Malwarebytes Premium changing file permissions?

[Ezraen]

Hi!

So I've been having this issue for a while now. I try to delete a file or folder, or look at the security tabs in their properties and windows is telling me that I lack the permission to delete/view permissions even though I am on an admin account. I tried all kinds of things to resolve this, including booting into safe mode, but to no avail. I read somewhere that antivirus software may be changing permissions or blocking deletion, so I exited malwarebytes and tried to delete the files - and it worked!!

Files on desktop are 100% gone now, even when I hit F5 or when I restart windows explorer. Could someone explain this functionality of malwarebytes to me? And how do I stop it? Not being able to delete files is a bit of a hassle to be honest.

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab on the left column
   
   
    
7. Click the Gather Logs button
   
   
    
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
   
    
9. Upon completion, a file named mbst-grab-results.zip will be found on your Desktop. Click OK
   
   
    
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
    
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/hc/en-us/articles/360038523934

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

[exile360]

Greetings,

Malwarebytes shouldn't change the permissions on any files on your system, though it does include a self-protection driver in the Premium version that will prevent the deletion of any of Malwarebytes' files which can include the desktop shortcut to launch Malwarebytes, which could explain the issue you experienced possibly.  I haven't seen any other kinds of issues with permissions caused by Malwarebytes, however please do let us know if you experience any (other than what I mentioned about Malwarebytes' actual installation files/folders etc.).

[LiquidTension]

Hi @Ezraen,

What type of files does this affect? Are you encountering this with random files or specific files?
Can you provide an example of one of the file paths you're experiencing this with?

The Ransomware Protection component in Malwarebytes has file blocking functionality that prevents the file from being launched, permissions adjusted, etc. This is performed (sometimes silently) when the program cannot definitively conclude a file should be quarantined, but for safety reasons does not want to allow the file to be launched again. However, this will only occur with executable files and is temporary (up until the next Windows session).

Please carry out the instructions in post #2 and reply back with the generated file so we can take a closer look.

[Ezraen]

Hi!

So far as I can tell it only affects .exe files, and mostly only those that are placed on my desktop or in a folder on my desktop. But it has also affected a few exe files in my C drive.

Example paths:
C:\LearningPython\Åsö Distans\002 - if else (Lärobok sid 55-59)\Inlämningsuppgift 001\venv\Scripts\python.exe
C:\Users\andre\Desktop\FRST64.exe
C:\Users\andre\Desktop\youtube-dl\youtube-dl.exe

I've included the logs requested. Thanks in advance!

mbst-grab-results.zip

[exile360]

Thanks, if you are willing it might also be helpful to get a Process Monitor log of the issue happening if you are able to easily replicate it.  To do so please do the following:

Create a Process Monitor Log:

• Create a new folder on your desktop called Logs
• Please download Process Monitor from here and save it to your desktop
• Double-click on Procmon.exe to run it
• In Process Monitor, click on File at the top and select Backing Files...
• Click the circle to the left of Use file named: and click the ... button
• Browse to the Logs folder you just created and type MB4 Log in the File name: box and click Save
• Exit Process Monitor and open it again so that it starts creating the logs
• Replicate the file permissions issue
• Close Process Monitor
• Right-click on the Logs folder on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
• Please attach the Logs.zip file you just created to your next reply, or if it is too large, please upload it to WeTransfer and select the option to send the file as a link from the options menu available by clicking on the circular ... button on the page and provide us with the link to the file
  

Thanks

[LiquidTension]

2 hours ago, Ezraen said:

Hi!

So far as I can tell it only affects .exe files, and mostly only those that are placed on my desktop or in a folder on my desktop. But it has also affected a few exe files in my C drive.

Thank you for the information.

From the provided logs, there's no indication Malwarebytes is causing this. If you're able to replicate the issue occurring on-demand (the transition from a functioning file to non-functioning), the Process Monitor instructions provided above should hopefully give us a better idea of the cause.