Jump to content

tdhaslett

Honorary Members
  • Posts

    26
  • Joined

  • Last visited

Everything posted by tdhaslett

  1. Hi All, Wondering if there is a simple fix for this as I have not been able to find anyone else with this issue online. Running MBAE 1.12.2.124. I am trying to download an .exe in Firefox. I browse to a network share that is not mapped as a drive, and when I click New Folder, AE takes over and kills Firefox. If I save the file to an existing folder, it downloads fine. If I create a new folder in a mapped network drive, it works fine and I can download. If I create a new folder in a local drive, it works fine and I can download. The file that it reports as being blocked is not the file that I was downloading. The file that it reports as being blocked is always a file that resides in the folder in which I am trying to create the new folder. So far, in the six times that it has blocked this, it has cited two different files - though there are many other files in the folder as well. Since it is easy to work around, it is not a show-stopper, but it is annoying.
  2. The MBES instructions on how to fix the Web Blocking issue from Saturday says to disable the real-time protection module for MBAM. It does not say to re-enable it after updating the database. I can't imagine that the solution is to leave the module disabled, so should there be another step included to turn the protection module back on again, such as is included in the MBEP instructions?
  3. Eureka! That's what has been causing my users to get logged on with temp profiles so darn much?
  4. So, I've retrieved the EXE for it, if anyone is interested. The upgrade created C:\ProgramData\MalwarebytesARW\MBAMService\instlrupdate\mbarw-setup-business-0.9.18.806.exe after I started an update from the pop-up. Note that I did not have to complete the install form here. I grabbed it and set up a package in PDQ Deploy to push it out. After the install/update, the systray icon does not reappear, so I added a net stop / net start for mb3service at the end of the package, which gets it to reappear. My PDQ package goes like this: File Copy to C:\temp Run install from command line with switches "/SP- /verysilent /suppressmsgboxes" delete the public desktop shortcut (just my personal preference) net stop mb3service net start mb3service It is working well so far.
  5. Also interested to get the .msi installer. I have downloaded he latest MBES package, but it is still the same old version. I was none too pleased to hear it from my users that there is an updated version available.
  6. Thakns again Dyllon! I've done Option 1 via my PDQ Deploy server and scanned a few times. I get a few more machines showing up each time. Is it possible to restart a service on the computers to accelerate the progress? Perhaps the TCP/IP NetBIOS Helper service?
  7. Thanks Dyllon! I tested this on a few machines, and sure enough, it shows port 137 as "open|filtered" on one that does not show in the scan, and shows as "open" on one that does. Is there a way to allow the scans through?
  8. Hello, What is the communication method/protocol that the console uses to scan for machines in an IP range? I currently have 107 clients in one subnet reporting as online, but when I scan that subnet to push some client updates, I only end up with 19 found computers. Firewalls are off, NetBIOS over TCP/IP is enabled, and File and Printer Sharing is enabled. I used to get much better results from the scans. The only thing that has changed is that we moved to new building on a mostly new LAN. We use the same subnets as before, and moved most of the switches from the old location, but we do have some new ones. Since we are getting some results, I wouldn't think that the infrastructure would be the issue. The 19 machines that do show up seem to be random, and are from all areas of the building.
  9. Awesome! This worked for me. I was not sure if I needed to, but I restarted the service after applying the exclusion. Is that needed?
  10. Hello, We are having an issue with Anti-Ransomware interfering with Admin Arsenal's PDQ Inventory scanner. When PDQ Inventory runs a periodic scan, it creates a new folder/file tree, for example, C:\Windows\AdminArsenal\PDQInventory-Scanner\service-1\PDQInventory-Scanner-1.exe. Once the scan successfully completes, the files are deleted. The MB3Service allows these folders and files to be created, but seems to keep them locked, so the files do not get deleted. Each time the scan takes place, the number designation on the exe file, and the containing folder both increment by one. After the scan takes place 16 times, the number cycles back to 1. Since the PDQInventory-Scanner-1.exe file did not get deleted, and is locked by MB3Service, PDQ cannot complete its scan. The only way that I can delete these folders & files is to kill the MB3Service. Now, I know that there is no central management capabilities currently in the beta of A-RW, but is there any way to set exclusions on several machines at one time? Can exclusions be set through command line switches during install? I am hoping so! -tim
  11. I second this request. When a new version is released, it is very time-intensive to update the clients and make sure that every last one is updated. For those of use with precious little time, it is a deterrent to making sure that the protection technology is up-to-date. I still have Managed Clients on v1.5.0.2701 because of this.
  12. Awesome! A lot of great information in there! I don't recall seeing that Auto-Upgrade option before, but I now have it enabled on all of my policies. Also great to know that I can use my deployment (PDQ) server to push the unmanaged AE client update and still have it be managed. Does that work for the AM client also? If I recall, it won't upgrade the Managed Client, correct? Any chance those console upgrade instructions will be added the Admin manual? Thanks Dyllon!
  13. I see that there is a new AE client (1.09.2.1134) available to push from the MBMC, but the MC is the same version as my current console with AE 1.08.2.1189, so when I attempt to run the MC install to get it to start pushing the new AE client, it tells me that it is the same version as the existing and will not install. I have some questions related to this: Is the proper way to get the new AE client in the console to uninstall my current 1.7.0.3208 MC and install the "new" 1.7.0.3208 MC that includes the 1.09.2.1334 AE client? Where in the documentation does it explain how to upgrade the console? I could not find it.
  14. This was my experience: I was having this same problem about a year ago. It turned out that it was trying to authenticate to a Domain Controller that had been shut down, but not yet demoted. There was no way to tell it to use another DC. It wasn't until that DC was brought back on line, demoted, and completely removed from the domain that the AD accounts could log in to the console again.
  15. Hello, How should I be getting notified that there is a newer version of the Management Console or the clients? Currently, I do not get any notifications. I do get notifications when our license period is coming to an end so that we can pay again, but that is all. I have no idea what the current versions of the console and clients are and I have no idea where to find that information. Can anyone point me in the direction of this information and where to download said updated items so I can be up to date?
  16. Okay, this seems to have worked... At the directions of support, yesterday I removed all of the domain accounts from the console admins and the domain query account on the Admin > Other Settings tab, then logged out of the console, restarted the meeserverservice, logged into the console again and re-added the domain accounts as console admins and the domain query account. It is still working this morning, so I think this problem is solved. Support let me know that they would have their team look into the issue to see if they can find the cause. Reportedly, the service should not need to be restarted.
  17. Nope, scratch that. It stopped working the next day for some reason and is again looking for the old DC when logging in with a domain admin account.
  18. Hi, Just wanted to post the solution for this for the next person that experiences it. Log in to the console with the default MBMC Admin account, remove the existing domain user accounts and then re-add them with the old DC down. They will then authenticate to a running DC.
  19. AE is blocking MS Word 2013 when trying to change the font size on one computer. I have upgraded AE to 1.07.2.1015 on the machine that is having the issue. We were having the issue on v1.05.2.1017 and I saw in the forum that there was an issue that was corrected with Word add-ins, so I upgraded, but I am still having this issue. Word is version 15.0.4719.1002. Windows 7 Pro x86
  20. Just wanted to throw this into the mix... We are also getting FPs on the ntdll.dll file, but not in C:\Windows\System32. Ours, in every case so far (71 clients out of 150), has been detected in these two locations: C:\Windows\winsxs\x86_microsoft-windows-ntdll_31bf3856ad364e35_6.1.7601.17514_none_5ade482d5a6fc521\ C:\Windows\winsxs\x86_microsoft-windows-ntdll_31bf3856ad364e35_6.1.7601.17725_none_5ad47c575a76f4b7\ No BSODs so far. I have pulled down the DB update and pushed it out, so I am hoping we will be good.
  21. Will Malwarebytes be registered with Microsoft to satisfy the Windows 7 Action Center's checks for Virus and Spyware protection? It is causing Outlook to think there is no protection, and thus, users are getting popups when some systems go to send emails on their behalf.
  22. Hi all, Is there a way to download an update file so that I can manually update a client's signature database that I have removed from our network? We are currently rolling out MBES and an infected machine did not get the client yet, so I have to do an offline install. I know I can probably search around for this, but I am cleaning up from Cryptowall 3.0 right now and have limited time to figure this out and much to do. Thanks!
  23. Ah, I see. That makes complete sense to me. Thanks for your quick reply!
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.