Jump to content
Isis4

Stop Automatic Quarantine Reboot?

Recommended Posts

I'm having a hellish time with Malwarebytes suddenly declaring that something must be quarantined immediately, and then automatically rebooting my PC in the middle of my work. The couple of items it quarantines are categorized as PUPs, but they are programs that I've been using for years without any problems, on several different computers, that Malwarebytes has never flagged until now, and that I always end up restoring.  I looked in the user's guide and it seems to say that as a user of the free version of Malwarebytes I have no control over this behavior. But surely there must be a way to keep this from happening? It's getting to a point now that I'm seriously considering removing Malwarebytes from my system, which I'd rather not do, because it's always been the most effective program of its kind that I've used. But I can't keep having my work interrupted with a program that has a mind of its own. I would greatly appreciate some insight into what my options are to stop automatic quarantines and reboots. Thanks so much.

Share this post


Link to post
Share on other sites

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven't done so already, please run these two tools and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Farbar Recovery Scan Tool (FRST)
    1. Download FRST and save it to your desktop
      Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
    2. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
    3. Press the "Scan" button
    4. This will produce two files in the same location (directory) as FRST: FRST.txt and Addition.txt
      • Leave the log files in the current location, they will be automatically collected by mb-check once you complete the next set of instructions
  • MB-Check
    1. Download MB-Check and save to your desktop
    2. Double-click to run MB-Check and within a few second the command window will open, press "Enter" to accept the EULA then click "OK" 
    3. This will produce one log file on your desktop: mb-check-results.zip
      • This file will include the FRST logs generated from the previous set of instructions
      • Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

Share this post


Link to post
Share on other sites

Greetings,

I'm sorry for the trouble you're having with Malwarebytes.  First off, you can prevent the automatic reboot by editing the scheduled scan by going to Settings>Scan Schedule and double-clicking on the scheduled scan listed there.  In the screen that pops up click the Advanced button to reveal additional options and uncheck/disable the option Restart computer when required for threat removal.

Now, as for the PUP item that you wish Malwarebytes to ignore, return to the Dashboard tab and click Scan Now.  Allow the scan to complete and once it shows the detections for the application you wish to keep that it has been detecting, click the checkbox on the top to the left of where it says Threat Type so that all detected items are unchecked, then click Next.  When prompted on what to do with the remaining unchecked items, click Ignore Always and they will be added to Malwarebytes Exclusions list so that they will no longer be detected by future scans.

I hope this helps and if you have any further issues or questions please let us know.

Thanks

Share this post


Link to post
Share on other sites

Thank you, exile360. Much appreciate your help.

When I double click on the scheduled scan, I don't get the Advanced button option at all. I assume that's what's missing in the free version. Luckily Malwarebytes hardly ever detects anything except for these two programs anymore. Before I started deleting all flash cookies I always got frequent detections, and with this automatic reboot I would have no choice but to remove Malwarebytes, because it would be too disruptive.

So for  now I was only able to do the scan and add a few items to the exclusion list. But the earlier scan quarantined 7 items associated with two programs, and the manual scan only detected 4 associated with one program, so I suspect that the other 3 items will show up again eventually and likely trigger the same quarantine and reboot behavior. Is there a way to manually add the other items to the exclusion list?

 

Share this post


Link to post
Share on other sites

It all depends on what the items are that are being detected.  If they're registry entries, then no, but if they are files or folders, yes.  To exclude a file or folder follow the instructions in this support article, making certain that you leave the default Exclude a File or Folder option selected, then browse to the location of the program or file you wish to exclude and select it and add it as indicated in the article.  If the items being detected all reside within the program's Program Files folder, then excluding it should be a simple matter of adding that particular folder to your Exclusions list (for example, C:\Program Files\<Program Being Detected by Malwarebytes>) because exclusions are recursive (meaning everything within an excluded folder will be ignored, including files, other folders as well as other items within folders within an excluded directory).

By the way, are you able to at least delete the scheduled scan?  If you just don't want to use scheduled scanning and would rather perform manual scans on your own to avoid this issue, that could be a viable option, assuming it allows you to delete it (I believe it did in previous versions, but that may have changed in 3.4.5 as I haven't checked it yet, having the paid version myself).

Share this post


Link to post
Share on other sites

Yes! I was able to delete the scheduled scan! That should solve the problem of the automatic quarantines and reboot, since that always happens after a scheduled scan. That's a relief! Thank you for pointing me to that option. I'll just be more disciplined about doing manual scans, where I have more control over what happens with the detected items.  I'll keep the instructions for adding exclusions on hand, but just stopping the scheduled scan should take care of my primary problem with the automatic disruptions.

Thank you so much for your help, exile360! Really very much appreciated!

Share this post


Link to post
Share on other sites

That's great, I'm glad I was able to help :)

As for exclusions, it should be a piece of cake now since you'll be doing manual scans from this point forward.  Just remember to uncheck whatever you want to keep, then click Ignore Always when prompted on what to do with the remaining/unchecked items and you should have all of them in your exclusions list in no time.

Share this post


Link to post
Share on other sites

Yeah, I was thinking just waiting for the manual scan to prompt me would be much easier. Can't tell you how relieved I am to have nipped this automatic behavior in the bud.

I love tech forums! I always learn so much from others. Thank you for being part of this online community and helping us all become more adept at computing. :)

 

Share this post


Link to post
Share on other sites

No problemo :)

Always glad to help, and if you need help with anything else (not just Malwarebytes issues) please don't hesitate to post.  There are other areas of the forums here such as the General Windows PC Help forum where you can ask about and discuss anything from software, to Windows itself, to hardware or pretty much anything else having to do with computers.  There's also a general chat area if you just want to stop in and say hi, talk about movies, music, video games or anything else (as long as it isn't anything illegal or offensive of course).

This forum is a pretty decent resource for learning as well as receiving assistance on a wide array of subjects, so feel free to stop by any time to chat us up or ask us a question :) 

Share this post


Link to post
Share on other sites

Thanks, this is really wonderful to know. This site is going right into my bookmarks! :)

 

Share this post


Link to post
Share on other sites

Hi @exile360,

Similar to OP's thread, i wanted to ask something I would like to know, in fact I did not like.

I'm using Malwarebytes 3.3.1 (previous version) and I've been using MBAM for a long time since version 1.x.

I noticed that, although PUP and PUM configuration setting is set to "Warn", Malwarebytes provides an option to Quarantine to Ignore after the scan. When I select "Quarantine" it automatically schedules to delete them on next reboot, asking user's PC to reboot immediately. Is it an expected behaviour?

Also, In Malwarebytes main windows, Application or Protection TAB does NOT provide any option to choose any post-detection action like "Delete". Is it also by design? I mean, Quarantine should not mean directly deleting the object when found, but neutralizing it which means keeping it sandboxed / renamed on a protected location, but Malwarebytes appear to "delete it on reboot" when you select Quarantine option at the end of scan when scan report is generated. Was it running always like that?

I hope you can explain this, sir.

Best regards!

Share this post


Link to post
Share on other sites

Malwarebytes has always worked this way, and I'll explain how it works to provide details on what's going on.

First, any time Malwarebytes is going to remove something, regardless of whether it is in real-time via real-time protection or after a scan, it always creates an encrypted backup copy of the item in quarantine, then it proceeds to delete the item or schedule it for deletion on reboot, but no matter what you end up with a backup copy in quarantine so that after the deletion has taken place, you still have the item backed up and may later restore it if you need to for any reason.  It has worked this way since the 1.x days and still works this way today.

So yes, this is expected behavior, and especially with scans, Malwarebytes will generally schedule items to be deleted on the next system restart, either because the item may be active/in-use, or because Malwarebytes wants to make sure that it is removed fully, but regardless of which may be the case, Malwarebytes will always create a backup copy in quarantine first to prevent deleting an item with no backup copy in case it is needed.

Share this post


Link to post
Share on other sites

After restarting Malwarebytes after Quarantine Windows 10 64bit will not Boot, Does a startup repair but does nothing. I ran the scan with Frst64 and copied the log files that are attached. Thank you for any help.

FRST.txt

Share this post


Link to post
Share on other sites

Greetings,

I responded to your PM.  Go ahead and create a new topic in the malware removal area as I recommended and one of our malware removal specialists will help you to get your system fixed up, cleaned and back in proper working order again.

If there's anything else we might assist you with please let us know.

Thanks

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.