spatenchb

Thanks. Immediately after I posted this, there was an update. When I scanned again, it was not detected, so it must have been fixed.

I believe this is a false positive. Pdf Exchange pdf reader. pdfxve9.zip

Also seeing this in SurfShark VPN. Trojan.CobaltStrike on tunnel.dllMalwarebytes.txt

I appreciate you suggestions, but Webroot will only allow you to enter one file at a time and I do not have the directory C:\Windows\Sysnative.

Sorry. Webroot will not allow you to exclude drivers (.sys) files.

Yes @cassiopeia. I have excluded all of the Malwarebytes executable files within Webroot and it continues to block the Malwarebytes update process. When I close Webroot it updates fine. I noticed that Webroot has not had an update since 10/3/17, and the combination of Malwarebytes/Webroot worked fine prior to my Windows Fall Creators update a week ago. Not sure what other Malwarebytes files I need to exclude. I have see several other issues, concerning Malwarebytes updates (post Fall Creators), reported in the Forum.

Yes. I can confirm that Webroot seems to be part of the issue. It was not a problem prior to The Fall Creators update. I excluded all of the Malwarebytes .exe files from Webroot, but it did not help. A reboot solves the issue until the next shutdown. On first boot it happens again.

I am running the latest version 3.2.2.2018, component 1.0.212. After updating Windows 10 to the Fall Creators version, Malwarebytes reports that the signatures are out of date. Manually clicking for the updated signatures does nothing. This occurs each day on the first boot. After a reboot, the "out of date" warning is gone and everything works normally.

Any progress on this issue? Thanks

I just checked this problem again using the latest version 3.1.2.1733, Package 1.0.139, Update 1.0.2060. Still not fixed. Do I need to revert back to 3.0.6.1469-1096? Thanks.

Tested this issue again today. The problem still exists. Version 3.1.2.1733, Package 1.0.122, Update 1.0.1993 Thanks

Ok. I will check it out periodically. Thanks for the quick response.

This behavior must be related to a change in the last versions Ransomware Module. Have not seen this issue in any other version 2 or 3. I looked at the logs, but I did not see any references. SafeHouse creates an encrypted Volume on a local or external drive - similar to Boxcryptor or Truecrypt. When I attempt to open the Safehouse executable (DocumentsVolume.exe) from a USB flash drive - it does not open. I do not get any error dialog - the process simply halts. When I disable the Ransomware Protection module in MB it opens with no issues - no reboot is required. I also tried listing the path and executable as an exclusion, but that did not help. Thanks, mb-check-results.zip

After installing the latest Version mb3-setup-consumer-3.1.2.1733 Premium, I have noticed an issue with Safehouse. http://www.safehousesoftware.com/SafeHouseExplorer.aspx SafeHouse creates an encrypted Volume on a local or external drive - similar to Boxcryptor or Truecrypt. With the latest MB version when I attempt to open the Safehouse executable (DocumentsVolume.exe) from a USB flash drive - it does not open. I do not get any error dialog - the process simply halts. When I disable the Ransomware Protection module in MB it opens with no issue. In addition, it also worked fine in version mb3-setup-consumer-3.0.6.1469-1096, with Ransomware Protection turned on, prior to my update. I also tried listing the path and executable as an exclusion, but that did not help.

Having looked into this behavior more closely, I can now see that it is the Ransomware Protection module that is causing the problem. If I disable the protection, I can open the file and volume with no issues.

I have been doing some further checking and I have found that this is not a generic issue with all .exe files on the USB flash drive. The file that I am having an issue with opens an encrypted Volume on the USB drive. The software http://www.safehousesoftware.com/Default.aspx is similar to truecrypt. It creates an encrypted password protected Volume on the flash drive. The .exe file, in question, simply opens the password dialog. I have not had any issues until version 3.1.2.1733. Previous versions of 3 seem to work fine. I have tried Excluding the file within the Settings, but that does not work either. If I manually stop the MBAMService.exe Service, then it opens and works fine. The file itself is large (3 GB) , since it is a Volume. I also ran a full manual scan on main OS and the USB drive to see if Mbam was seeing the file as malware. Everything is clean.

The latest version mb3-setup-consumer-3.1.2.1733 is blocking my attempts to run a .exe file from a USB flash drive. I do not get any popup or error when this happens. The executable just refuses to open. If I turn off Malwarebytes (uncheck start on reboot) I can run the file with no problem. In addition, it works fine with my previous version mb3-setup-consumer-3.0.6.1469-1096.

The problem is when you go to ambientweather.com the site is blocked showing the IP 68.180.151.74. This IP has several thousand sites pointing to it, however, ambientweather.com is a business site and its IP is 68.142.205.137 see below. I don't know why ambientweather.com is being resolved to the blocked IP. http://hosts-file.net/default.asp?s=www.ambientweather.com

This may be coming from an ad. The IP seems to be a Yahoo domain. The block pops up when I go to ambientweather.com