Unify Controller conflict with Malwarebytes Premium

[arbrich]

Running  Malwarebytes and it causes Unify Controller to stop. 

I have tried turning the Java Protection Off with no luck as well as setup exclusions for The entire Ubiquiti UniFi folder and for the ace.exe that runs the controller.

Running on Windows 10 1809

If I turn off Malwarebytes exploit and web protection, Controller will run fine.

I am looking for some way to put in Exclusions or change malware settings to allow the controller to run without stopping.

 

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab on the left column
   
7. Click the Gather Logs button
   
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

[Firefox]

Greetings, @arbrich
 
Please do the following so that we may take a closer look at what is going on with your system to try and solve the problem:

1. Download and run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced tab on the left (not Start Repair)
3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply
   

Thanks

[arbrich]

Here are the logs. I ran this while the Unify Controller was running and it had not failed yet. 

Again the goal is to determine what Exclusions I need to put in so the Controller will not shut down.

If I turn OFF Web Protection and Exploit Protection the Controller will continue to run normally.

I was able to keep the Controller Running when I just turned of Web Protection today.

 

 

 

mbst-grab-results.zip

[arbrich]

Just an update that the Controller continued to run normally overnight with only the Web Protection turned off.

So we just need to figure out what exception to put in to keep it running and allow me to keep web protection on.

Thanks

 

[exile360]

Greetings,

I would suggest excluding each of the program's active/running processes when the program is running/in use to see if that helps.  Be sure to exclude them by selecting the Exclude an Application that Connects to the Internet option described in the section of the same name in this support article.  That should hopefully resolve it, but if it does not then it may prove helpful to grab a WireShark log of the communication from the app when it's being used to determine exactly what IPs/domains it connects to then excluding each of them using the Exclude a Website option described in the same support article and hopefully that will resolve it.

[arbrich]

I assume I should Exclude the java applications as well since this runs through java ?

[exile360]

Yes, that would be a good idea as one of the Java components may be the executable that is actually being blocked trying to connect.

[arbrich]

I excluded everyhting I could see running including Unify.exe, mongod.exe, java.exe, javaw.exe and javaws.exe with no luck.

Can you guide me on Wireshark at all  ??  - I did download and install it.

[arbrich]

Here are 2 captures:

Cap1 is The controller running and then failing and I stopped the capture

Cap2 is after the Controller has failed.

The Client PC is 192.168.1.244 where the controller is running.

captures.zip

[exile360]

Thanks, I'm sure they'll prove useful.  I'm no expert on Wireshark myself, but it is often used for tracing connections and checking connectivity issues so the network/Web Protection guys should be able to use them to determine where the block is occurring and why.  I'll ping one of them to come take a look at the data you've provided and hopefully we can get this figured out and fixed for you.

@Dashke or @Zynthesist could one of you guys please take a look here to try and determine why Web Protection is preventing Unify Controller from connecting when active?  Wireshark logs are provided above along with all the Malwarebytes logs and data from the Support Tool.  Web Protection doesn't appear to be blocking anything according to the logs, but if Web Protection is active Unify can't connect, and if Web Protection is disabled it can connect and Web Exclusions for all of its associated processes hasn't helped so my guess is that it might be some kind of driver and/or WFP conflict maybe?  Unify is a VPN/cloud application and likely uses WFP itself, though the only registered WFP filters showing in the logs are those from MWAC/Malwarebytes and the ones belonging to MS/defaults.  I'm hoping there's a simple solution here like an exclusion we're missing or something.

Thanks

[Zynthesist]

@arbrich Hello, sent you PM.

[arbrich]

Guys any update on this ticket, It has been over a month now ??

Zynthesist asked me to check in with support again ?

 

 

[AdvancedSetup]

Please follow up with your support ticket online.
 

Thank you