Anti-Ransomware Interfering with PDQ Inventory Scans

[tdhaslett]

Hello,

We are having an issue with Anti-Ransomware interfering with Admin Arsenal's PDQ Inventory scanner.

When PDQ Inventory runs a periodic scan, it creates a new folder/file tree, for example, C:\Windows\AdminArsenal\PDQInventory-Scanner\service-1\PDQInventory-Scanner-1.exe. Once the scan successfully completes, the files are deleted. The MB3Service allows these folders and files to be created, but seems to keep them locked, so the files do not get deleted. Each time the scan takes place, the number designation on the exe file, and the containing folder both increment by one. After the scan takes place 16 times, the number cycles back to 1. Since the PDQInventory-Scanner-1.exe file did not get deleted, and is locked by MB3Service, PDQ cannot complete its scan. The only way that I can delete these folders & files is to kill the MB3Service.

Now, I know that there is no central management capabilities currently in the beta of A-RW, but is there any way to set exclusions on several machines at one time? Can exclusions be set through command line switches during install? I am hoping so!

-tim

[djacobson]

Hi @tdhaslett, yes, MBARW can have exclusions configured via CMD.

API location - C:\Program Files\Malwarebytes\Anti-Ransomware\assistant.exe

assistant ––exclusions add c:\safe_executable.exe
assistant ––x add “c:\work files\safe_executable.exe”
assistant ––exclusions delete-all

Anti-Ransomware 0.9 Administrator Guide.pdf

[tdhaslett]

Awesome! This worked for me.

I was not sure if I needed to, but I restarted the service after applying the exclusion. Is that needed?

[djacobson]

Hey @tdhaslett, the exclusion will be live right away after setting it. No need to reboot.