Jump to content
Trav_TS

Blocking Games from saving files

Recommended Posts

Malwarebytes Anti-ransomware innately blocks games from saving files required for operation.  I do not feel the software should behave in this manner if the application has been installed by the Administrator and is running correctly.

Share this post


Link to post
Share on other sites

Hi @Trav_TS - thanks for your report. Can you provide a few more details about what exactly is taking place? 

Which games are affected?

What operations are being performed?

Where on disk are these file saves being attempted? Main drive, or secondary/external drive? Temporary directory?

 

Also, I would like to gather additional information to assist with our analysis. arwlogs.exe is an information gathering tool that neither installs nor does it make system/registry hive changes.

  1. Download the trusted, Malwarebytes authored arwlogs.exe utility/tool and save only to a system Administrator's desktop of the system in question.
  2. Single right-click the j1Bynr2.png&key=c55e643d4ec26aa771880d2d  arwlogs.exe icon and select RunAsAdmin.jpg  Run as administrator from the Windows context menu.
  3. If a Windows User Account Control (UAC) alert/prompt for arwlogs.exe appears, select the "Yes" button to continue.
  4. If a Windows SmartScreen warning alert/prompt for arwlogs.exe appears, select "More info" then select the "Run anyway" button to continue.
  5. A Command window will appear and its contents may be mostly ignored.
  6. When "Press any key to continue . . . " appears at the bottom of the Command window, type any Enter key to close the window.
  7. A zipped archive HSPwQfy.png&key=8bea481e1c29518a4e1e2ca3 (yyyy-mm-dd-{COMPUTERNAME}.zip) should have been generated to the system Administrator's desktop.
  8. Attach the above-zipped archive to your next reply in this topic.
  9. Delete j1Bynr2.png&key=c55e643d4ec26aa771880d2d  arwlogs.exe from the Administrator desktop.

 

Create and obtain Farbar Recovery Scan Tool (FRST) logs

  1. Download FRST and save it to your desktop
    Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
  2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
  3. Press the "Scan" button
  4. This will product two files in the same location (directory) as FRST: FRST.txt and Addition.txt

Please attach those files in reply.

 

 

 

Share this post


Link to post
Share on other sites

What I have experienced thus far are the files with the suffix .wtf.  These are configuration files that World of Warcraft uses to save settings.  When MWB AR is running as a service these files are blocked from saving and from changes being read while the service is running.  Adding an exception inside the program does not remedy this issue.  

2018-01-16-LAN-1.zip

Share this post


Link to post
Share on other sites

Hi Trav_TS. Thanks for those details. If you just disable the protection on the Dashboard of Malwarebytes Anti-Ransomware Beta, does that resolve the issue? Or do you have to completely exit the MB3Service? And, are these files being saved to your C drive? Or some other drive?

Could you also post the logs from the FRST tool I mentioned after the arwlogs section of my previous post?

Thank you.

Share this post


Link to post
Share on other sites

My system is setup as such:

C:\OS and system programs

D:\Games, Media and Documents

E:\USB Media (Digital movies etc)

H:\Backup Partition

World of Warcraft files, unlike some games, save all of their settings to subfolders of the parent folder on the partition the game is installed.  Other games tend to save game files in C:\Users\Appdata so system protection is not a factor in this issue, I assume that is why you are asking.

Using disable protection works equally as well as stopping the service so thank you for that suggestion.

FRST.txt

Addition.txt

Edited by Trav_TS

Share this post


Link to post
Share on other sites

Great, thanks for the additional detail. We'll get this to our developers. We may need to perform additional troubleshooting steps to help identify the cause of the issue. Again, thanks for your report.

Share this post


Link to post
Share on other sites

Greetings, @Trav_TS -

We have released the next Component Update (CU) for Malwarebytes Anti-Ransomware Beta. One of the items fixed is an issue with some applications ability to save files in certain conditions. This fix should also apply to the situation you've reported.

You should receive the new CU 1.1.139 in the coming days. It's being served in a metered fashion.

Please let us know if your results match ours. We believe it should.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.