LiquidTension

Hi all, Thank you for trying out this latest beta version and providing feedback!

Hello, The PFROs in this case are expected. These files are not related to definitions but rather in-app messaging. The PFROs you're seeing are deletion operations for files no longer required. Deleting the file on-reboot is used in this case for simplicity to avoid complications with determining if the file is intentionally still in use or not. It's not related to file permissions or indicative of any sort of issue. Are you stating that you only see an issue after startup with slowness/hangs when these PFROs are processed by Windows? If you delay the start of Real-Time Protection (Settings -> Security -> Windows startup -> Advanced -> Delay Real-Time Protection...), does this have any impact?

Thank you for reporting this. Now that you've uninstalled AVG, please continue to monitor the situation and let us know if you encounter any further blue screens or not.

Hello, This is currently expected. The "4.1.2.173" in the file name is a combination of the Malwarebytes service and MBSetup version numbers. 4.1.2 = Malwarebytes service Major.Minor.Patch semver 173 = MBSetup build number We are reviewing whether a change to this file naming format is needed.

Hello, Thank you for the report. Could you run the Malwarebytes Support Tool please and provide the generated file? https://support.malwarebytes.com/hc/en-us/articles/360039023453-Upload-Malwarebytes-Support-Tool-logs-offline

This version has now been fully released. See here for details: https://forums.malwarebytes.com/topic/257102-malwarebytes-41/?do=findComment&comment=1392458

We have a defect filed for this incompatibility and will be investigating further. In the meantime, Web Protection will need to be disabled in Malwarebytes to allow normal usage of the VPN.

Hi @pxwell, I've sent you a private message with follow-up information.

Hello, Is this consistent in every Windows session? Do you see the same behaviour in Safe Mode or with a clean boot (excluding Malwarebytes Service)? We haven't had any other reports of this and it's not reproducible, so we'll need additional information to track down the root cause. Could you start by gathering logs with the Malwarebytes Support Tool please? https://support.malwarebytes.com/hc/en-us/articles/360039023453-Upload-Malwarebytes-Support-Tool-logs-offline

Hello, Thank you for the file. The logs indicate you were still on the old version when the most recent detection occurred. The product was only updated to the new beta version a few hours after the detection occurred. Now that you have the beta version installed, you shouldn't experience the issue.

Hello, Which issue are you referring to? The false-positive detections for Microsoft Office programs (Word, Excel, etc) or the performance issue with Windows 10 v2004 (or potentially something different entirely)? This forum topic is related to false-positive detections for Microsoft Office programs. You've mentioned programs such as Explorer and WinZip which are unrelated. if you are experiencing false-positive detections for Microsoft Office programs, we have a fix for this currently in beta. See here. If you're experiencing something else, please clarify the issue. Please provide logs as well using the Malwarebytes Support Tool: https://support.malwarebytes.com/hc/en-us/articles/360039023453-Upload-Malwarebytes-Support-Tool-logs-offline

Thanks for the report. We'll look into why those folders weren't removed correctly. Regarding the registry leftovers you mentioned - note that there are many keys/values that may contain references to Malwarebytes but are not explicitly created by the product and are not appropriate to remove. This is the case with any software installation. The Support Tool does a very thorough job with removing registry keys/values. If you have any details on exactly what was leftover, we can certainly take a look.

Please note we've released a new beta update that corrects this issue. See here for details: https://forums.malwarebytes.com/topic/261368-microsoft-office-blocked-by-ransomware-protection/?do=findComment&comment=1392001

Please note we've released a new beta update that corrects this issue. See here for details:

Please note we've released a new beta update that corrects this issue. See here for details: https://forums.malwarebytes.com/topic/261368-microsoft-office-blocked-by-ransomware-protection/?do=findComment&comment=1392001

Hi all, Thank you for the feedback. Please note we've released a new beta update that corrects this issue. See here for details: https://forums.malwarebytes.com/topic/261368-microsoft-office-blocked-by-ransomware-protection/?do=findComment&comment=1392001

Please note we've released a new beta update that corrects this issue. See here for details:

Please note we've released a new beta update that corrects this issue. See here for details: https://forums.malwarebytes.com/topic/261368-microsoft-office-blocked-by-ransomware-protection/?do=findComment&comment=1392001

Thank you for the report. @ball2hi I've sent a private message with follow-up steps.

We have released a new beta update to address this issue (component package version 1.0.976). To obtain this beta update: Enable beta updates if necessary by opening the Malwarebytes settings and turning the "Beta updates" setting on. Click About followed by "Check for updates". Note: If you have just started the computer, you may need to wait a few minutes before the update will be available to download. If you have configured any new exclusions as a result of this issue, we recommend removing them once component package version 1.0.976 or higher is installed. This can be achieved using the Allow List found in Detection History or Settings and should only be done after the new update is installed. For more details, see this post: https://forums.malwarebytes.com/topic/257042-malwarebytes-41-beta/?do=findComment&comment=1391997

@frozen To confirm, is the issue still not exhibited with the latest standalone Malwarebytes Anti-Ransomware? https://forums.malwarebytes.com/topic/258918-latest-version-of-mbarw-beta-v091956-11349-released-11-june-2020/ You mentioned the issue is not exhibited when using a different profile. Can you try a new/default profile located on a different drive so we can rule out if the contents of your profile has any impact? ----- @PhoneNumberZero Is your Firefox profile also located on a different drive than the one Firefox is installed to? Could you also try the Malwarebytes Anti-Ransomware standalone linked above and see if the issue is still exhibited?

Hi all, We are aware of an issue involving Ransomware Protection blocking Microsoft Office programs such as Word and Excel. We are actively investigating this issue and hope to provide a fix for this as soon as possible. For now, if you encounter a Microsoft Office block and are certain this is a false-positive, we recommend the following: Restart Ransomware Protection by opening the Malwarebytes dashboard, toggling Ransomware Protection off and then back on again. If you are still unable to launch the blocked Microsoft Office program, restart the computer. Add a folder exclusion for the affected program (e.g. C:\Program Files (x86)\Microsoft Office\Office12). Refer to Add to the Allow List in Malwarebytes for Windows v4 for details on adding exclusions to Malwarebytes. The path of the affected program can be found in the block notification or the Detection History -> History tab within Malwarebytes. The steps above should prevent further blocks and allow you to resume normal usage of your Microsoft Office program. If you still encounter an issue after carrying out the steps above or would like confirmation on whether the block you encountered is a false-positive: Please create a new topic in the Ransomware false-positive section and attach the log file generated by the Malwarebytes Support Tool. In some circumstances, you may need to perform a repair of your Microsoft Office product if you are still unable to launch it after restarting the computer. See here for details: https://support.microsoft.com/en-us/office/repair-an-office-application-7821d4b6-7c1d-4205-aa0e-a6b40c5bb88b We will provide an update to this topic when available.

Thank you for the additional detail provided on the issue. Based on the logs provided, I can confirm the reboot was triggered by Malwarebytes. Clicking "Later" to the notification should not result in the machine being rebooted. We have a defect filed and will be investigating this further. For reference, this is the notification being referred to:

Hello, Thank you for the logs. This was indeed a false-positive that we intend on releasing a fix for as soon as possible. In the meantime, if the issue does happen again, you may wish to add a folder exclusion for C:\Program Files (x86)\Microsoft Office\Office12 until the fix mentioned above is released.

Hi @Chinook, Thank you for the logs. Could you provide more detail on what you are specifically doing with Chrome when the block occurs? Is it a consistent set of actions that result in the block occurring? If you launch Chrome without extensions or plugins loaded, does the issue still occur? Close all instances of Chrome. Press the Windows Key + R on your keyboard at the same time and enter: Chrome.exe --disable-extensions --disable-plugins Please do the following: Download and run Process Monitor: https://docs.microsoft.com/en-us/sysinternals/downloads/procmon Reproduce the Chrome block. Stop the Process Monitor capture (File -> click "Capture Events" to remove the checkmark). Save the output (File -> click "Save..."), zip it up, upload to a file hosting service of your choice (WeTransfer.com, Google Drive, OneDrive, etc) and share the download link. Rerun the Malwarebytes Support Tool, gather logs and attach the new mbst-grab-results.zip.