OK, this is crazy, now Malwarebytes AI module is quarantining itself

[Ralph_Edington]

OK, this is crazy, now Malwarebytes AI module is quarantining its own programs. See below.

 

And quarantining on old version of Windows' own CMD.EXE ???? Really!?!?!?!

Please for the love of everything, would you give us a chance to REPORT ONLY on "AI Detections" rather than stripping needed, legitimate programs from our computers without asking????????  I am so, SO tired of dealing with this nonsense.

 

Thank you,

Me (once again)

 

 

[Ralph_Edington]

Oh and while you're at it, could you please add a one-step action for "Add Exclusion AND Unquarantine"  ???  Right now the process of adding an exclusion and unquarantining is extremely cumbersome.

 

Thanks,

 

Me

[miekiemoes]

Hi,

Above has been fixed already. Sorry for the inconvenience. Can you verify if you are still getting these detections? If so, can you post the detection log, so we can collect more details?

Thanks for your feedback regarding the "Add Exclusion AND Unquarantine". I'll pass it on to our team.

Thanks!

[Ralph_Edington]

Thank you for reaching out. No more AI detections this morning since the ones I already posted.

Thank you for fixing that, I will be sure to let you know if I see any more :)

 

Cheers,

 

Ralph Edington

[miekiemoes]

Thanks for verifying!! :)

 

[Ralph_Edington]

Hey I see my Nebula console is now showing: 

 

"Malwarebytes is investigating reports of some customers encountering a false-positive for detection Malware.AI.4263214107 with file C:\Program Files\Malwarebytes Endpoint Agent\Microsoft.Win32.TaskScheduler.dll.  If you are affected, please restore this file from quarantine immediately. For additional details and instructions, please see this article or contact support for assistance."

 

However, on the laptop of ours that had this problem, restore from quarantine DID NOT WORK, I had to remove and reinstall the whole client, so I think your guidance above is wrong?

 

 

 

Hope that helps,

[miekiemoes]

Hi,

This might happen in some cases when there was a quarantine event before, but a reboot hasn't happened yet, so the file couldn't be restored restored. It should work/unquarantine properly after a reboot.

There's a reference on the page to submit a ticket in case the files couldn't be restored.

[AlexLeadingEdge]

I would like to second the request for an "unqarantine and whitelist" option. Trying to find out what the MD5 is (not that MD5 seems to always work) or to create a wildcard file location in the whitelist options is tedious.

[miekiemoes]

Thanks for your feedback. I'll pass it on to our team.