Ericcire

Hi. I am almost certain this is a false positive unless they have been hacked. Thanks. Eric

A fresh download worked OK. Maybe the Notepadd++ people figured something was wrong and fixed it already. Case closed. Thanks. Eric

The Notepad++ installer npp.8.4.Installer.x64.exe is being blocked. Malwarebytes Nebula reports communication over ip 91.243.59.6 during install and blocks it? The software manufacturer is legit: https://notepad-plus-plus.org/ Thanks. Eric

Thanks for the link, I submitted a ticket. I created a new policy for some specific users to avoid aggravation where I disabled the "Office WMI Abuse Prevention" in the MWB settings, it works... while we wait for a resolution of the issue. Eric

Just like the other reports in this forum if you search for "WMI"... we are getting that same block on several computers when opening MS Office files from File Explorer. We are running Malwarebytes Nebula. This started happening upon installing the latest version, it did not happen before, here's our MWB version: Asset Manager: 1.2.0.336 Endpoint Protection: 1.2.0.889 Endpoint Protection Protection Update: 1.0.44996 Protection service version: 4.4.5.130 Component package version: 1.0.1430 And here's the block popup message: And here's the log entry: Malware.Exploit.Agent.Generic Blocked Exploit Exploit ComSpec=C:\WINDOWS\system32\cmd.exe I know you recommend disabling the "Office WMI Abuse Prevention" in the MWB settings which is I guess a temporary work-around so we are not inundated with user calls, but we are waiting for a better resolution please. Thank you. Eric

Well, I guess let's keep it blocked. Thank you. Eric

This one comes up blocked often in our reports. It probably is a false positive but is it? Thank you. Eric

I am pretty sure abyznewslinks.com is a false positive, please assess and allow. Thank you for your work! Eric

I am pretty sure irpp.org and policyoptions.irpp.org are false positives even if Malwarebytes blocks them with "Website blocked due to a Trojan". Please advise and unblock! Thank you. Eric