Malwarebytes and Microsoft Exchange 2013

[Efrain]

We are running Exchange 2013 on Windows Server 2012 R2.  Malwarebytes Endpoint Protection was installed on the server about two months ago.  Recently Microsoft pushed out KB5000871 (security update for Exchange).  The update failed several times and eventually several services on the server were disabled.  We had to remove Malwarebytes Endpoint Protection to get Exchange working again.  Afterwards we were able to install KB5000871.

Is Malwarebytes aware of any conflict between it's software and this patch (or any other patch)?  What are Malwarebytes recommendations for installing Malwarebytes on an Exchange server?

Thanks!

[exile360]

Greetings,

You may find the information in this support article to be of help.  It provides details on running Malwarebytes on Windows Server as well as documenting potential issues you may encounter, best practices, exclusions and configuration recommendations for various Server configurations.  The information in this support article may also prove useful; it describes how to disable Malwarebytes' real-time protection to avoid potential conflicts and performance issues with Windows Server if needed.

I hope this helps, and if you require any further assistance please feel free to post or to contact Malwarebytes Business Support directly via the form on this page and they will respond via email.

Thanks

[Efrain]

Thanks for the info!  I also ran into this document but there are so many exclusions I wonder if it's even worth installing Malwarebytes.

Anti-virus software in the operating system on Exchange servers | Microsoft Docs

[AdvancedSetup]

@Efrain

Please see the following for additional details

https://blog.malwarebytes.com/malwarebytes-news/2021/03/microsoft-exchange-attacks-cause-panic-as-criminals-go-shell-collecting/

 

[exile360]

1 hour ago, Efrain said:

Thanks for the info!  I also ran into this document but there are so many exclusions I wonder if it's even worth installing Malwarebytes.

Anti-virus software in the operating system on Exchange servers | Microsoft Docs

If it helps at all, folder exclusions in Malwarebytes are recursive, so if multiple (or all) files and folders within a particular directory need to be excluded you can simply exclude the parent folder and everything the excluded folder contains will also be excluded.

Edited March 12, 2021 by exile360

[Efrain]

Thanks for the replies thus far.  We'll planning on re-installing Malwarebytes on our Exchange server tonight with the exclusions in the Microsoft article I mentioned above.  However, it would be greatly appreciated if Malwarebytes provided better guidance on this.  Particularly, I'd like to know:

1.  Is Malwarebytes Endpoint Protection recommended and safe to run on a Windows server used for Exchange.

2.  What does Malwarebytes recommend (if any) as far as exclusions, policy configurations, etc. for Exchange.

Thank you!

Edited March 12, 2021 by AdvancedSetup
corrected font issue

[AdvancedSetup]

Hello @Efrain

From my understanding your city already has an account with Malwarebytes.

I would highly suggest that you open a support ticket with Business Support to work with them directly.

Submit Support Ticket

 

There is also this new report out if you've not seen it

https://www.bleepingcomputer.com/news/security/ransomware-now-attacks-microsoft-exchange-servers-with-proxylogon-exploits/

 

Thank you

[Efrain]

Hi.  I already opened a case with Malwarebytes but have not gotten a response.  Again, thanks for all the help!

 

[AdvancedSetup]

I've sent a request to our internal team to have them follow up. Someone should reach out to you today

Thank you again