Suspicious Activity - False Positive

[HugoD]

Is there any way to whitelist this specific program, C:\PROGRAM FILES (X86)\OMESSENGER\OMESSENGER.EXE. This is an IM program we use internally and Malwarebytes is flagging it down as Suspicious Activity and its rating it as "High." I don't really care that much and I can continue to ignore it, but if there is a way to whitelist it so that it doesn't show up anymore under suspicious activity, I would greatly appreciate it! 

[Porthos]

We could use a little more info.

Please zip and attach OMESSENGER.EXE and also post the log showing the block/detection.

 

[exile360]

I suspect the detections may be web blocks from the Web Protection module indicating that it is connecting to one or more suspicious websites; a common issue with many Peer-to-Peer (P2P) applications such as IM apps, however depending on which business product you're using, it may or may not include the capability to exclude a process from the Web Protection component.

The instructions for the consumer version can be found under the Allow an application to connect to the Internet section of this support article, however they may differ (or may not exist) depending on which product your organization uses.  I couldn't locate any details on excluding a process from Web Protection within the administrator guide for the cloud managed version of Malwarebytes, however the unmanaged version might offer the option to do so as the consumer version does.

[exile360]

I'm checking with my co-workers to see for certain whether the option exists, and if so, how to accomplish it.  I'll post back here once I find out one way or the other.

[exile360]

I have returned with some more info.  If you are using the Nebula cloud platform, you can indeed exclude an executable by path from the Web Protection component of Malwarebytes.  Details can be found in this support article.

To create it, follow the example in the second to last entry in the table where it indicates Web Monitoring as the type and shows the file path of C:\Windows\Zoom\Zoom.exe as the example.

If you aren't using Nebula or you have any further questions on how to create the exclusion please let us know.

Thanks