Printer driver temp files possible false positives

[sharonp]

We have a Duralabel Pro printer we have been using for years here and the temp files the drivers (Seagull Scientific drivers) create when the printer is used are possibly throwing false positives. I made sure the correct driver was installed from the manufacturers website and also added the file path (C:\ProgramData\Seagull\Drivers\Temp) to exceptions but still is getting caught. Any idea what I can do?

mbae-default.log

[exile360]

Greetings,

Unfortunately, excluding a file or folder that way does not exclude it from Exploit Protection.  In this case, given the type and number of detections, I would recommend temporarily disabling Exploit Protection, installing your printer drivers, then re-enabling Exploit Protection and testing to verify that the printer is able to function without triggering any further blocks or detections from Malwarebytes until this false positive is resolved by the team.

To disable Exploit Protection, right-click on the Malwarebytes tray icon in the notification area near your system clock and click on Exploit Protection: On and click Yes when prompted by User Account Control.  Re-enable Exploit Protection using the same menu once the drivers are installed.

Edited February 24, 2021 by exile360

[sharonp]

When right-clicking the Malwarebytes tray icon i only have the option to Start a Threat Scan - I'm guessing because our default policy has Exploit Protection set to On? Is there any other way I may disable it from that one computer or a way to download Malwarebytes again but exclude Exploit Protection?

[exile360]

Ah, that must be it.  You will likely need to have your systems administrator disable Exploit Protection temporarily as you likely don't have access to control it from the client side.

[exile360]

Details on the settings for Exploit Protection in Nebula can be found in this support article if needed.

[Arthi]

Hi By sharonp,

Thanks for posting. Please go to Exploit settings->Advanced settings-> and uncheck "Malicious Load Library" protection for MS Office. Hit Apply and you should not see this block again. Thanks.

[sharonp]

Is this correct? Our default policy does not have Malicious LoadLibrary Protection checked for anything and still have us those blocks.