PinkDev1

Nice work! That was quick. No joke. I've been using MB for years and never came across this issue. I have a hunch my recently added program.exe had something to do with this 😆

Ignore this statement. I remembered that wrong

Here's the full timeline, for more clarity: I'm editing a video on SONY VEGAS PRO 17.0 when suddenly.. Windows Defender flags a ton of files I run a MalwareBytes scan, and it detects the files too I verify that both scans are indeed false positives by uploading many files to VirusTotal I restart my pc without telling Windows Defender to "quarantine" the entries MB doesn't start I run mb-check-3.1.10.1000.exe, mb-clean-3.1.0.1035.exe, and FRST64.exe I realize that Windows Defender has quarantined those files without telling me I tell Windows Defender to restore the files (Wait 5 mins) MB shows up on the tray area of the taskbar Restart PC MB is working as normal I could just say it was a crazy bit flip, but the fact that they both went crazy at the same time is unbelievable. Before the mayhem started though, Windows Defender created an event log for an interaction between VEGAS PRO and my Program.exe. I shouldn't have cleared my program's access-log.txt before posting the source code here 🤦‍♂️. My copy of VEGAS PRO isn't "original". There's a possibility that a long time fuse finally went off; I installed VEGAS on 2019-09-23, but I've rarely used it since. OR this could all just be a big coindidence caused by a bunch of bitflips. Either way, all the symptoms are gone: Scanning with WD and MB reports only the ussual stuff, and running VEGAS PRO shows something completely different than what it showed before on my access-log.txt. The only signs that all of this ever happened are the scan I exported from malwarebytes, and the Windows Defender "Protection History" GUI: On the GUI there are a LOT of detections, far more than the 52 that MB reported, all in a single item: "Trojan:Win32/Bearfoos.A!ml". But only a small fraction of these detections were registered in the event logs. I've also analyzed some of these detections on VirusTotal, and none of them were detected as malware. Every scan I've made since this incident has detected nothing out of the ordinary, so I'll continue to use my PC as normal. I'd still like to leave a record of this, just in case it happens to someone else 😅

That first post used to be a reply to this thread btw. That's why it starts like that. C:\Program.exe That's a little program I engineered to detect if another program called a path under "C:\Program Files" without using quotes. It helps me to detect which programs are vulnerable to privilege escalation. I've attached the .exe and the source code in a ZIP with the password "infected". I've verified that program.exe wasn't replaced by a rogue process; It's the same program I initially compiled. I don't think my program should be whitelisted though. Any exe under that path should be flagged. Also, I can't replicate that massive false positive now. All I did since then was restart my PC, and update the "Update Package Version" from v1.0.54556 to v1.0.54606. I have no clue of what could've caused so many false positives in that scan, both in Windows Defender and in MalwareBytes, but the issue is gone now. Before I restarted my pc though, I ran mb-check-3.1.10.1000.exe, mb-clean-3.1.0.1035.exe, and FRST64.exe, because a comment that was there before suggested it. I can PM you the logs if you'd like to go through them. Improper Quotes Monitor.zip

I'd just like to mention that I also had this issue, but for me, the cause was that Windows Defender had mistakenly flagged a ton of things (about 52 detections) as Trojans ("Trojan:Win32/Bearfoos.A!ml"), and it had automatically removed them in a single run. I had to go and restore the massive false positive from the Windows Security dashboard, then wait a couple of minutes until it finished the restoration process, and restart my PC. Afterwards, MB started working again. Before I restored the files, I decided to run a scan with MalwareBytes, just in case it wasn't a big false positive, but MB it also detected them as malware ("Trojan.Agent"). Weird thing is, when I uploaded each file to VirusTotal, none of them were flagged by any antivirus. Also, when I scanned the files individually from the file explorer with right-click -> Scan with MalwareBytes, none of them were flagged by MB. These false positives include a program I've coded and compiled myself, which I'm certain isn't malware. I've attached the massive false positive scan from MB. mal-report_redacted.txt

This doesn't really make sense. The color of the MalwareBytes icon has been modified on the very badge the Staff uses here. It is clearly still recognizable. An option to use a black or white icon Settings > Appearence would be great. Right now it's fairly annoying to have such a distinctly colored icon the taskbar: