False Positive

[Sheakley]

Good day

 This is a copy of what the Beta caught.. The program we use is called Autosoft. Automotive DMS Software.

The system it is running on is 2008R2.

I installed it last month after a bout with DMA Locker 3.0

Oddly enough it has been ticking along flawlessly and without a report(Thankfully) until yesterday.

This is what I see (uploaded JPEG) These are the static files on the server that control the uploading of the GM files from AutoSoft.

One being as shown, a registry entry. I was hesitant to make an exception out of the two because they have been there and no threats detected.

Unfortunately when they quarantined the two entries shown, the uploads stopped going up to GM, upsetting the Parts Manager..lol

So they reinstalled the software that had the broken links and I had the BETA shut off so it doesn't grab the file and registry entry and disable the program again.

I do not like to have it in the OFF position but at this point I have no choice.

MY QUESTION... is this a false positive issue possibly and can I make an exception out of a registry entry and if so How? I had no trouble adding the file location, but am unable to

do so with the registry entry.

Any thoughts would be appreciated!

Thank you for great software BTW!

 

John

 

[1PW]

Hello Sheakley and

The MBARW developers have not approved the use of MBARW on any Microsoft Windows Server.

Additionally due to the fact that the MBARW project is in the earliest phases of Beta, the use of MBARW in any commercial/enterprise/production environment is strongly discouraged at this time.

If you would like assistance in achieving a successful uninstall of MBARW Beta, please advise in a reply to this topic.

Thank you for your interest in MBARW and your continued patience and understanding.

[Sheakley]

Good morning and thank you for the follow up!

 I understand what you are conveying and I have other security measures in place as well.

As a BETA question then: is there a way to enter a registry entry as an exception 

 

Thank you once again     :  )

 

Edited May 23, 2016 by Sheakley

[tetonbob]

Hi Sheakley. There is not a way to add a registry item to Exclusions, only files. That being said, if the file has been added to exclusions, the Service associated with the file should no longer be detected either.

Can you provide the MBAMService.log from C:\ProgramData\Malwarebytes\MBAMService\logs ?

[Sheakley]

That's what i was wondering..

 

Here is the log from the inception of the Beta back in April.

Thank you for your time with this!

 

MBAMSERVICE.LOG

[tetonbob]

Thank you. Would it be possible for you to zip and attach a copy of the AutosoftIntegrationService.exe file?

When I look in the service log at the exclusions added it seems there has not been one added for AutosoftIntegrationService.exe but rather an exclusion was added for AutosoftIntegrationService.exe.config

Can you check again within the program to make sure the correct file was added to exclusions?

 

[Sheakley]

Ahhhhhh !! You are correct !  I have added the correct file application (.exe)

I have not reactivated the program as of yet.  Do you still need the  AutosoftIntegrationService.exe ?