Jump to content

Recommended Posts

1 hour ago, AdvancedSetup said:

I assume both of you either have Firefox installed onto another drive instead of the C drive, and/or you're loading Profiles that are not on the C drive or default folder structure. Is that true?

 

 

Not true for me, have profile on the C Drive.

Link to post
Share on other sites
  • Replies 86
  • Created
  • Last Reply

Top Posters In This Topic

  • Root Admin
3 minutes ago, smokeejoe said:

Not true for me, have profile on the C Drive.

Okay, just wondering as so far you are the only 2 I've seen with the issue so trying to figure out what you both may have in common as no one else seems to be posting about this issue.

Thanks

 

Link to post
Share on other sites
On 7/2/2020 at 11:21 AM, LiquidTension said:

@frozen To confirm, is the issue still not exhibited with the latest standalone Malwarebytes Anti-Ransomware?
https://forums.malwarebytes.com/topic/258918-latest-version-of-mbarw-beta-v091956-11349-released-11-june-2020/

You mentioned the issue is not exhibited when using a different profile. Can you try a new/default profile located on a different drive so we can rule out if the contents of your profile has any impact?

-

The problem occurs in my case when I use my normal profile which is stored over on D drive. If I use the profile that is over on C drive  (which is a copy of the files I made from the D drive profile) the problem does NOT occur.

Link to post
Share on other sites

What is weird is that if I perform the update while using the D drive profile MBAM first flags Updater.exe when FIrefox is restartred after the update. Then MBAM simply terminates FIrefox upon restarting Firefox. None of this behavoir occurs when I use the C drive profile.

 

Link to post
Share on other sites

As I wrote in my post:


Just like @frozen, I have always had a profile on the D drive
However, the problem appeared for me first time on the night of July 9-10 when Firefox has updated to version 78.0.2 - although I haven't changed Firefox settings or add-ons or Malwarebytes (it was then 4.1.0.56 version) since the beginning of the year.

Link to post
Share on other sites
3 minutes ago, floc said:

As I wrote in my post:


Just like @frozen, I have always had a profile on the D drive
However, the problem appeared for me first time on the night of July 9-10 when Firefox has updated to version 78.0.2 - although I haven't changed Firefox settings or add-ons or Malwarebytes (it was then 4.1.0.56 version) since the beginning of the year.

Same thing here. I have been updating FIrefox without issues until April this year and was always using the profile on D drive. Only since then have I had to use the C profile to do the update I bet if I leave FIrefox alone for a day or so I will again be able to use the profile on D drive again without any repercussions from MBAM. At least that was what I experienced earlier this month. 

Link to post
Share on other sites

@AdvancedSetup @exile360

In my case, Firefox is installed as typical on the C drive, in Program Files.  My AppData folder is also on the C drive but most of my user data, including my Firefox profile, is on a different drive.  After upgrading to Firefox 79.0 today, MBAM flagged firefox.exe a few seconds after launching and wouldn't let me launch again so I had to completely disable the ransomware protection.  This is the first time this has happened for me.  Looking back over this thread, I don't think the version of Firefox matters.  I guess the profile being on a different drive isn't a requirement for the issue to occur but somehow greatly increases the chance of it happening.  I'm guessing there is some sort of heuristics occurring.

Anyway, I already created a support ticket earlier, which is 3131631 and attached the results of the support tool to the ticket.  Soon after I received what I assume to be a canned email response because the email requested I run the support tool even though I had already attached the results to the ticket.

I looked for and couldn't find a way to whitelist or create an exception for files erroneously flagged as ransomware like there is for web protection and malware.  That would be a nice feature to have for occurrences such as this.  But if the feature already exists and I'm missing it somehow in the UI , please let me know.

Link to post
Share on other sites

I just noticed that MBAM is still blocking FIrefox.exe from running. The EXE is still there on the hard drive. I had to close MBAM to run the program. There is s of course nothing inin quarantine. THis is because MBAM did a RTP detection on it. I guess I will have to disable Ransomware altogether in MBAM. If I do then Firefox is allowed to run, Same thing happens if MBAM is closed altogether.

 

Link to post
Share on other sites

Adding "C:\Program Files\Mozilla Firefox\firefox.exe" as an exclusion to Ransomware and re-enabling Ransomware detection in MBAM allows me to run FIreofox even from the profile on D Drive. That is probably until the the next firefox update I guess.

Link to post
Share on other sites
12 hours ago, frozen said:

Adding "C:\Program Files\Mozilla Firefox\firefox.exe" as an exclusion to Ransomware and re-enabling Ransomware detection in MBAM allows me to run FIreofox even from the profile on D Drive. That is probably until the the next firefox update I guess.

Thank you!  I couldn't find that option yesterday and after seeing your post and digging around a bit, I finally found it.  I thought the allow list was only for files detected as malware and PUPs as I had managed them within the Quarantine screen in the past and I could've sworn in the older UI that there was a separate screen to manage the Web Protection items.  So I was either confused and mistaken or they rolled separate options into one view in the new UI and threw me off.

Link to post
Share on other sites

All the different types of exclusions were always listed on the same screen/table in the UI going all the way back to Malwarebytes 1.x, however scan logs and real-time protection reports are now separate where they used to be on the same screen, so that may be what you are remembering.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.


Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.