Broken.Open Command CryptoPrevent

[john_in_naples]

I just started receiving the errors below.  Crypto Prevent has been on this workstation for weeks.  Any ideas as to what is going on?

 

 

Broken.OpenCommand, HKRC\piffile\shell\open\command, C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventFilterMod.exe

 

Broken.OpenCommand, HKRC\scrfile\shell\open\command

 

 

mb.txt

[Firefox]

Hello and Welcome to Malwarebytes

Being that you are probably infected, feel free to follow the instructions below to receive free, one-on-one expert assistance in checking your system and clearing out any infections and correcting any damage done by the malware.

Please see the following pinned topic which has information on how to get help with this: Available Assistance for Possibly Infected Computers

Thank you

[daledoc1]

Hi,

 

If this is the only detection you're seeing on your scan, then you might want to check this recent reply to a similar report by our Research Director >>here<<:

 

 

Please add this to your whitelist in Malwarebytes. By default, the .scr and .pif files should have “%1” %* as valuedata for the command.

 

On the other hand, if you have any reason to believe that you might be infected, then by all means, please do follow @Firefox's expert advice to have a malware expert assist you with checking your system.

 

Thanks,

[Firefox]

Thanks daledoc1, for the backup...

[theMezz]

I just started receiving the errors below.  Crypto Prevent has been on this workstation for weeks.  Any ideas as to what is going on?

 

 

Broken.OpenCommand, HKRC\piffile\shell\open\command, C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventFilterMod.exe

 

Broken.OpenCommand, HKRC\scrfile\shell\open\command

 

 

Exact same situation as  john_in_naples...

I wonder if this is a false positive?

 

Registry Data: 2

Broken.OpenCommand, HKCR\piffile\shell\open\command, "C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventFilterMod.exe" *"Good: ("Bad: ("C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventFilterMod.exe" *"%1" %*),Replaced,[ffffffffffffffffffffffffffffffff]" %*)" %*, %4, %5

Broken.OpenCommand, HKCR\scrfile\shell\open\command, "C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventFilterMod.exe" "Good: ("Bad: ("C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventFilterMod.exe" "%1" %*),Replaced,[ffffffffffffffffffffffffffffffff]" /S)" %*, %4, %5

[daledoc1]

Hi, @theMezz:
 

Exact same situation as john_in_naples...
I wonder if this is a false positive?

See below:
 

Hi,
 
If this is the only detection you're seeing on your scan, then you might want to check this recent reply to a similar report by our Research Director >>here<<:
 
Please add this to your whitelist in Malwarebytes. By default, the .scr and .pif files should have “%1” %* as valuedata for the command.
 

 
On the other hand, if you have any reason to believe that you might be infected, then by all means, please do follow @Firefox's expert advice to have a malware expert assist you with checking your system.

To do so, please follow the advice here: Available Assistance for Possibly Infected Computers
 
Thanks,

 
 

[Deneb]

CryptoPrevent has just been updated to version 6, which has a real-time filter thatprevents execution of CPL, SCR and PIF files by default (configurable in settings). If you have the premium version you will have automatically updated. MalwareBytes sees the registry changes made by CryptoPrevent  as an indication of possible malware alterations to the registry. The simplest solution is to choose to exclude the detections in MBAM.

 

See the Technical Information and Forum menus in CryptoPrevent for more information.

[Deneb]

There is now an article on these detections on the Cryptoprevent author's website:

 

http://www.foolishit.com/vb6-projects/cryptoprevent/anti-virus-anti-malware-application-warning/

[AdvancedSetup]

This is built-in to MBAM and cannot be fixed. If you want to continue to use the Cryptoprevent "open command" then you will have to whitelist this in MBAM to exclude it from detection.

[TableLamp]

I have the same problem. How do I whitelist CryptoPrevent in MBAM?

Thanks

[Unicore]

You can whitelist the problem by going to MBAM, Settings, Malware Exclusions, then click on "Add File".  Find CryptoPrevent in your program files and drill down to "CryptoPreventFilterMod.exe".  Add that file to your MBAM exclusions.

[Unicore]

You also want to go to MBAM, History and restore those registry items from CryptoPrevent that were put into quarantine by MBAM.

[Unicore]

Forget my two previous posts.  It doesn't work to whitelist CryptoPrevent at the folder or file level.  CrytoPrevent makes changes to the registry that must be whitelisted in MBAM.

[Deneb]

All you need to do is to add the two registry detections for piffile and scrfile to Malware Exclusions. From memory, I think a right click on the quarantine entries allows this - it's been a few days since I did it now so I can't recall exactly.

[Unicore]

Thanks for the insight Deneb.  I tried to right click on the quarantine entries, but that did not work for me.  I'm going to have to hold my breath and take a deep dive into the registry to see if I can find the proper path to the piffile and scrfile objects so I can include them in Malware Exclusions.  Wish me luck! 

[Deneb]

Hi Unicore, in the interests of getting the right information I deleted the two registry entries from my exclusions list and ran another scan. Its the drop-down action menu in the scan result screen of the MBAM main interface that you need. Click on the drop down menu for each entry - it gives three options: Quarantine, Add Exclusion or Ignore Once.

 

Hope that helps. Good luck!

[Unicore]

Great minds think alike!  While I was gone, I added back the quarantined entries and ran a hyper-scan.  The errant files are again detected in the drop-down action menu as you described.  I selected ADD EXCLUSION for each of the files and then APPLY ACTION...and ran another scan.  Problem solved! 

 

It's kind of tricky when MBAM bounces between two menus that seem to do the same thing.  In reality, the only way that registry entries can be whitelisted is to follow the procedure you outlined.  I'm glad I didn't have to dig down into the registry!

 

Thanks for your help!  I think it's really great when users such as you and I can help each other to solve such problems. 

[Deneb]

Glad you managed to resolve it.