Jump to content

Blocking Games from saving files


Recommended Posts

  • Staff

Hi @Trav_TS - thanks for your report. Can you provide a few more details about what exactly is taking place? 

Which games are affected?

What operations are being performed?

Where on disk are these file saves being attempted? Main drive, or secondary/external drive? Temporary directory?


Also, I would like to gather additional information to assist with our analysis. arwlogs.exe is an information gathering tool that neither installs nor does it make system/registry hive changes.

  1. Download the trusted, Malwarebytes authored arwlogs.exe utility/tool and save only to a system Administrator's desktop of the system in question.
  2. Single right-click the j1Bynr2.png&key=c55e643d4ec26aa771880d2d  arwlogs.exe icon and select RunAsAdmin.jpg  Run as administrator from the Windows context menu.
  3. If a Windows User Account Control (UAC) alert/prompt for arwlogs.exe appears, select the "Yes" button to continue.
  4. If a Windows SmartScreen warning alert/prompt for arwlogs.exe appears, select "More info" then select the "Run anyway" button to continue.
  5. A Command window will appear and its contents may be mostly ignored.
  6. When "Press any key to continue . . . " appears at the bottom of the Command window, type any Enter key to close the window.
  7. A zipped archive HSPwQfy.png&key=8bea481e1c29518a4e1e2ca3 (yyyy-mm-dd-{COMPUTERNAME}.zip) should have been generated to the system Administrator's desktop.
  8. Attach the above-zipped archive to your next reply in this topic.
  9. Delete j1Bynr2.png&key=c55e643d4ec26aa771880d2d  arwlogs.exe from the Administrator desktop.


Create and obtain Farbar Recovery Scan Tool (FRST) logs

  1. Download FRST and save it to your desktop
    Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
  2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
  3. Press the "Scan" button
  4. This will product two files in the same location (directory) as FRST: FRST.txt and Addition.txt

Please attach those files in reply.




Link to post
Share on other sites

What I have experienced thus far are the files with the suffix .wtf.  These are configuration files that World of Warcraft uses to save settings.  When MWB AR is running as a service these files are blocked from saving and from changes being read while the service is running.  Adding an exception inside the program does not remedy this issue.  


Link to post
Share on other sites

  • Staff

Hi Trav_TS. Thanks for those details. If you just disable the protection on the Dashboard of Malwarebytes Anti-Ransomware Beta, does that resolve the issue? Or do you have to completely exit the MB3Service? And, are these files being saved to your C drive? Or some other drive?

Could you also post the logs from the FRST tool I mentioned after the arwlogs section of my previous post?

Thank you.

Link to post
Share on other sites

My system is setup as such:

C:\OS and system programs

D:\Games, Media and Documents

E:\USB Media (Digital movies etc)

H:\Backup Partition

World of Warcraft files, unlike some games, save all of their settings to subfolders of the parent folder on the partition the game is installed.  Other games tend to save game files in C:\Users\Appdata so system protection is not a factor in this issue, I assume that is why you are asking.

Using disable protection works equally as well as stopping the service so thank you for that suggestion.



Edited by Trav_TS
Link to post
Share on other sites

  • 1 month later...
  • Staff

Greetings, @Trav_TS -

We have released the next Component Update (CU) for Malwarebytes Anti-Ransomware Beta. One of the items fixed is an issue with some applications ability to save files in certain conditions. This fix should also apply to the situation you've reported.

You should receive the new CU 1.1.139 in the coming days. It's being served in a metered fashion.

Please let us know if your results match ours. We believe it should.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.