SmartSwitch Software Triggers Ransomware Warnings

[garioch7]

I have installed a paid version of Malwarebytes for Android Premium (MAP).  I have a Samsung SM-G386W smartphone.  I use Samsung Smart Switch software (latest version) to back up the contents of the phone.  As soon as Smart Switch starts to back up the individual 35 apps installed on the phone, I get warning messages from MAP, showing "Malwarebytes Ransomware" in the top of the screen.  The phone buzzes and jingles with each application backed up.  From what I can tell, the apps are backed up properly.  There are no warnings about the data on the phone being backed up.

All that should be happening is that the app files are being read and then copied to my desktop computer.  It would be great if MAP did not make such a fuss about a simple backup.

I have checked the "Settings", but I see no way to tell MAP that Smart Switch is a legitimate application on my PC and that there is, therefore, no need for MAP to get excited. 

Any ideas?

Thank you and have a great day.

Regards,
-Phil

[garioch7]

Malwarebytes Staff:

I have not had a reply to my post of a week ago.  Are there any logs that you need; or, further information that I can provide that would assist you to identify and remediate this nuisance behavior?

Thank you and have a great day.

Regards,
-Phil

[AdvancedSetup]

Hi @garioch7

 

The Development Team is looking into reproducing this issue. Hopefully, they should be able to reproduce and find a fix. Thank you for reporting and assisting us in correcting.

Can you please go to settings and under protection uncheck the ARP. Let us know if that stops the notifications

Thanks

 

Edited September 8, 2017 by AdvancedSetup

[garioch7]

@AdvancedSetup

I did as you requested and turned off the Anti-Ransomware Protection, and then launched Smart Switch to do a backup of the phone.  Same as before.  Notifications during the "applications" phase only of the backup process.  MBM was repeatedly and cyclically reporting the following across the top of my phone, and phone was vibrating to notify me: "Anti-Ransomware Protection", the name of the backup folder being created by Smart Switch, and that it was scanning my sdcard (no apps on the micro sd card): "path= \mnt\sdcard".

I purchased the micro SD card when I purchased the phone back a year ago, and the old Malwarebytes for Mobile never complained during my weekly backups of the cell phone, using Smart Switch.  There have been no recent updates to the Smart Switch software either, so I am convinced it is a Malwarebytes issue.  I am running Windows 10 Pro x64, Build 1703 on the target computer backup location.  There are no warnings or issues with the computer, just the Samsung phone.

Thank you, Ron, and I look forward to assisting to find a solution to this nuisance issue.  Have a great weekend.

Regards,
-Phil

[AdvancedSetup]

Thanks for trying Phil. I'll let the Development Team know.

Ron

 

[garioch7]

@AdvancedSetup

I appreciate your assistance very much.  It is odd that MBM is examining my micro SD card in the cell phone when Smart Switch is doing the applications phase of the backup.  There are NO apps on the SD card; just a few contacts photos.

I am probably one of the few out there who regularly backup my smart phone, so perhaps that is why this issue has not been reported before.

If I can do anything at all to assist the Development Team, please ask that they contact me.  I will be watching this topic.  No real rush on this; just a nuisance.

Have a great weekend.

Regards,
-Phil

[Vabadus]

@garioch7 we are on it Just one thing, if you are willing to do of course, it'd be really helpful, if you can provide some screenshot or a very small video about this, especially for the moment that you see this notification.

Thank you very much Phil, much appreciated.

[garioch7]

@Vabadus

Thank you for your reply and welcome to the MAP Forum.   I took an HD video of less than a minute (104 MB) and I tried to upload that to my PhotoBucket account, but that eventually just got lost (the upload said it had completed prematurely but the file was not there), presumably due to the slow Internet speeds here in rural Cape Breton, so I uploaded the video to my Sendspace account instead.  It was not feasible to film the entire duration of the application backup phase by Smart Switch, due to file size and the slow Internet speed.  I also saw some other messages, one naming the app being backed up, and at the end, there is some message about installing or uninstalling on the notification bar.  Once the Smart Switch backup completes, the notification bar on the smart phone reverts back to normal.  The notifications only appear once the applications start being backed up, which is about 50% of the way into the backup. There are only 35 apps on my smartphone.

It should be noted that I do have Bitdefender Mobile Security also installed on my smart phone.  Perhaps there is some conflict there.  There are no messages however from Bitdefender.

I will be interested in your findings.  If I can assist in any other way, please let me know.  Have a great day.

Regards,
-Phil

[Vabadus]

@garioch7thanks for your help, much appreciated. we'll look into more details.

[garioch7]

@Vabadus

Have you made any progress in identifying what is causing this issue?

Thank you and have a great day.

Regards,
-Phil

[Vabadus]

@garioch7 yes we kinda did. we improved the logic and will include it in the next release. when you receive an update, please let us know, if the issue still exists.

[garioch7]

@Vabadus

Thank you for your very prompt reply!

What is the build number of the new release?  Normally, I do weekly scans of the smart phone on Fridays.  I will let you know how it goes.  The phone should have updated by then, but I just want to make sure it does have the new build, in case the issue should persist.

Thank you and have a great day.

Regards,
-Phil

[Vabadus]

Phil, it'll be 3.1.0

thank you very much.

[garioch7]

@Vabadus

Thank you for the build number.  I only use the smart phone when travelling or to scan and back it up, so it is not turned on a lot.  I will ensure that I give the phone ample opportunity to update.

I will let you know on Friday if the problem is resolved.  Thank you and have a great day.

Regards,
-Phil

[Vabadus]

Thanks Phil.

Btw, release will come in 2 weeks. But if you are in our beta community, you can get it few days earlier

[garioch7]

@Vabadus

Thank you for the information that the new build is still two weeks away.  I would have been wondering why my smart phone did not update on Friday coming.

I am not a member of any beta communities.

I will respond back when my smart phone updates and has the specified build installed.

Thank you and have a great day.

Regards,
-Phil

[garioch7]

@Vabadus

I backed up my cellphone today, using SmartSwitch, but this Friday, all of the Ransomware warnings were missing in action during the application phase of the backup.

I checked my Android version number and it was 3.0.1.4.  I don't know when Malwarebytes for Android updated, but this version doesn't have the issue.

So you can close this as resolved.

Thank you and have a great day.

Regards,
-Phil

[Vabadus]

Thanks @garioch7

[garioch7]

@Vabadus

I guess that I spoke too soon.  I just backed up my Samsung SM-G386W, using SmartSwitch, on both of my computers, and the ransomware warnings when backing up to both Windows 10 x64 Pro computers!  The phone is acting as it did when I reported this issue.

The cell phone shows Malwarebytes for Android, Version 3.0.1.4.; Malware database version: 2017-10-11.01; and Phishing database version: 2017-10-12.01.

Hopefully the next version update will fix this issue.

Thank you and have a great day.

Regards,
-Phil

[Vabadus]

@garioch7 would you mind trying the version that'll come at the end of this week. It'll be version 3.1

I hope then it'll be fixed, thanks for keeping us updated.

[garioch7]

@Vabadus

Thank you for your response.  Friday is my backup day, so hopefully my phone will have updated to the new version by the end of the week.  If not, I will wait until it does and report back.

Have a great day.

Regards,
-Phil

[garioch7]

@Vabadus

My cell phone updated Malwarebytes for Android this morning to Version 3.1.0.11.  The issue remains.  If anything, MBA is even ringing more chimes and buzzing more when backing up my applications.  MBA is not reacting when email, contacts, etc., are being backed up.  The anti-ransmware module only goes berserk when the applications are being backed up.

Have a great weekend.

Regards,
-Phil

[Vabadus]

Thanks @garioch7 and sorry to hear that

We'll have a look once again.

[Vabadus]

Phil, would you mind sharing once again the followings

- Your device model and Android version

- Your windows version

- SmartSwitch software version

[garioch7]

@Vabadus

My device is a Samsung G386W, about two years old.  The Android version number is: 4.4.2

The anti-ransomware module reacts when the apps on the phone only are being backed up.  There are no warnings when memos, contacts, etc., are being backed up.  One computer (Dell XPS 1645 laptop) is running Windows 10 Pro x64, Build 1709.  The other computer (Maingear Shift) is running Windows 10 Pro x64, Build 1703.

The SmartSwitch software is the latest version: 4.1.17054_16.

Thank you and have a great day.

Regards,
-Phil