Jump to content

Rsullinger

Staff
 View Profile  See their activity

  • Posts

    533

  • Joined

  • Last visited

 Content Type 

Posts posted by Rsullinger

    Remove PC's from Management console

    in Malwarebytes Management Console

    Posted

    Hello Brainerdmobil,

     

    I asked for the e-mail so I could take it into a private message since it dealt with AD information of that customer. I didn't want to post anything public facing about their AD if that was a cause for the issue. While I understand you were looking for a quick answer for it, I wanted to keep privacy concerns a top priority on this. 

     

    As for a fix, if you do not have ad groups added, please right click and remove the client from the client pane. That will clear it from the console and free up the license. If it is in an added AD/OU group, you will need to wait for the server to remove obsolete clients. You can change how often this is done by going to the admin pane>database settings tab and click on the 'change...' button under the clean up settings area. From there, you should see the delete obsolete clients option and the time frame it waits before it deletes them.

     

    To cleanly remove the client in the future, it is best that you un-install it first from the management console. That will remove it from the client and free up the license from the server instantly.

    Malwarebytes blocking npm script run on windows console (cmd.exe)

    in Exploit

    Posted

    Hey Aroberge,

     

    It should only exclude the script that CMD was calling at that time. However, if it still gets prevented, I want to see the logs for that. Can you reproduce the issue again and when you do, collect these logs for me:

     

    C:\ProgramData\Malwarebytes\MBAMService\mbae-default.log

    C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.log

    The directory is hidden by default so you might have to click on "View -> Hidden items" in Explorer to see it.   There is also a post here from Microsoft on how to do this for the more recent OS: https://support.microsoft.com/en-us/help/14201/windows-show-hidden-files
     

    MBAE updates - some clients updating, some aren't

    in Malwarebytes Anti-Exploit for Business

    Posted

    Hey Trevoralf,

     

    There is not unfortunately. The anti-exploit automatic update can only be pulled through or CDN's. So the only other option would be taking the install package and deploying it through sccm/gpo to the clients if that is an option to you.

    The .exe and .msi can be found here for it:

    1.09.2.1291 exe:

    https://malwarebytes.box.com/s/7gbe30azrsfof7v2poithvvda2huu1w9

    1.09.2.1291 msi:

    https://malwarebytes.box.com/s/6m519c2yvtlkioeryzsbu1t8ueons8mf

    PowerPoint does not work with MB 3.0

    in Malwarebytes for Windows Support Forum

    Posted

    Hello Fred,

     

    That was my mistake. The log file type is different in the standalone version compared to mb3. However, thank you for those logs. I am getting this sent over to our development team to look into this further. Just as additional information from another thread, can you find what build of power-point you are on currently? We have been seeing reports of this happening on the latest version so I want to confirm that information from you. 

    PowerPoint 2016

    in Malwarebytes for Windows Support Forum

    Posted

    20 hours ago, John L. Galt said:

    @Rsullinger - Just finished installing Office 365 Home & Family (had a spare install left) on a VM with the following details:

    1. Host: Windows 10 x64 Pro Insider Preview build 14986
    2. Guest: Windows 10 x64 Pro Insider Preview build 14986
    3. MB3: licensed Premium version (all protections enabled)

    Here is what I found. (I'll update this post as I install other versions and keep testing).

    • Installing Office365 x64 version 1610 [PowerPoint Version 1610 (build 7466.2038)]  Causes 0 issues
    • Updating to Powerpoint x64 version 1611 (build 7571.2075) Causes PowerPoint to not load unless AE protection for PP is disabled.
    • Updating to PowerPoint x64 Version 1612 (build 7628.1000)  Causes PowerPoint to not load unless AE protection for PP is disabled.
    • Installing Office365 x86 version 1610 [PowerPoint Version 1610 (build 7466.2038)]  Causes 0 issues
    • Updating to Powerpoint x86 version 1611 (build 7571.2075) Causes PowerPoint to not load unless AE protection for PP is disabled.
    • Updating to PowerPoint x86 Version 1612 (build 7628.1000)  Causes PowerPoint to not load unless AE protection for PP is disabled.

    Attached is the service log.

    MBAMSERVICE_VM.zip

    Hey John,

     

    Do you mind getting the  C:\ProgramData\Malwarebytes\MBAMService\mbae-default.log file as well after you reproduced the issue? I am having our development team looking into this with the information you provided and they will need that log as well. 

    MBMC

    in Malwarebytes Management Console

    Posted

    Hello Preyash,

     

    Thank you for those. Do you mind grabbing me the event viewer logs as well? If it is due to windows update, that should have a bit more information on it. While FRST does show some event viewer information, it doesn't show all of it and I want to see all the events that occurred on that startup. This will give a bit of information to do this:

     

    https://technet.microsoft.com/en-us/library/cc749339(v=ws.11).aspx

     

    I will want to see the system, application, and security logs. Go ahead and send those to me in a PM if you do not want them posted publicly. 

    PowerPoint does not work with MB 3.0

    in Malwarebytes for Windows Support Forum

    Posted

    Hello FredGreco,

     

    We have been seeing a few reports of this. Do you mind collecting some logs for our developers to take a closer look into this? 

    I want to have you collect two logs from these directories after you trigger the alert again:

    C:\ProgramData\Malwarebytes\MBAMService\mbae-default.txt

    C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.txt

    The directory is hidden by default so you might have to click on "View -> Hidden items" in Explorer to see it.   There is also a post here from Microsoft on how to do this for the more recent OS: https://support.microsoft.com/en-us/help/14201/windows-show-hidden-files

    Along with that we want to collect some more information from the computer to see what else is installed. We want to rule out any conflicts. To do this:
     

    1: Please download FRST from the link below and save it to your desktop:

    http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

    2: Double-click the purple FRST icon to run the program. Click Yes when the disclaimer appears.

    3: Click the Scan button

    4: When the scan has finished, it will make 2 log files in the same directory the tool is run, FRST.txt and Addition.txt. Please attach both files in your reply.

    PowerPoint 2016

    in Malwarebytes for Windows Support Forum

    Posted

    Hello Everyone,

    I want to have you collect a few logs for me. First I want to have you collect two logs from these directories:

    C:\ProgramData\Malwarebytes\MBAMService\mbae-default.txt

    C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.txt

    The directory is hidden by default so you might have to click on "View -> Hidden items" in Explorer to see it.   There is also a post here from Microsoft on how to do this for the more recent OS: https://support.microsoft.com/en-us/help/14201/windows-show-hidden-files

    Along with that we want to collect some more information from the computer to see what else is installed. We want to rule out any conflicts. To do this:

    1: Please download FRST from the link below and save it to your desktop:

    http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

    2: Double-click the purple FRST icon to run the program. Click Yes when the disclaimer appears.

    3: Click the Scan button

    4: When the scan has finished, it will make 2 log files in the same directory the tool is run, FRST.txt and Addition.txt. Please attach both files in your reply.

    Firefox triggers exploit protection

    in Malwarebytes for Windows Support Forum

    Posted

    Hello All,

     

    I want to have you collect a few logs for me. First I want to have you collect two logs from these directories:

    C:\ProgramData\Malwarebytes\MBAMService\mbae-default.txt

    C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMSERVICE.txt

    The directory is hidden by default so you might have to click on "View -> Hidden items" in Explorer to see it.   There is also a post here from Microsoft on how to do this for the more recent OS: https://support.microsoft.com/en-us/help/14201/windows-show-hidden-files

    Along with that we want to collect some more information from the computer to see what else is installed. We want to rule out any conflicts much like what Aura was asking for the Kaspersky conflict. To do this:

     

    1: Please download FRST from the link below and save it to your desktop:

    http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

    2: Double-click the purple FRST icon to run the program. Click Yes when the disclaimer appears.

    3: Click the Scan button

    4: When the scan has finished, it will make 2 log files in the same directory the tool is run, FRST.txt and Addition.txt. Please attach both files in your reply.

     

    Thank you,

     

    Powershell Script Blocked

    in Malwarebytes for Windows Support Forum

    Posted

    Hello Alex,

     

    Thank you for that. IT is the log I was looking for and it is encrypted. So it looks like it may be comming from this file:

     

    C:\Program Files\Managed Antivirus\Managed Antivirus Master Service\powershell.exe 

    Is that something you have on the computer? It seems to be the way it is calling the powershell script may be the reason it is being blocked. If you do know what that script is, do you know what it is attempting to do? 

    Powershell Script Blocked

    in Malwarebytes for Windows Support Forum

    Posted

    Hello AlexLeadingEdge,

     

    I want to have you collect me another log that has a bit more information on that block as I want to see what protection layer it is hitting. The log is called mbae-default.txt and it is found under the C:\ProgramData\Malwarebytes\MBAMService. I would replicate the block again before you grab that log so it is at the bottom. Once you do that, get it over to me and I should be able to see what is happening in this instance. 

    3.0.4 makes computer unusable...

    in Malwarebytes for Windows Support Forum

    Posted

    Hello Mikolajek,

     

    In addition to the information that Lisa wanted, we want to have you collect some logs for us. We want to get more information on what anti-exploit is doing when this is occurring. 

    You can find the logs in the following locations:

    c:\programdata\Malwarebytes\MBAMService\logs\MBAMService.log
    c:\programdata\Malwarebytes\MBAMService\mbae-default.log

     The directory is hidden by default so you might have to click on "View -> Hidden items" in Explorer to see it. 

    Along with this, we want to get a diagnostic log of the system to rule out any conflicts. To do this:

    1: Please download FRST from the link below and save it to your desktop:

    http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

    2: Double-click the purple FRST icon to run the program. Click Yes when the disclaimer appears.

    3: Click the Scan button

    4: When the scan has finished, it will make 2 log files in the same directory the tool is run, FRST.txt and Addition.txt. Please attach both files in your reply.
     

    Thank you,

     

    Ron S

    DRIVER_POWER_STATE_FAILURE on wireless drivers

    in Anti-Exploit Beta

    Posted

    Hello EdAinWestOC,

    Unfortunately anti-exploits exclusions are only able to take the md5 of the program that we are blocking to allow it through our program. So if anti-exploit is the root cause of this, you would not be able to exclude the wireless drivers like that. Just for more information, have you tried un-installing anti-exploit and see if the issue stopped? You mentioned you loaded both programs on to both laptops when this issue occurred so I want to eliminate if it is anti-exploit,  anti-malware, or both. 

    Exploit paylod process blocked

    in Malwarebytes Anti-Exploit for Business

    Posted

    Hello Bumskull,

    Since this alert has occurred, has it happened more then once? 

    This is what is happening with the alert:

     

    "2016-12-02T09:54:33.494-06:00";"tboehm";"6276";"C:\Windows\system32\cmd.exe";"3200";"C:\Windows\system32\cmd.exe";"3";"701";"207";"";"";"";"";"";"";"C:\Windows\system32\cscript.exe cscript.exe \nologo \(blocking out the name).local\SysVol\(blocking out the name).local\Policies\{52D9B9E8-9131-4138-A8EA-C597B562796F}\User\Scripts\Logon\gpo.vbs";"";"";"";""

    Just based on that, it seems like it may be something we block due to the nature of it opening up cmd to launch vbs via cscript. But if this is the only computer having the issue then it may be something else that we need to look into.
     

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.