Blocks NPM from working

[hoffs]

Hello,

So I today tried to install some NPM packages but it would always fail with npm related error "ENOENT: no such file or directory" which means that NPM couldn't find or access the file. But as soon as you disable Ransomware protection it instantly works fine. You can even be stuck at that point and disable Malwarebytes while its stuck and it will immediately continue after disabling. You can see more people confirming the issue towards the end of the thread here (pretty recent posts): https://github.com/npm/npm/issues/17444 .

This is kind of a false positive in a way that it seems to be blocking it but not necessarily popping the block.

[miekiemoes]

Hi,

Sorry for the delay - We would need more info, so can you zip and attach the MBAMService.LOG, this so I can have a look why it was detected.

You can find this log in the following folder: C:\ProgramData\Malwarebytes\MBAMService\LOGS

Also, can you let us know what version of Malwarebytes you are using? Are you using MB3 or the standalone version of AntiRansomware?

Thanks!

[jladbury]

Same thing with me. Have attached the log.

MBAMSERVICE.LOG

Version 3.4.4

Edited March 20, 2018 by jladbury
add version info

[tetonbob]

@jladbury thanks for the log. Unfortunately it doesn't show the cause of why Anti-Ransomware would be blocking NPM. Can you please provide additional information which we can share with our Dev team?

First, run the arwlogs tool as shown in this post, then provide as an attachment the zip file it will create.

https://forums.malwarebytes.com/topic/177810-how-to-report-a-false-positive/

Also, if you could run a Process Monitor capture while reproducing the issue, it would be greatly appreciated.

https://live.sysinternals.com/Procmon.exe

The procmon capture will be too large to attach. You can use a file transfer service such as wetransfer to upload, and provide a link here or via Private Message to me.

https://wetransfer.com/

Thanks!

[hoffs]

@tetonbob I sent you a private message with my logs reproducing this issue.

Edited March 20, 2018 by hoffs

[tetonbob]

@hoffs - thanks much! I'll send this along to our Dev team  

[gootman]

Any update on this. this is a new problem for me with programming. VS uses npm to compile code. I need to turn off ransomware protection in order to have it work. This wasn't the case before with malwarebytes. I now have an additional step in order to publish. Any steps I can do to tell malwarebytes to ignore npm? It doesn't show in the log

[tetonbob]

Hi @gootman - yes, we have this issue fixed in our next release which is slated for the end of this month. No firm date at this time though.

[tetonbob]

Greetings. 

We officially released 3.4.5.2467 today. This release includes a fix which should address this issue.
https://forums.malwarebytes.com/topic/225664-malwarebytes-345-patch-release/

You can download it here https://downloads.malwarebytes.com/file/mb3/

An install over the top of existing should be fine, but I'll leave that decision in your hands.

Edited March 29, 2018 by tetonbob