Dell Remote Assist

[RetiredChief]

Usually accessed through Dell SupportAssist, but if it is not there (removed today to fix a problem and then later reinstalled), you can enter dra.dell [sic] which will go directly to the Dell program so that you can download and run it. Malwarebtyes blocked it, rather understandably, but it is legitimate as written.

[sUBs]

Hello, please have a read > 

 

[RetiredChief]

I would post a log if I had a log that shows the false positive, but the log file report show no such item, which is why I did not post the log.

[cli]

Can you attach the detected file as well as the files located in C:\ProgramData\Malwarebytes\MBAMService\LOGS? Thanks.

[RetiredChief]

I have no idea why only one of the files with the extension .log will attach to this.

dra.del is not a file, it is just the text needed to accept the terms and start the process of downloading and starting a remote session. When I ran into the block yesterday, I accepted only one access, not a permanent one. Curiously, I tried this on both computers today, and MWB did not block it on either one. I even checked to see if a cookie was set, it was not.

 

 

 

 

 

 

 

 

mbae-default.log

[cli]

You may not receive a detection because the detection was automatically fixed. Also, the rest of the logs may have not attached because there are restrictions on what types of files you can attach to the thread. Can you attach the detected file and all the files in C:\ProgramData\Malwarebytes\MBAMService\LOGS in zip or rar format? 

[RetiredChief]

7 hours ago, cli said:

You may not receive a detection because the detection was automatically fixed. Also, the rest of the logs may have not attached because there are restrictions on what types of files you can attach to the thread. Can you attach the detected file and all the files in C:\ProgramData\Malwarebytes\MBAMService\LOGS in zip or rar format? 

I had pondered if there might be a MWB method of automatically fixing the detection.

I tried three times to upload the two remaining .log files; I have no idea why that did not work. Those two files are quite small, so the size restriction on uploads here ought not to apply. The LOGS folder, however, is 120MB; I will see what a. zip file size is, may have to create at least two such files. I will get to this project later today if the world does not end meanwhile.

[RetiredChief]

For your delectation, I offer this file.

LOGS.rar

[cli]

Is the detected file named 'C:\Downloads\DellRemoteAssist (2).exe'? If it is, I see that it has been whitelisted.

[RetiredChief]

How many times do I have to tell you that it was dra.dell that was detected, not any .exe or anything other than dra.dell? If you cannot connect to dra.dell, you cannot download DellRemoteAssist.

Again, in case you did not carefully read the first paragraph of this reply, the block was for dra.dell.

[Porthos]

5 hours ago, RetiredChief said:

How many times do I have to tell you that it was dra.dell that was detected

Is it a web block or does it get quarantined by Malwarebytes?

[cli]

What is odd is, I looked in the mbamservicelogs and didn't see an explicit web block for dra.dell. I also checked our database and I didn't see an entry for dra.dell.

[RetiredChief]

4 hours ago, cli said:

What is odd is, I looked in the mbamservicelogs and didn't see an explicit web block for dra.dell. I also checked our database and I didn't see an entry for dra.dell.

Why do you find odd that which I had already posted here, " I would post a log if I had a log that shows the false positive, but the log file report show no such item, which is why I did not post the log."?

What to me is odd that the block appeared once, and since then has not reappeared. Given that, why is this ongoing? 

I am assuming that you have actually tried entering dra.dell in a browser and did not find a block. If that is so, then my original post has become moot, and this thread ought to be abandoned.

[Porthos]

9 minutes ago, RetiredChief said:

I am assuming that you have actually tried entering dra.dell in a browser and did not find a block.

You posted in the file section and not the Web FP section is the biggest confusion so going to that site was not tried. When I open a browser to dra.dell it goes to here and no block.  https://www.dell.com/support/incidents-online/en-us/remoteassist

12 minutes ago, RetiredChief said:

If that is so, then my original post has become moot, and this thread ought to be abandoned.

If it works now for you then wonderful. Glad it is working and yes the post will be locked soon unless it does not work for you.

[cli]

18 minutes ago, RetiredChief said:

4 hours ago, cli said:

What is odd is, I looked in the mbamservicelogs and didn't see an explicit web block for dra.dell. I also checked our database and I didn't see an entry for dra.dell.

Why do you find odd that which I had already posted here, " I would post a log if I had a log that shows the false positive, but the log file report show no such item, which is why I did not post the log."?

Typically when users mention logs they are referring to the scan logs that you can export via the UI. The logs I guided you to collect were the mbamservice logs, which shows the mbam app activity and sometimes contain detections that the scan log doesn't show. 

Please check again. Just because we didn't experience a block doesn't mean you won't. If a detection does happen again, please collect a screenshot of the block and the mbamservice logs.

[RetiredChief]

19 hours ago, Porthos said:

Is it a web block or does it get quarantined by Malwarebytes?

One-time block. Not repeated on either computer.

[RetiredChief]

13 hours ago, cli said:

Typically when users mention logs they are referring to the scan logs that you can export via the UI. The logs I guided you to collect were the mbamservice logs, which shows the mbam app activity and sometimes contain detections that the scan log doesn't show. 

Please check again. Just because we didn't experience a block doesn't mean you won't. If a detection does happen again, please collect a screenshot of the block and the mbamservice logs.

As you refuse to read what I have posted, I am done here.

This time, you ask me to check again, when I had already written "Curiously, I tried this on both computers today, and MWB did not block it on either one." I have checked a few more times, same result.

[cli]

From reading your posts and looking at the logs, the behavior seemed atypical. I wanted to see if it was intermittent and whether if it may be a bug. Thanks for reporting and double checking for me.