Jetbrains TeamCity considered exploit

[ThePhoenyx]

I just installed MB3 yesterday and ran a scan which went fine, nothing bad found. I rebooted my machine an hour ago and it almost screamed about the amount of exploits it found... all in one directory, my TeamCity installation. What is up with that? It scanned fine yesterday and now it's posting Generic.agent exploit every 5 minutes. Bitdefender never found anything wrong, a couple of other online scans found nothing wrong and now MB3 is killing my TeamCity installation that runs my build service. PLEASE help me with this or I'll have to delete MB3 since I have to run that service!

[tetonbob]

Greetings, @ThePhoenyx - can you provide the specific Protection Event report from the Reports tab, please? It would likely be an 'Exploit blocked' or 'Malware blocked' report.

[ThePhoenyx]

This is what it said. (Having problems with uploading atm)

-----------------------------------------------------------------------------------------------

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 6/22/19
Protection Event Time: 10:17 PM
Log File: 07c2ad32-955d-11e9-887c-00155d08c1ae.json

-Software Information-
Version: 3.7.1.2839
Components Version: 1.0.538
Update Package Version: 1.0.11198
License: Premium

-System Information-
OS: Windows 10 (Build 18362.116)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Malware.Exploit.Agent.Generic, , Blocked, [0], [392684],0.0.0

-Exploit Data-
Affected Application: Java
Protection Layer: Application Behavior Protection
Protection Technique: Exploit payload process blocked
File Name: C:\WINDOWS\SYSTEM32\cmd.exe \c rd \s \q D:\TeamCity\buildAgent\temp
URL:

 

(end)

------------------------------------------------------------------------------------------

I was getting the same thing (if I remember correctly, don't have the older reports anymore) before I deleted MB3 last year so I could

keep my TeamCity running. I reinstalled last week hoping I wouldn't be having the same problem. Please note, if it's a choice between

MB3 and TeamCity, TeamCity wins. BitDefender doesn't do this (I tried it out last month) but I really prefer MB3 if this can be fixed.

[Navil]

Having the same problem. Has this been resolved yet?

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 12/30/19
Protection Event Time: 10:20 PM
Log File: 4db7283e-2af6-11ea-85c4-bc5ff4955f97.json

-Software Information-
Version: 4.0.4.49
Components Version: 1.0.785
Update Package Version: 1.0.16969
License: Trial

-System Information-
OS: Windows 10 (Build 18362.535)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Malware.Exploit.Agent.Generic, C:\WINDOWS\SYSTEM32\cmd.exe \C dir \-c C:\ProgramData\JetBrains\TeamCity\system, Blocked, 0, 392684, 0.0.0

-Exploit Data-
Affected Application: Java
Protection Layer: Application Behavior Protection
Protection Technique: Exploit payload process blocked
File Name: C:\WINDOWS\SYSTEM32\cmd.exe \C dir \-c C:\ProgramData\JetBrains\TeamCity\system
URL: 



(end)