Jump to content

djacobson

Staff
  • Content Count

    1,189
  • Joined

  • Last visited

Everything posted by djacobson

  1. Here are some excerpts from some previous answers to this question.
  2. djacobson

    System Tray Icon Missing

    I believe it is going to be included in an update currently targeted for 1/31.
  3. Network drives are not scanned by the end-user workstation with the MBEP software, they are also no longer available to be scanned via the context menu option. This is something MBAM 1.x was able to do and if you are familiar with that older option, you may notice that MBEP's context menu option goes grey when attempting to right click network drives and engage the option. Drives like these should be scanned using an MB install on the hosting server where the drives are local and can be scanned as normal. As far as ransomware, if a workstation is hit it wouldn't matter what drive the ransomware is encrypting, or if that location happened to be ignored. We are looking at the malware's behavior itself, things like this are not running from your drive share in the QB folders, they are running in memory to attack the file system. The exclusions relieve whichever particular real-time engines that the exclusions can be, or are, applied to within the extra "Exclusion applied To" option set. The exclusions are for MBEP to ignore the excluded items, and what they are doing, not what is happening to them via something else. The main consequence and concern around what's been brought up in the previous paragraphs, is to be aware that an attack on an unprotected workstation can reach anything to which that workstation has access. Say there's an unprotected workstation, and it got ransomware and began to encrypt the system. When the attack is finished with the local drives and moves on to the network drives/shares, even if the server hosting the share has MBEP installed, the share is in danger in this scenario. The attack is in the unprotected workstation's memory, and the protected server's MBEP real-time cannot see that. It is vital to protect your servers by protecting all your workstations.
  4. djacobson

    System Tray Icon Missing

    Hi @RickyF, give the service pipe registry key a try and policy startup delays, other than that, we'll need to wait for the upcoming release.
  5. @j_french How is your policy setup? Where are the clients set get their signature updates?
  6. Google's policy towards 3rd party protection will have to change before that can happen. The best approach for now is to leverage your scanner schedules as you have been doing, and malicious connections to internet addresses will be blocked by the web portion. Chrome removed from Anti-Exploit list of Protected Apps in Malwarebytes https://support.malwarebytes.com/docs/DOC-2655 The Google Chrome team announced in a blog post dated November 2017, it will not allow 3rd-party vendors to inject into the Chrome browser for Windows beginning in September 2018. Refer to Reducing Chrome crashes caused by third-party software for details - https://blog.chromium.org/2017/11/reducing-chrome-crashes-caused-by-third.html - "In September 2018, Chrome 69 will begin blocking third-party software from injecting into Chrome processes." Google believes this approach makes Chrome more secure and less prone to crashes, which they identify as the main source of stability issues with their browser. Security solutions such as Malwarebytes for Windows' Anti-Exploit functionality uses this injection into Chrome to provide an additional filter. The filter checks to see if the web pages rendered contain exploits and blocks it accordingly. In response to Google's decision, and to minimize the inconvenience to users seeing these incompatibility messages from Chrome, Malwarebytes has removed Chrome from the Anti-Exploit list of protected apps in the following products: Malwarebytes for Windows – Component Package version: 1.0.441 and above Malwarebytes Endpoint Protection Malwarebytes Endpoint Security While we find a way to restore protection for Google Chrome, Malwarebytes believes our other layers of protection such as web blocking, malware blocking, anomaly detection, anti-ransomware, plus the other protection applications in anti-exploit will continue to protect users from malware and other forms of threats.
  7. djacobson

    System Tray Icon Missing

    The default policy is set to use the Incident Response product in a scan only config, have you changed it to run any realtime options? Just want to make sure there. Give an in-policy startup delay a try as well, upping the timer as you go, if you get to 120 seconds and it doesn't reliably start, then we'll need to look at something else conflicting with the service's attempt to be started. I do not recommend having the self-protect or self-protect early start on unless you are actively dealing with an infection that is targeting and modifying Malwarebytes' files. That is what the option is for, getting Malwarebytes to run on a heavily infected machine in which the malware is preventing Malwarebytes from running. In the past this feature was called "Chameleon" and was a free standalone tool. When MB3 came out, this product was turned into a feature within the main program. The B2B Admin Guide doesn't really discuss its usage. The B2C help guide has much more detail on the MB3 engine, this is what Cloud uses: https://www.malwarebytes.com/support/guides/mb/Settings2.html Enable self-protection module: This setting controls whether Malwarebytes creates a safe zone to prevent malicious manipulation of the program and its components. Checking this box introduces a one-time delay as the self-protection module is enabled. While not a negative, the delay may be considered undesirable by some users. When unchecked, the "early start" option which follows is disabled. Enable self-protection module early start: When self-protection is enabled, you may choose to enable or disable this option. When enabled, the self-protection module will become enabled earlier in the computer's boot process, essentially changing the order of services and drivers associated with your computer's startup. Not only does it introduce more delay to the startup, it also changes items to a read-only mode, which can prevent even the legitimate file changes Malwarebytes needs to do when upgrading portions of the program. Azure AD is an interesting angle, the support team will need a fair amount of information/logs from those machines, it would be best to open a ticket in regards to this lead.
  8. djacobson

    System Tray Icon Missing

    Has the machine rebooted to take up the new service timeout config? Do you have an existing startup delay set in your policy?
  9. djacobson

    Tray icon NOT showing

    See this post -
  10. djacobson

    System Tray Icon Missing

    Hi @Buddy, this one is a new issue, but with a similar symptom as your past problem. For this one, pick out one machine and add this line to the registry via CMD or PS. Let me know if that works for you. reg add HKLM\SYSTEM\CurrentControlSet\Control /v ServicesPipeTimeout /t REG_DWORD /d 60000
  11. That is a hurdle, I'm sorry it is not easier at the moment 😔
  12. Hi @PTechS, if QB has a list of folder areas or network addresses used for the update, these locations can be added to Malwarebytes' exclusions area to help.
  13. Hi @AlexLeadingEdge, that would be a nifty thing to add for the admins that like to research. I'll help get that submitted. Here's where you can find that info until it becomes a feature: In Quarantine, click on the detected threat and look for the Detection ID, this is the hash of the quarantine file. In this example, my Detection ID is 7a06df44-1524-11e9-bf13-00ff70609f10, so there should be a 7a06df44-1524-11e9-bf13-00ff70609f10.quar and 7a06df44-1524-11e9-bf13-00ff70609f10.data file in C:\ProgramData\Malwarebytes\MBAMService\Quarantine on the endpoint. On the endpoint, go to C:\ProgramData\Malwarebytes\MBAMService\ScanResults, look in the hashed *.json file with the same-ish timestamp as your scan, open the json in a text editor, confirm you have the right scan file to quarantine files by finding this line: [ID of the scan result json] { "applicationVersion" : "3.6.1.2716", "clientID" : "Endpoint Agent:[clientID]", "clientType" : "agentScan", "componentsUpdatePackageVersion" : "1.0.478", "cpu" : "x64", "dbSDKUpdatePackageVersion" : "1.0.8718", "detectionDateTime" : "2019-01-10T22:09:55Z", "fileSystem" : "NTFS", "id" : "760fa592-1524-11e9-9f28-00ff70609f10", A little later in the scan result json you can find the ID again, along with the MD5 and SHA256 of the detected and quarantined file(s). "threats" : [ { "linkedTraces" : [ ], "mainTrace" : { "cleanAction" : "quarantine", "cleanContext" : { }, "cleanResult" : "successful", "cleanResultErrorCode" : 0, "cleanTime" : "2019-01-10T22:10:46Z", "generatedByPostCleanupAction" : false, "id" : "7a06df44-1524-11e9-bf13-00ff70609f10", "linkType" : "none", "objectMD5" : "3B9269B0C31CA2CCFB30D75A83B0609E", "objectPath" : "C:\\USERS\\DJACOBSON\\DESKTOP\\TEST-TROJAN.EXE", "objectSha256" : "FC0771A47FFF3909627D224119BC4C9AD3CF8F11EA33CD7CE61A9B8894F5C23C", "objectType" : "file",
  14. No problem! I'm glad I could help a bit, hopefully that gives more confidence in how MB works in these kinds of scenarios.
  15. Hi @REGITDept. The extension is likely not doing anything to generate malicious behavior, and so only shows when the user's machine is scanned versus being picked up by the realtime engines. The process of installation itself is not malicious. We're not watching what you install, it's more like how it installs. Unless it is a situation where there is a dropper attempting to execute something other than what the user or allowed application had intended within the installer, there shouldn't be any provocation of the realtime to trigger. Chrome's user profile, bookmark and extension syncing process is not malicious on its own, it would not trigger our realtime under this normal syncing behavior, no matter what it happens to be pulling from your user's home machine(s) and installing to their workstation. But the moment whatever was installed runs, and attempts to maliciously hook in memory or run payload, that is when Malwarebytes' realtime engines will engage. An extra tip here is that malicious browser extensions tend to be items which attempt to poison or doctor search results and land you on a bad link (most just serve up ads though), if that link or ad has a malicious server on the other end, the connection will be dropped as Malwarebytes' web blocker engine would engage. This is a typical case as many of the programmatic functions of extensions aren't doing anything malicious enough to trigger the file, exploit or ransomware engines. The web portion is the likely the block you'll see until a scan cleans out the items. More options around this for consideration; disabling Chrome's autosync ability via GPO, sparing your environment the stuff on your user's home machines. Google's team has posted how to do this in Chrome support thread. Another one may be leveraging Windows Applocker, which can provide an extra dimension of control over what ends up on machines where users may have perms enough to install software. This is especially useful if you have exec's that insist on "being admins" on their machines, but regularly get themselves in trouble with the crap they install on their computer.
  16. Hi @j_french, a short workaround can be to make a new installer package and not include the Anti-Malware portion. It has not changed and does not need to be installed in an upgrade. Additionally, if your endpoint's Anti-Exploit version exceeds what is bundled in the installer, it can be skipped as well. The issue you are having has cropped up in the past with 3rd party deployment from time to time. When using 3rd party deployment the advice we gave back then, and the best way we found to avoid this, was to do an uninstall, restart, reinstall upgrade process. Though with what you are experiencing in your 1.9, we have had some trickling reports that this 1.8 and 1.9 double install can happen using the built-in push tool. We are looking at the install process but have not found the exact cause with this hiccup just yet. If you have current examples of this, may I ask if you could post some of the logs from the upgrade attempts? Look in Windows temp, C:\Windows\Temp\MSIxxxxx.LOG, sort by date and look inside for them referring to "clientsetup.msi" (or if renamed, whatever that may be). Thanks!
  17. djacobson

    BSOD caused by farflt.sys

    Farflt.sys is the driver for the Anti-Ransomware / Behavior Protection engine. Restarting the endpoint will release any threads which may be stuck. Disabling the option can help avoid encountering these while the new cause for this is investigated. Consider as well, many server's need extra configuration of exclusions or what real-time protections are able to be used, this is based on what roles a server may provide.
  18. The secondary console installer is pulled from your main MBMC server after installation, the installer is an exe and is located in C:\Program Files (x86)\Malwarebytes Management Server\WebApp\client.
  19. Having it do that for fresh installs is pretty far outside of what I had been discussing, you said you have a ticket in right now?
  20. djacobson

    Experiencing High Resource Usage

    Resource usage issues have cropped up over the product's life a few times, but not all causes have been the same thing, despite similar symptoms. One person's solution in this long standing thread may not be applicable to someone else's issue. For those of you reading this in the future, please keep this in mind. @Kernel009, have a look at what starts on the machines. When a delay helps out with resource usage, it is most often due to competing protection software engines trying to load at similar times, or another program starting up that attracts the attention of one or more protection software real time engines into watching it. This sort of behavior can begin before log on, if that is the case, recording the event with a tool called Process Monitor, in a boot logging mode, can help provide visibility into what is happening at that time.
  21. Hey ML, are you intending to scan for infections or scan for endpoints to which you can deploy the protection portion of the software? Scanning for and deploying to clients directly - https://support.malwarebytes.com/docs/DOC-1021 Video example - https://support.malwarebytes.com/videos/1033 Alternative deployment, creating an offline client installer package to use with your preferred deployment tool - https://support.malwarebytes.com/docs/DOC-1098 If the protection side of the software is already deployed, you can set a scanning schedule under Policy -> your policy -> Edit -> Scheduler. To perform an on-demand scan, go to Client -> highlight a chosen machine -> Right click "Run ____ Scan Now".
  22. Jared is exactly right. If your machine shows in the client view as online with protections on, the install was successful, just delayed in its check-in for longer than the push installer is set to wait.
  23. Old clients should show that 'older version, you can upgrade' message. The other one, 'successful install but fail to register' is long standing, mostly meaningless message. The time-frame for an install to check back into the server is hardcoded, when that time passes, this status is saved and the message is presented, no matter if the check-in was ultimately successful. A re-scan of this same status will show you a different version of the same thing, the 'already installed, has not registered' message, despite a machine showing in the client view as online and communicating.
  24. Hi @ML1234, your first password is blank, nothing, after this it will prompt you to create your password and you will be able to log into the console 😊
  25. djacobson

    Question about Malware bytes

    This functionality is part of the Endpoint Detection and Response level for the Endpoint Protection product. See more about it here - https://www.malwarebytes.com/business/endpointprotectionandresponse/
×

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.