Jump to content

Ransomware protection blocks legit app


Recommended Posts

I'm running current MWB on Win 10 Pro. I also run Qlik Sense BI tool but today MWB has started to interfere with Qlik Sense.

Sense runs a local data connector on port 9051. If I enable Ransomware protection in MWB I get data connector not connecting errors in Sense. Disable it and all is well with Sense.

I tried adding the Sense data executables to the Allow list but no improvement. Any thoughts on how to allow localhost:9051 to be connected to by local apps without Ransomware protection getting in the way ?

Logs attached.

mbst-grab-results.zip

Link to post
Share on other sites

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  1. Download Malwarebytes Support Tool
  2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
  3. Double-click mb-support-X.X.X.XXXX.exe to run the program
    • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
  4. Place a checkmark next to Accept License Agreement and click Next
  5. You will be presented with a page stating, "Get Started!"
  6. Click the Advanced tab on the left column

    mbst_get_started.jpg
     
  7. Click the Gather Logs button

    mbst_advanced_gather_logs.jpg
     
  8. A progress bar will appear and the program will proceed with getting logs from your computer

    mbst_getting_logs.jpg
     
  9. Upon completion, a file named mbst-grab-results.zip will be found on your Desktop. Click OK

    mbst_log_saved_desktop.jpg
     
  10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:

     notify me.jpeg  

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

mb_attach.jpg.220985d559e943927cbe3c078b
 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

Link to post
Share on other sites
11 minutes ago, unixnut said:

Any thoughts on how to allow localhost:9051 to be connected to by local apps without Ransomware protection getting in the way ?

Add the executives to the allow apps that connect to the internet. Be sure to add the whole Qlik folder to the folder exclusions as well. Are there any other Qlik folders in program files or program files x86? Add them as well.

Also might want to report it as a false positive here. https://forums.malwarebytes.com/forum/191-ransomware/

 

Link to post
Share on other sites

Hi @unixnut,

Thank you for reporting the issue. We believe this is related to a known issue that we hope to release a fix for in an upcoming update.

To assist our investigation, could you provide us with some additional troubleshooting data please.

  • Open Malwarebytes and click Settings.
  • Turn the Event Log Data setting on.
  • Remove the exclusions you recently added so that you are able to reproduce the issue once more.
  • Capture a Process Monitor log as the issue is reproduced.
    • Please download run_procmon.bat using the link below.
      https://malwarebytes.box.com/s/he92cwwd71sa0w7waiub8wx69ymb5d4i
    • Open your Downloads folder.
    • Double-click CX41PDv.png run_procmon.bat. Click Yes if prompted by AVOiBNU.jpg User Account Control.
    • Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.
    • A blue window will appear.
    • When prompted to carry out the tasks, please reproduce the issue you've been experiencing.
    • Once done, click inside the Command Prompt window and press Y on your keyboard followed by Enter.
    • Upon completion, a file named HSPwQfy.png procmon-log.zip will be saved to your Desktop. Please attach the file in your next reply.
    • Note: If the file is too large, you will be provided instructions to upload the file to a file hosting website (wetransfer.com).
  • Gather logs with the Malwarebytes Support Tool and attach mbst-grab-results.zip to your post: https://support.malwarebytes.com/docs/DOC-2396


After reproducing the issue and capturing the data, feel free to re-add the exclusions.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.