Malwarebytes Quarantining Software It Shouldn't

[chozosr388]

So, I've been using this particular driver update utility for about nine or ten years now, even with MBAM installed alongside it, and I've never had any issue up until about a month ar so ago.  I built my PC, so I don't have any OEM update utilities to keep my drivers up-to-date, so I use Driver Booster to keep me up-to-date without having to do a monthly search for new drivers for my hardware.  Well, MBAM has taken to start trying to quarantine it when I launch it, or when I download an installer for a new version.  Now, like I said, I've been using it for close to, if not ten years now, so I know, beyond the shadow of a doubt, that there's nothing wrong with either Driver Booster's installer or its executables.  Now granted, Malwarebytes doesn't flag it as malware, just as a PUP.  I'm downloading it, I've been using it for years; it's obviously not unwanted.  The biggest issue is, I have to add an exclusion every time there's an update; the file hierarchy kinda demands it, as each new release gets its own folder (i.e.: "%PATHTOAPP%\6.3.4\").  Now, I don't want to have to exclude the entire folder because well, what happens if I do get something and it happens to infect Driver Booster?  But Malwarebytes is really making it difficult to keep it around without doing just that, thus potentially creating a point of asylum for something.  the line "You've become the very thing you sought to destroy" seems to come to mind with that realization.

 

Any help would be appreciated, 'cause I'd rather not have to create a potential petri dish or get rid of a utility that hekps me keep my system safe and well-oiled, so-to-speak.

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab on the left column
   
7. Click the Gather Logs button
   
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
9. Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

[exile360]

Greetings,

The easiest way to exclude an installed application that you update frequently and where the path changes frequently as you describe would be to temporarily disable the Malware Protection component of Malwarebytes just before you're going to install the latest version after you've downloaded the latest installer but before you actually run it, then run the installer and get it fully installed, then open Malwarebytes and click the Scan Now button on the Dashboard, allow the scan to complete, then uncheck the top checkbox on the upper left of the scan results to clear all of the detected items, ensure that they are all components of the application you wish to exclude, then click Next and when prompted on what to do with the remaining detections, select the option to always ignore them and they will be added to your exclusions.

Additionally you may configure Malwarebytes to ask you what to do when any PUP is detected using the drop-down menu provided under Settings>Protection under the Potentially Threat Protection section for PUPs by selecting Warn User.  When Malwarebytes detects a PUP with real-time protection it will prompt you on what to do with it, and when you scan, PUP items will automatically be unchecked (though still shown in the list of detections) which will make them easier to exclude as described above if it is something you wish to keep while you can check the box next to anything you wish to remove.

With regards to what Malwarebytes detects as PUP and why, please refer to the information in the following links:

https://www.malwarebytes.com/pup/
https://blog.malwarebytes.com/malwarebytes-news/2016/10/malwarebytes-gets-tougher-on-pups/
https://blog.malwarebytes.com/cybercrime/2015/06/digital-snake-oil/
https://blog.malwarebytes.com/cybercrime/2015/06/driver-updaters-digital-snake-oil-part-2/
https://blog.malwarebytes.com/cybercrime/2015/07/pup-makers-digital-snake-oil-part-3/
https://blog.malwarebytes.com/threats/registry-cleaner/
https://blog.malwarebytes.com/puppum/2016/12/why-malwarebytes-detects-pc-pitstop-as-potentially-unwanted/
https://blog.malwarebytes.com/malwarebytes-news/2017/11/winning-the-battle-against-pups-on-your-computer-and-in-u-s-district-court/
https://blog.malwarebytes.com/puppum/2016/07/pup-friday-cleaning-up-with-5-star-awards/
https://blog.malwarebytes.com/puppum/2016/08/systweak-redux-our-response/

Regarding legal precedent, please refer to the following articles which cite two cases involving Malwarebytes and vendors blocked as PUP:

https://blog.ericgoldman.org/archives/2017/11/section-230c2-protects-anti-malware-vendor-enigma-v-malwarebytes.htm
https://blog.ericgoldman.org/archives/2018/09/section-230-helps-malware-vendor-avoid-liability-for-blocking-decision-pc-drivers-v-malwarebytes.htm

The following links should also prove informative as to why many items are classified as PUP by Malwarebytes:

https://decentsecurity.com/#/registry-cleaners/
https://support.microsoft.com/en-us/help/2563254/microsoft-support-policy-for-the-use-of-registry-cleaning-utilities
http://miekiemoes.blogspot.com/2008/02/registry-cleaners-and-system-tweaking_13.html
https://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2853053
https://www.howtogeek.com/171633/why-using-a-registry-cleaner-wont-speed-up-your-pc-or-fix-crashes/
https://www.howtogeek.com/162683/pc-cleaning-apps-are-a-scam-heres-why-and-how-to-speed-up-your-pc/
https://lifehacker.com/5482701/whats-the-registry-should-i-clean-it-and-whats-the-point
https://lifehacker.com/5033518/debunking-common-windows-performance-tweaking-myths
https://www.howtogeek.com/198758/never-download-a-driver-updating-utility-theyre-worse-than-useless/
http://www.howtogeek.com/98465/htg-explains-when-do-you-need-to-update-your-drivers/
https://www.howtogeek.com/233115/the-only-way-to-safely-update-your-hardware-drivers-on-windows/
http://www.tomshardware.com/answers/id-1857635/good-free-automatic-driver-updater.html
http://www.tomshardware.com/answers/id-1974868/trusted-driver-updater.html
https://www.howtogeek.com/172839/10-types-of-system-tools-and-optimization-programs-you-dont-need-on-windows/
https://computer.howstuffworks.com/question1751.htm
https://lifehacker.com/5415355/do-you-really-need-more-than-4gb-of-ram
https://www.tomshardware.com/reviews/memory-module-upgrade,2264.html
https://www.howtogeek.com/128130/htg-explains-why-its-good-that-your-computers-ram-is-full/
https://techlogon.com/2011/03/28/will-more-ram-memory-make-my-computer-faster/

I hope this helps, and if there is anything else we might assist you with please let us know.

Thanks