Jump to content

Can we prevent users from uninstalling Malwarebytes?


Recommended Posts

We are working on some security reporting and auditing and need to create a setting to prevent users from uninstalling MalwareBytes. We currently use AppLocker as a whitelist for installing/running software, but I don't believe that we have a blacklist method. But, I don't want to blacklist something that would keep us from being able to update the software. 

Can we enable self-protection to do this or is there another way to do that? 

Edit: I think I put this in the wrong topic! :(

Edited by alicias
Link to post
Share on other sites

Greetings,

Unfortunately there is no way natively to do this within Malwarebytes at this time, however the uninstaller does require administrative privileges so User Account Control could be used as a means to prevent users from uninstalling the software if you were to set up admin passwords to prevent your users from performing administrative tasks (generally a good idea for security anyway, and one of the primary reasons Microsoft implemented UAC in Vista in the first place).  Otherwise the only way I know to do something like this would be to deliberately block the uninstaller itself from executing which could be accomplished via a registry policy or Group Policy by using the DisallowRun registry function, however it has limitations and only prevents users from executing specified processes by path/name and only through the Explorer shell process (i.e. they can bypass it using CMD or any other initiating process) and also be advised that by default, Malwarebytes actually detects the DisallowRun setting when enabled as a PUM (Potentially Unwanted Modification) as this setting has frequently been used by malware in the past to prevent legitimate security apps and system tools from running to prevent their detection and removal.

If it helps at all, Malwarebytes normally uses an InnoSetup installation package, so that is what the uninstaller actually is.  Documentation on InnoSetup can be found here, although Malwarebytes also offers an MSI installation package for some of their business products (which actually is an InnoSetup installer wrapped within an MSI archive/installer).  MSI documentation may be found here as well as here.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.