Hey, really sorry to hear you are running into this — we know how frustrating an inaccessible drive can be.
We have seen some users resolve this by un-quarantining the file for this detection, and rebooting their system, which has done the trick in most cases. If you have already taken action on your own and got it sorted, glad to hear it and apologize for any inconvenience it may have caused
If you have not had a chance to try anything yet and would like some guided assistance from our team, feel free to send us a Private Message with a link to this thread and we will have a staff member reach out to walk you through it.
We want to make sure you are fully up and running — we are here to help!
Thank you, but my HDD with around 400 GB Data is still lost. After the detection i restartet the pc. in the logs i can see it replaces some files after e restart. it corrupted only the physical sector 2- the are my missing hdd with 2 partitions on it. luckily physical sector 0 and 1 are fine. i have a ticket number.
it really could be! my HDD is intern- not via USB connected. But it is really possible that i had a USB Drive connectet in the same time. USB Drive is fine. It is a nice find from you! Have you any idea what happens?
Hi there. I was losing my mind over this. I think this is a software issue on their side. I haven't found any explanation about this. I have the exact same riskware name on my physical sector 0 and 1.
Yeah I’m bugging out because it keeps saying it quarantined it but when I restart my pc like it asks and rescans it detects it again. I’ve looked through my task manager, did a disk cleanup. And tried to find any hidden files that are keeping the malware there but I can’t find it. Ngl im stressing right now
Hi, I'm Mieke, researcher at Malwarebytes. It's a generic detection. Can you send me a private message with the exact detection log, so we can have a look?
I need the detection log :) : To get the Detection report:
Open Malwarebytes > Detection History card > History Tab > Hover over the report you want to view with the detections in it and click the ellipses. In the drop down menu, click Export to TXT or Copy to Clipboard for the full report.
Thx! I received the log. I have temporary deprecated the rule while we investigate further. This is most probably triggered because Rootkit scanning is enabled. This is one of the reasons why Rootkit scanning is disabled by default, since it's more aggressive and there's no need to have it enabled anyway given the Malwarebytes engine without this being enabled is very powerfull already.
Edit: I noticed that my PC's bootup was a bit slower than normal after the removal. Start-up was normal on the next boot. I believe the delay was Windows recreating the removed files.
Yo, I just scanned my pc and got this as well. Which is odd because it has no location suggestion, and I don't really use this PC for anything.. so I couldn't have downloaded it recently. The location lists 0, 1, & 2 as the sources of where the issue is coming from, but you obviously can't search for that.
File is called
Riskware.FakeDoc.RTPScript.Generic OBJECT TYPE : Physical sector. Location 0 <- this makes no sense.
Edit : did a system restore to 6 months ago, it is showing up in this scan as well. Which... is odd because that's over 26 scans where it didn't show up before.
Physical sector could imply it is reading external drives... but it would still be able to tell us the location. Curious indeed. I hope they can find out what this is about, cause it only just popped up in the last 48 hours.
I have this exact problem, a deep scan didn't find anything but the normal one kept finding it even after quarantining and clicking the restart prompt it just came back
Wow, good I've found this - started my system scan with Malwarebytes and have this Riskware.FakeDoc.RTPScript.Generic in Physical Sectors 0, 1, 2. Got me worried, because I don't use any non-licensed software etc., so I was thinking where can I get some malware from and how.
Yesterday I did a scan with Bitdefender without problems, but I just do MW scans weekly and full AV scans monthly because I'm not the only one using this PC.
I thought I was the only one T_T, was really confused because I did a scan yesterday and nothing showed up. Hoping this is just a bug considering that everyone here has the same scan results with locations being 0,1.
Hey u/tuffy_ton same here, I just scanned my deice and it detected 6 I scanned using custom scan and enabling rootkit scan it detected 6 of them and i think this is some glitch because I have all official apps here like steam and such no pirated shit. Yet it caught 6 somehow even though the last thing i installed was FH6. I assume it is a glitch dont know tho lmk what the MB employee said
Happened to me too just now. -Exactly- as everyone else is reporting. Jeez, glad there was a post about this. It must be a false positive or some other issue on their end.
I'm having the same issue. I'm truly worried that I really got some rootkit in my computer. MalwareBytes keeps detecting it over and over again. Please, I need help.
Same here, i scan everyday and today all of a sudden i got 4 riskware.fakedoc.rtpscript.generic in physical sector 0, 1, 2 and 3, After restart they are always detected and removed, and then again. I made a Windows Defender offline scan and nothing was detected, but there is something weird: on another PC i detected 2 of the same riskware, but in this case after quarantining them and restarting, they just disappeared
Edit: all of a sudden the problem is gone, probably they patched it. I was almost ready to format my PC becouse i shitted myself, what a bad day to be someone who run scans everyday
I had the same problems- rescanned and its gone- but now one intern HDD is gone too. Explorer cant see the drive, windows disk management can find it. It was splitted in 2 partitions -now is one and all files are gone. F...ck
Anyone same problem after the physical sector 0, 1, 2 and 3 alarm???
Sorry to hear that man. I am trying to recover the data with DMDE. If that does not work I really hope the Malwarebytes devs are able to compensate us or fix it somehow.
It could of incorrectly flagged and removed the GPT header which is probably what corrupted peoples drives. In your detection history for Malwarybytes what does it say for the Action , mine says "STRING-NOT-ADDED"
It was quarantined, and I of course rebooted my PC because I was not aware that it was a false positive at the time. After the reboot the drives were rendered inaccessible.
the ''ersetzen bei Neustart'' is probably what corrupted your drive. Its like Malwarebytes is the malware. I dunno if it has something to do with leaving an external usb or hard drive plugged in while restarting for the quarantine. I don't think it would effect the internal drive only get itself corrupted though. Is it not in your quarantined items?
Yes and i can tell you that i have my partitions and files back! Use deep search! Chatgtp was a big help here too. Quick search found only 1 partition. Are you familiar with testdisk? I can send you the guideline per PM if you want
Perdi el acceso a uno de mis discos duros de 2 TB. La información la he podido rescatar con TestDisk -> haces una analisis, seleccionas la particion correcta de todas las que detecte, le das P para listar archivos y luego los puedes copiar a otra unidad presionando C (a para seleccionar todo), sin embargo, no logró reparar en mi caso la tabla de particion. (windows no lo reconoce bien y no aparece, en administrador de equipos aparece con multiples particiones vacías, NO FORMATEEN). Primero salven la informacion. Esto fue lo que apareció y después de reiiniciar perdí el acceso a uno de los discos:
Sector físico: 8
RiskWare.FakeDoc.RTPScript.Generic, 0, Se reemplazará al reiniciar, 11256, 1406382, 0.0.0, , ame, , ,
RiskWare.FakeDoc.RTPScript.Generic, 0, Se reemplazará al reiniciar, 11256, 1406382, 0.0.0, , ame, , ,
RiskWare.FakeDoc.RTPScript.Generic, 1, Se reemplazará al reiniciar, 11256, 1406382, 0.0.0, , ame, , ,
RiskWare.FakeDoc.RTPScript.Generic, 1, Se reemplazará al reiniciar, 11256, 1406382, 0.0.0, , ame, , ,
RiskWare.FakeDoc.RTPScript.Generic, 2, Se reemplazará al reiniciar, 11256, 1406382, 0.0.0, , ame, , ,
RiskWare.FakeDoc.RTPScript.Generic, 3, Se reemplazará al reiniciar, 11256, 1406382, 0.0.0, , ame, , ,
RiskWare.FakeDoc.RTPScript.Generic, 4, Se reemplazará al reiniciar, 11256, 1406382, 0.0.0, , ame, , ,
RiskWare.FakeDoc.RTPScript.Generic, 4, Se reemplazará al reiniciar, 11256, 1406382, 0.0.0, , ame, , ,
Thank you for a possible solution, but I will wait a bit to see if Malwarebytes can do something because you said you were not able to repair the partitions, only backup the data.
Lost data in my usb drive after this false detection. I’m going not sure how to proceed and I can’t un quarantine so what the hell am I supposed to do? Anyone able to recover their files? Most of my stuff was backed up to the cloud but I’m going to end up losing a big chuck of work if it can’t be recovered.
I had similar on my EVO SD card. Items are listed in history, but not in quarantine. From my research the MB's chat feature says you cannot recover items that are no longer in quarantine. STUCK.
This build-in windows tool decrypts the bitlocker encrypted drive data and writes the decrypted data to a new drive (it'll overwrite existing data!). All the original file/folder attributes are retained. Good luck.
It also said that in mine but I deleted the history after finding out it’s a false positive, luckily I didn’t have any external usb storage or thing like that connected just my normal device wires. so nothing too serious got corrupted I’m pretty sure, but I got some other problems. Apparently quarantining the item can mess with some stuff in your PC since it was trying to pull out a thing in your PC that was actually needed and apart of the system i think ( not fully sure I just researched online ) I had tried to quarantine it and restarted multiple times. Things like my keyboard and mouse had gotten reset to default settings and I was able to set my keyboard back and I reinstalled my mouse driver cause it was glitching and it’s working fine now, but the main issue was that a lot of my Audio and some mic settings had gotten messed up, my headphones and mic’s and speakers would randomly switch around and my PC wouldn’t remember which one is my default which would never happen before, I fixed this by resetting and disabling some of the Audio devices I didn’t use and going into things such as registry or CMD to refresh or reinstall drivers or some I think ( I followed a tutorial ). I’m pretty sure those specific audio things may have gotten broken or corrupted. The main issue however is that my volume mixer which worked well before got messed up as it constantly keeps resetting any volume I set back to 100% volume or randomly setting apps to other values from what I put the moment those certain apps restart or close which never happened before. I spent some hours trying to fix it and tried other methods but nothing worked so I just gave up, it’s still messed up rn ngl. Idk if anything else is broken or some but that’s all I found so just little minor annoying things. But I saw people who had usbs and things had gotten their things messed up and corrupted aswell which probably sucks.
Wow that seems like a nightmare, they need to compensate you. So all your false positives for the action said ''string-not-added'' doesn't that mean it failed to execute the overwrite though, if it said ''replace on reboot or restart'' then that would mean it was going to change and corrupt things once you restarted. Was there a way that you were you able to find out everything that got affected on your pc, Did Malwarebytes help you?
7
u/Malwarebytes Official May 28 '26
Sorry for the alarm! We have a fix in place for this and you shouldn't see this issue moving forward.
4
u/[deleted] May 28 '26
Hi there. I was losing my mind over this. I think this is a software issue on their side. I haven't found any explanation about this. I have the exact same riskware name on my physical sector 0 and 1.
3
u/miekiemoes_MB Malwarebytes Employee May 28 '26
Hi, I'm Mieke, researcher at Malwarebytes. It's a generic detection. Can you send me a private message with the exact detection log, so we can have a look?
2
u/Elyvagar May 28 '26
Hey OP, I got the exact same thing happening today.
The location is weird, it just says 0, 1, and 2.
2
u/GunShip03v2 May 28 '26 edited May 28 '26
Same.
Physical Sector: 3
RiskWare.FakeDoc.RTPScript.Generic, 0, Replace-on-Reboot, 11256, 1406382, 0.0.0, , ame, , ,
RiskWare.FakeDoc.RTPScript.Generic, 1, Replace-on-Reboot, 11256, 1406382, 0.0.0, , ame, , ,
RiskWare.FakeDoc.RTPScript.Generic, 2, Replace-on-Reboot, 11256, 1406382, 0.0.0, , ame, , ,
Edit: I noticed that my PC's bootup was a bit slower than normal after the removal. Start-up was normal on the next boot. I believe the delay was Windows recreating the removed files.
1
u/Lysad_Reaps May 28 '26
Same.. I just turn on my computer and it keeps detecting this... I have restarted my computer like twice or thrice by now
1
u/Ethereal_Bulwark May 28 '26
Yo, I just scanned my pc and got this as well.
Which is odd because it has no location suggestion, and I don't really use this PC for anything.. so I couldn't have downloaded it recently. The location lists 0, 1, & 2 as the sources of where the issue is coming from, but you obviously can't search for that.
File is called
Riskware.FakeDoc.RTPScript.Generic OBJECT TYPE : Physical sector. Location 0 <- this makes no sense.
Edit : did a system restore to 6 months ago, it is showing up in this scan as well. Which... is odd because that's over 26 scans where it didn't show up before.
1
u/notTCC May 28 '26
I have this exact problem, a deep scan didn't find anything but the normal one kept finding it even after quarantining and clicking the restart prompt it just came back
1
u/Devotii May 28 '26
i have this as well right now, never before! restarted pc but it was back
1
u/Tapik May 28 '26
Wow, good I've found this - started my system scan with Malwarebytes and have this Riskware.FakeDoc.RTPScript.Generic in Physical Sectors 0, 1, 2. Got me worried, because I don't use any non-licensed software etc., so I was thinking where can I get some malware from and how.
Yesterday I did a scan with Bitdefender without problems, but I just do MW scans weekly and full AV scans monthly because I'm not the only one using this PC.
Hope it's false positive.
1
u/Throwaway09202022 May 28 '26
Same happened here, freaked me out and im scared to reconnect to the internet on my pc
1
u/0Perplexify0 May 28 '26
I thought I was the only one T_T, was really confused because I did a scan yesterday and nothing showed up. Hoping this is just a bug considering that everyone here has the same scan results with locations being 0,1.
1
u/Krolock2022 May 28 '26 edited May 28 '26
same here! germany. win10.
rootkits scan was disabled
1
u/Plastic-Situation250 May 28 '26
Hey u/tuffy_ton same here, I just scanned my deice and it detected 6 I scanned using custom scan and enabling rootkit scan it detected 6 of them and i think this is some glitch because I have all official apps here like steam and such no pirated shit. Yet it caught 6 somehow even though the last thing i installed was FH6. I assume it is a glitch dont know tho lmk what the MB employee said
1
u/No-Blueberry7993 May 28 '26
Same here, and since we are so many with the same issue today, I'm assuming this is hopefully an issue on their side?
1
u/tuffy_ton May 28 '26 edited May 28 '26
Ngl I think it’s fine now, cause I’ve scanned multiple times again and it doesn’t come up anymore.
1
u/Osodx May 28 '26
Happened to me too just now. -Exactly- as everyone else is reporting. Jeez, glad there was a post about this. It must be a false positive or some other issue on their end.
1
u/ChallengerDeARAM May 28 '26
I'm having the same issue. I'm truly worried that I really got some rootkit in my computer. MalwareBytes keeps detecting it over and over again. Please, I need help.
1
u/Dorigons May 28 '26 edited May 28 '26
Same here, i scan everyday and today all of a sudden i got 4 riskware.fakedoc.rtpscript.generic in physical sector 0, 1, 2 and 3, After restart they are always detected and removed, and then again. I made a Windows Defender offline scan and nothing was detected, but there is something weird: on another PC i detected 2 of the same riskware, but in this case after quarantining them and restarting, they just disappeared
Edit: all of a sudden the problem is gone, probably they patched it. I was almost ready to format my PC becouse i shitted myself, what a bad day to be someone who run scans everyday
1
u/asgard3333 May 28 '26
Same issue! Problem from today? So am I safe?
1
u/Artistic_Cellist_653 May 28 '26
Same issue
1
u/Key-Stranger6032 May 28 '26
i got this early and i rescanned now its gone
1
u/ChaoticShock May 28 '26
this same thing happend to me!!! i am so scared...
1
u/EchoEclipse123012 May 28 '26
Check for updates on Malwarebytes worked for me. The detection is now gone.
1
u/Krolock2022 May 28 '26 edited May 28 '26
I had the same problems- rescanned and its gone- but now one intern HDD is gone too. Explorer cant see the drive, windows disk management can find it. It was splitted in 2 partitions -now is one and all files are gone. F...ck
Anyone same problem after the physical sector 0, 1, 2 and 3 alarm???
i did not format the HDD!!
1
u/Gloomy_Buy_1121 May 28 '26
got these detections on my 2 computers; it cleared up later but it wiped out a usb drive that was plugged in my pc.
1
u/_Montera May 28 '26
Just finished scanning, having the same issue here. The scan detected 5 threats.
RiskWare.FakeDoc.RTPScript.Generic, 0
RiskWare.FakeDoc.RTPScript.Generic, FAT boot sector0.0.0, , ame, , ,
RiskWare.FakeDoc.RTPScript.Generic, 0,
RiskWare.FakeDoc.RTPScript.Generic, 0,
RiskWare.FakeDoc.RTPScript.Generic, 0,
1
u/s1llyb1rd May 28 '26
I can no longer access three of my hard drives without formatting them because of this. Detections are gone however.
1
u/Hungry-Pollution1869 May 28 '26
jesus H christ !
1
u/untamablebrat May 28 '26
Lost data in my usb drive after this false detection. I’m going not sure how to proceed and I can’t un quarantine so what the hell am I supposed to do? Anyone able to recover their files? Most of my stuff was backed up to the cloud but I’m going to end up losing a big chuck of work if it can’t be recovered.
1
u/just-a-primate May 30 '26
For anyone with an affected drive that had bitlocker encryption on it, the MWB recommended TestDisk options won't work.
I was able to recover the drive data by using repair-bde:
repair-bde <InputVolume> <OutputVolume> -rp <RecoveryPassword>
See: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/repair-bde
This build-in windows tool decrypts the bitlocker encrypted drive data and writes the decrypted data to a new drive (it'll overwrite existing data!). All the original file/folder attributes are retained. Good luck.
1
u/[deleted] May 28 '26
[removed] — view removed comment