![](http://content.invisioncic.com/Mmalware/set_resources_28/84c1e40ea0e759e3f1505eb1788ddf3c_pattern.png)
Decrypterfixer
-
Posts
337 -
Joined
-
Last visited
Content Type
Events
Profiles
Forums
Posts posted by Decrypterfixer
-
-
We have found the cause, and a fix will be included in or next update for all Windows 8-10 apps.
-
GeekFreak,
I have went through all your logs and have determined the cause of your issue.
The good news is, nothing is actually wrong with your system, and nothing was actually removed!
What happened was that both of the applications that triggered a event with MBARW were actually updater applications, that there normal routine is to simply run in the background, quickly update files, and then remove itself.
So what happened is MBARW detected activity that seemed like ransomware, and then before MBARW could preform additional checks and Whitelisting, the updater application removed itself (like it is suppose to, as it is only a temporary updater application). This caused MBARW to simply take the detection before into account, and attempted to kill it and quarantine it, and notify the user.
So actually in the end, nothing was killed or removed by MBARW and everything is functioning as it should.
Thank you very much for using our BETA and also reporting this issue to our thread, because now we will be able to create a fix for this and detect when a application removes itself in the way your apps did
. Users like yourself is what is making MBARW even greater!
-
I Agree, this topic will be closed for now. If there is a reason or more information in the future as a reason to update, i will do so then.
Thanks to all participants of the thread!
-
Hello,
Thanks for helping us with MBARW!
Could you please follow these steps to upload the needed logs for us to view?
Thanks!
-
Has a complete reboot of the machine been preformed since the quarantine of these files? Sometimes with Windows 10 or 8 they have a option to sleep instead, and it may be a good idea to simply use the start menu to reboot to see if these files are either back in place, or in a new quarantine folder. Thanks!
-
I apologize for the time it took to reply to this topic. I have been following it since the beginning and simply did not want to reply with information until more research and collaborating with our development dept. for mbarw was done.
First I would like to address that MBARW does Not initiate "Hooks all over the systems processes". There has been other security applications that Process Laso seems to have had conflicts with in the past (based on research) that performs these operations, but this should not be relevant here as the same unsupported methods do not happen within MBARW.
After reviewing the logs on this thread and communicating with development, we will be looking into the conflict discussed here. The good news is that MBARW and Process Lasso look to be compatible and run smooth in nearly all tested cases. When the 2 applications are installed on Virtual Machines and regular machines of Windows 7 and higher (x86 and x64) with modern hardware, the situation discussed in this thread does not trigger. We do start to see signs of the discussed events when we start using (or allocating) older hardware in CPUs and RAM. For example, on a Virtual Machine with only a single virtualized core of 2.40ghz, the 2 applications run fine with MBARW monitoring and CPU sitting at 3% minimum and maximum 20% spikes at large File IO operations.
With the reporting user having a Toshiba Laptop with a 2.2 GHz Celeron 900 CPU (from 2009) and 2 gigs of ram, this seem to be more on the side of lack of resources than an actual defect with either application. The PC is running at the very low minimum requirements for Windows 10 also. These tests also did not (and could not) get tested with the basic applications, settings, and environment any user could also be running on their machine at this time also.
But even with the analysis above, we will still be making contact with Process Laso's creator to dive into some more technical research to see what can be done in this current situation to make the user experience more pleasurable for both the user and other softwares in general.
In the end user satisfaction is our too priority. I want to thank Homer712 for bringing this to our attention and helping us with our beta! We also appreciate the response of Process Lassos creator for support.
All users here have helped MBARWs BETA tremendously, and for that we thank you!
-
Thanks for your feedback
we will look into this ASAP
-
Thanks for the feedback
we will be looking into this FP
-
Uninstalling and reinstalling should fix your issue
-
We are also aware and working on this issue. Thanks for your feedback
-
This is because the file was not really quarantined, could you please verify the exe is in its proper location in the Eset Programfiles folder?
-
Thanks for the feedback
Please bare with us with the current features, as the UI of the application is very Bare Bones for the BETA. The application will be much different in the future.
-
John,
Thanks for this detailed post about this defect. This will help us tremendously.
We are currently working on this issue, and need to go about Windows 10 Apps in a different approach than normal apps.
We will absolutely keep the community updated on this.
-
Currently we have no defined time to come out of BETA for MBARW. Please keep checking these forums for updates
-
ARIMO,
I have taken a look into your logs and see a few issues. Our team is currently on the case and will have it resolved soon
-
David,
To clarify, You are running CCleaner, and everytime a block occurs with nothing in the Quar. window? Even with an exclusion to CC?
-
This is a currently known defect, and we are working hard to resolve it as quickly as possible. Thanks for the feedback!
-
If you reboot the machine, close the application on start up, and run it again, does the problem still occur?
-
Hello Davicius,
We are looking into this issue and will be adding the EXE to whitelist and trying to make sure this doesn't happen again.
Please go into the windows store and try to redownload/repair the application by searching for it.
If this doesn't work, you can also use the Windows 10 App Trouble Shooter to help:
http://windows.microsoft.com/en-us/windows-10/run-the-troubleshooter-for-windows-apps
Once working correctly, please attempt to add it to your exclusions just in case.
-
Yaeo,
Sadly we cannot add a "decrypting" function for after getting attacked by Ransomware, because there are so many types and different encryptions. Also most cannot be decrypted anyways, as they use secure encryption methods. But, it may be possible in the future that we can release stand alone decrypters for some Ransomware if possible.
The good news if, if you are running MBARW, you should never get encrypted anyways
-
Wech,
Thanks for the Feedback, and we are currently looking into the bug of detecting excluded EXEs.
Thanks!
-
memeweaver,
MBARW actually doesn't delete anything on reboot, it simply moves it to the quarantine folder. So after reboot please restore the file, zip the file up, and add it to the exclusions for now so you may work as normal.
Then, if you would be so kind as to follow 1PW's instructions above and upload the logs along with the exe file.
thanks
-
Thanks for the feedback AreV, and thanks for being a part of the Malwarebytes Family
-
Hello,
We are currently looking into this issue. Thanks for the feedback and logs! they will greatly help.
Any Reports of High CPU with Process Lasso Pro
in Anti-Ransomware Beta
Posted
Excellent news bitsum! We are glad you were able to pin point the causing issue between our products, and will look forward to relying in the future that Process Laso is compatible with Malwarebytes Products. Of course it would be greatly appreciated if any Process Laso users here report any new problems that may arrise in the future so we may look into them the same way.
Should you need any more assistance BitSum or information, please don't hesitate to reach out again!