected against things like that.

[HDS-Jacob]

Hi Tullius,

Welcome to the Horizon DataSys forum. For reference, support can be reached at http://support.horizondatasys.com and let's see if we can get suggestions for you here as well.

Best,
Jacob

[Froggie]

Hi Tullius! I don't know about Vipre but other AV scanners allow you to customize how it does its FULL (and partial) scans. The one I use, ESET, allows me to either SELECT or DESELECT the scanning of the MBR... I have it selected 'cause ESET "likes" the Rollback MBR mods.

I don't know how Rollback can possibly guess how an AV scanner is going to see its code in the MBR and act accordingly. Every AV scanning algorithm, especially the so called "heuristic" scanning capability, acts differently. Signature file scanning is pretty straight forward but heuristics is truly a crap shoot. All HDS can do is contact Vipre and tell them what they're doing... it's up to Vipre to make changes accordingly.

Since this is the first I've heard of an AV scanner wrecking Rollback (this group isn't that small), I'd guess that Vipre's heuristics are pretty stringent and probably generate many false positives along the way.

If I had my druthers, I'd use an AV scanner that likes Rollback... Rollback is such a useful tool that it would definitely wind up higher on my list of important apps than any AV scanner (there are so many of those... and only ONE Rollback )

Good luck!

[Tullius]

Of course you're quite right about the actions of Anti-Virus scanners. If they couldn't probe everywhere they wouldn't be much use. It's just that I got the idea that RollBack RX concealed itself from everything so I was quite surprised to find myself dumped back at a fairly old baseline. I have almost re-installed RollBack with a different anti-virus program for the moment. I say almost because netreg thinks I have a network failure at the moment, which I don't.
I see from another post that I'm not the only one with this problem so I assume something has fallen over somewhere. I shall await developments
Regards,
Tullius

[Froggie]

Hello again Tullius! Just to let you know... in my never ending quest for trying to break Roolback and what it does to me, I just recently got around to installing VIPRE PREMIUM v4. After setting everything up, I ran both QUICK and FULL scans and it discovered nothing bad about my Rollback MBR... it ran happy as a clam.

Your MBR (from your previous experience) may really have been infected with something non-Rollback related... or, you we're using a previous version of VIPRE and they have since fixed the problem in v4.

Thought you might be interested...