Anarelion Posted January 3, 2018 ID:1196337 Share Posted January 3, 2018 (edited) Every single time I try to upgrade my linux subsystem, I get some random file blocked from execution (dash this time) and boom, Linux subsystem is broken till I uninstall and reinstall. I get that executing a bash/dash/any shell is dangerous, but is there a way to detect that they are running under the Linux subsystem and check what they do, not what they are? Malwarebytes has helped me in the past, so far has been a trustworthy company, but security shouldn't kill usabilty. I should be the one to decide about security tradeoffs. Please, if a shell executable is being run, allow me to decide if I allow it or not before blocking, also allowing browsing what is being executed would be a plus for expert users. Bonus points if you automatically whitelist any ubuntu shell (they are supposed to be crypto signed). Edited January 3, 2018 by Anarelion more precise meaning Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 3, 2018 Staff ID:1196364 Share Posted January 3, 2018 (edited) This is being investigated by the team currently. Can you try again and see if its still detected? We are having a hell of a time duplicating it on this end. I made some whitelist adjustments in the cloud and we want to see if that has any effect. Thanks. Edited January 3, 2018 by shadowwar Link to post Share on other sites More sharing options...
Anarelion Posted January 3, 2018 Author ID:1196420 Share Posted January 3, 2018 This is the error in malwarebytes and in my shell. I don't think its about having a repro or not, I think that these are common binaries used by malware and ransomware. My point is that I would like to have a choice whether I allow its execution or not, show me the arguments and any file involved and let me choose. Security is about tradeoffs, I would like to have some setting to allow me to choose. Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 6, 2018 Staff ID:1197383 Share Posted January 6, 2018 I can mention this to the team but our past research on HIPS type applications is most of our users dont know when something is bad or good and answer incorrectly most of the time. That is why we have shyed away from doing HIPS type prompts on things. Link to post Share on other sites More sharing options...
Dheeraj Posted February 27, 2018 ID:1220082 Share Posted February 27, 2018 Hello All, A fix for Linux subsystem issues has been released in our ARW standalone release this week. This will be incorporated into the Malwarebytes Premium in the next Premium release which is slated for the end of March 2018. For now, if you would like to try out the fix on the standalone ARW product, it can be downloaded from https://forums.malwarebytes.com/topic/211708-latest-version-mbarw-beta-09-v-0918807-download/ Sincere apologies for the delay Link to post Share on other sites More sharing options...
Staff tetonbob Posted March 29, 2018 Staff ID:1228294 Share Posted March 29, 2018 Greetings, all. We officially released 3.4.5.2467 today. This build includes a fix for the WSL issue you've been reporting. https://forums.malwarebytes.com/topic/225664-malwarebytes-345-patch-release/ You can download it here https://downloads.malwarebytes.com/file/mb3/ Let us know your results. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now