NAS discovery prevented, how to allow discovery

[MKaprielian]

Hello

Running version 3.3.1.2183

I have several NAS on my home network.  The maker provides  an NAS Assistant Application that searches the network for their NAS and allows me to access them, map drives and more.

After installing Malwarebytes the application can no longer discover the NAS devices and recommends I check my Anti-Virus apps.   If I exit Malware bytes they can now be discovered by the NAS Assistant application

I went into Malwarebytes settings,    Exclusions,   Exclude a Website,   Exclude an IP Address,     and entered the IP addresses.    This did NOT allow the NAS to be discovered by my NAS Assistant application.

Should I be doing something else to allow the NAS to be discovered when running Malewarebytes?

 

   Mark

[vbarytskyy]

@MKaprielian

What is the name of the application or do you possibly have a download link so we can test it?

Also--Could you get us some logs to look over so we can examine any detections/blocks that may have occurred?

See my signature for help with getting logs, make sure to get FRST and MB-Check logs. 

 

Thanks

[MKaprielian]

Hi

The name of the application is   Synology Assistant, Version 6.1-15163   from Synology.

You can download the Assistant from this page:   https://www.synology.com/en-us/support/download/DS116#utilities 

Well...   I just went to reproduce the  non-discovery problem so it would be the most recent item in the logs and it now allows it to discover the NAS IPs.    I didn't reboot anything but I had already tried restarting Malware bytes so I don't know of any reason why it didn't work at the time other than perhaps some kind of time delay.

It may still be worth looking into this though.

I will start working on getting the log files and attach in a new response

   Mark

 

 

[MKaprielian]

Here are the logs.

mb-check-results.zip

   Mark

 

[vbarytskyy]

@MKaprielian

I'm not seeing any blocks against a NAS drive being called out. I do see there were some exclusions processed around 11am (today) for local IP addresses. Those could be why the issue cannot be replicated again.

Was there an approximate time when you did notice the problem so I can check the logs around that time frame?

[MKaprielian]

Hi

That was about the time I did my testing.

New information:

On a second PC I did the following:

• MalwareBytes has been running and is still running
• Try the Synology Assistant, it fails
• Open MWB and added the exclusion for one of several NAS
• Close MWB
• run Synology assistant, it failed
• Opened MWB and looked to see that the exclusion was still there
• Closed MWB
• run Synology assistant,   ALL 3 NAS now appear

A few days ago I had repeated tried to get the Synology assistant to detect the NAS, it just wouldn't work.

Today I started trying the Exclusion in MWB and after a few fails it worked on the first PC that I reported and now It works, even without all the exclusions on the 2nd PC.

It doesn't make sense to me given the order of events and the fact that I did not exclude all three NAS on the other PC.   Yet, somehow, until I started trying to do things to MWB, I could not get it the Assistant to find the NAS.   There is some kind of interaction going on but not one that seems very deterministic.

   Mark

 

 

[vbarytskyy]

@MKaprielian

If you don't mind doing some additional testing, if you remove the exclusions on the first PC, are you still able to locate and access the drive? 

[MKaprielian]

Hi

Happy to do additional tests.

Just now did the following 

1. Opened MWB
2. Opened up Synology Assistant and did search for NAS.  Found them
3. Removed Exclusions, did not move off that screen and went directly to 
4. Click on Search, not found

A few moments later after the search failed I saw system tray pop-ups that I had not seen before.   I don't think I would have missed them when I was trying this out yesterday.

I caught a screen shot of one of them.  It is for one of the NAS.  See attached

 

Should I somehow try to have MWB scan the NAS?  Is that possible

 

Now I continue to get the system tray pop-ups.

Next steps?  Next tests ??

   Mark

 

[MKaprielian]

Additional Information:

After adding the three NAS IPs back into exclusions, doing a search for them continues to fail.

--- Note, there's no finish or OK after adding the exclusions.  Does it require moving off the window or closing the program or are the changes instant?

Started a timer

After 1 minute, getting a pop up for the busy NAS a minute later

After 2 minutes the search for the NAS works

Even with the Exclusions there and the Search working I now get a bunch of pop ups.  Here are different ones I caught

[vbarytskyy]

@MKaprielian

Do you mind giving the beta a try for us? We changed some logic in how website detections are handled so this would be a great test. After confirming with the beta, you can go back to the public release and add exclusions for the time-being, if you'd like or stay on the beta.

Note: There are some BSOD issues with the beta that we've identified but we believe it has to do with a specific driver file version, which your computer should not trigger that issue, based on logs that were sent earlier. 

If you'd like to try out the beta and see if these still trigger, download it here.

 

Thank you

[HarryZ]

Aloha.  I have this exact same problem: Synology Assistant cannot find existing Synology NAS (model DS416) with Malwarebytes installed and running. Turned of "Web Protection" in MWB and then the Synology Assistant CAN find the NAS. This is repeatable.  Also note that when the NAS is not detected, the drive is accessible via Windows Explorer (mapped drive) and also via the NAS' built-in administrative web interface.  Malwarebytes 3.6.1.2711 running on Win 10 1803

No problem with collecting logs to help with analysis, just please provide a link to the procedure to do this.

Mahalo,

Harry Z

[exile360]

Greetings,

If you exclude the Synology application via the instructions found in this support article under the section titled Exclude an Application that Connects to the Internet does it work then?

[HarryZ]

On 11/29/2018 at 3:26 AM, exile360 said:

Greetings,

If you exclude the Synology application via the instructions found in this support article under the section titled Exclude an Application that Connects to the Internet does it work then?

Yes, it does work after adding the exclusion for C:\Program Files (x86)\Synology\Assistant\DSAssistant.exe

Note to anyone else who might be reading this thread. Check the system tray and close any / all instances of Synology Assistant that might be there. (When you close the SA gui, it leaves an icon in the system tray). Right click on the icon and select 'Close Assistant'. Then set the exclusion in Malwarebytes, and try running SA again.

I'm assuming there is some form of analysis and subsequent "whitelisting" that is used internally in MWB to determine if a program is safe to run. Will you be adding DSAssistant.exe to your list of approved programs?

Mahalo,

Harry Z

[exile360]

No, there is no internal whitelist for excluding applications from the Web Protection component.  I will point the team to this topic for analysis though as there may be a web false positive that they can correct here.

[HarryZ]

13 hours ago, exile360 said:

No, there is no internal whitelist for excluding applications from the Web Protection component.  I will point the team to this topic for analysis though as there may be a web false positive that they can correct here.

OK. Let me know if you need any testing / gathering of logs done.

Mahalo for your assistance!

Harry Z