False Positive - Ultracopier and more

[simone_emulab]

I'm using beta4.

 

Ultracopier was reported as false positive.

 

Also i've experienced system crash, in my 32 GB Ram PC playing some videos on kodi the MBAM service grow up and saturate all memory.

 

ultracopier.zip

Malwarebytes Anti-Ransomware.zip

logs.zip

[1PW]

Hello simone_emulab and

Thank you kindly for the zipped files thus far.

If the system in question may be configured to permit the creation of [a] corresponding BSOD (system crash) .dmp file(s) please continue:

• Hold down the Windows Key + type R. A Run window should appear.
• Copy and Paste, or type, the following to the Run Window's: Open: box (Please include the quotes). "%SystemRoot%\Minidump\"
• A Windows' Explorer window containing .dmp file(s) should appear. Please select the/all relevant file(s) in this directory. If a Location is not available window appeared, single-left-click OK and go to Permit dump files:. Else continue.
• With all relevant files selected, single-right-click the selected file(s) and make the screen's pointer hover over Send To then single-left-click Compressed (zipped) folder.
• This should have produced a new zip file. Rename this file BSOD.zip
• At this point Attach the just created BSOD.zip file to this topic through the forum's reply window's More Reply Options button.

Permit dump files: If the system's Minidump directory or the .dmp files were absent, please consider following the computer's OS procedures for permitting their creation in future similar troubleshooting scenarios.

Thank you for participating in the MBARW Beta4 testing and your feedback.

[simone_emulab]

There are not BSOD, the system was unresponsive becouse of MBAM grow up ram usage and i'm forced to hard reset my pc.

 

BTW, after more investigation i think its not a MBAR or KODI issue but the culprit may be a third party launcher that run kodi by a IR remote.

 

I let you know if i there are some result after furter investigation.

 

Sorry for the bad report, anyway i confirm the ultracopier false positive.

 

[simone_emulab]

This is the code that launch KODI :

                proc.StartInfo = new ProcessStartInfo(path, args);                proc.Start();                while (!proc.HasExited)                {                }                proc.Close();

I've modified it like that:

                proc.StartInfo = new ProcessStartInfo(path, args);                proc.Start();                while (!proc.HasExited)                {                    proc.Refresh();                    Thread.Sleep(100);                }                proc.Close();

and apparently the problem is solved.

 

I've reported it there so you possibly can prevent similar behavior by bad coded apps

[1PW]

Hello simone_emulab:

 

It is good to know you have found a solution for the above issue.

 

Thank you again for beta testing MBARW and your feedback.