YUMI – Multiboot USB Creator (UEFI v0.0.3.9)

[jbo5112]

I was running YUMI-UEFI-0.0.3.9.exe

https://www.pendrivelinux.com/yumi-multiboot-usb-creator/

from Pen Drive Linux, to create a multi-boot USB flash drive. After loading the drive up with several distros (30+ GB worth), I was removing and adding one final ISO (Clear Linux live server 34640). Malwarebytes flagged the software as ransomware and now my USB shows I have zero(!) distributions installed.

Malwarebytes has been removed, and that was the last time I run real-time protection, unless Malwarebytes pays me $350 for the labor they destroyed.

Edited May 24, 2021 by AdvancedSetup
disabled live hyperlink

[shadowwar]

Fyi . When ransomware triggers it locks out the drive. All you would of had to do was shutdown malwarebytes and the files should of reappeared. If any were still missing then restart from malwarebytes and restore from quarantine. 

[jbo5112]

The file was plenty easy to get out of quarantine. What was ruined was all of the work I had done on the flash drive when YUMI was flagged in the middle of using it.

Would shutting down Malwarebytes have resumed YUMI where it left off, so it could have completed whatever it was doing, instead of corrupting all of the work?

[curmudgeonly]

I just experienced the same issue with two YUMI versions, 0.0.3.2 and 0.0.4.3.  Even after removing from quarantine, restarting, etc....the USB drive was still bootable but YUMI was unable to recognize the existing files and configurations, so does seem that something got corrupted due to an operation interruption by Malwarebytes.  I ended up opting to start over rather than spend who-knows-how-long troubleshooting.  This cost me a couple hours of both time and aggravation as I also had to re-apply several distros to the pen drive.  The curious thing is that I've used YUMI multiple times with Malwarebytes active and I've never had this issue before.  Unfortunately, I can not risk this continuing to happen so I will have to discontinue using Malwarebytes unless the cause of this issue can be identified and resolved.

[Porthos]

1 hour ago, curmudgeonly said:

Unfortunately, I can not risk this continuing to happen so I will have to discontinue using Malwarebytes unless the cause of this issue can be identified and resolved.

You can quit Malwarebytes from the system tray while you create your Yumi drive. When done just trun it back on.

1 hour ago, curmudgeonly said:

Even after removing from quarantine

It would help to have log from when it was quarantined so it can be looked at by the dev's

[curmudgeonly]

2 hours ago, Porthos said:

You can quit Malwarebytes from the system tray while you create your Yumi drive. When done just trun it back on.

Having to remember this every time is not a great option for me.  The problem is with how much time can be lost if/when this happens, and I'm reasonably doubtful that I'll remember to do this each time, especially weeks from now.

 

2 hours ago, Porthos said:

It would help to have log from when it was quarantined so it can be looked at by the dev's

Export and referenced log file are attached to this response.

malwarebytesExport.txt 4f00245c-56c3-11ec-9767-9cb6d011b52c.json.txt

[Porthos]

10 minutes ago, curmudgeonly said:

Export and referenced log file are attached to this response.

Thank you. That is what staff need to know to help you with this issue.

It would have helped also not adding on to a 6 month old topic as well.

I also suggest excluding YUMI in the future just in case a future version trips up Malwarebytes in the future.

I keep all of my tools excluded from DDefender and Malwarebytes on a just in case basis.

@cli @miekiemoes

Edited December 7, 2021 by Porthos

[cli]

Thank you for reporting, the file has been whitelisted.