RandomRecursion Posted December 1, 2021 ID:1490639 Share Posted December 1, 2021 Hello! Earlier today, MB detected Process Hacker 2.39 as RiskWare.ProcessHacker. Looking at previous threads, this appears to be an occasionally-recurring false-positive. Log is attached for your review. Thanks in advance! mbam_processhacker_fp.txt 2 Link to post Share on other sites More sharing options...
Staff cli Posted December 1, 2021 Staff ID:1490641 Share Posted December 1, 2021 This is a valid detection. We've decided to start detecting Process Hacker because it's abused by malware and especially by ransomware. If you added Process Hacker yourself and do not wish to see the detection, please add it to your allow list. Please read Exclude detections in Malwarebytes for Windows if you need assistance on how to add programs to the allow list. Thanks for reporting. Link to post Share on other sites More sharing options...
RandomRecursion Posted December 1, 2021 Author ID:1490676 Share Posted December 1, 2021 Thank you, I will do so. For the benefit of anyone else who runs in to this detection, you may want to update the blog article on Process Hacker, as it currently indicates that Malwarebytes does not detect it (the first note at the very end of the article). The link is https://blog.malwarebytes.com/101/how-tos/2018/11/advanced-tools-process-hacker/. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 1, 2021 Root Admin ID:1490677 Share Posted December 1, 2021 It's a blog post from three years ago. I'm sorry but no one goes back and edits documents that are ancient. It becomes rather obvious to most users that something posted three years ago is highly unlikely to be relevant today, but thank you for your feedback Cheers Link to post Share on other sites More sharing options...
sp123 Posted December 1, 2021 ID:1490728 Share Posted December 1, 2021 8 hours ago, cli said: This is a valid detection. We've decided to start detecting Process Hacker because it's abused by malware and especially by ransomware. If you added Process Hacker yourself and do not wish to see the detection, please add it to your allow list. Please read Exclude detections in Malwarebytes for Windows if you need assistance on how to add programs to the allow list. Thanks for reporting. How is 'Process hacker' more dangerous then Sysinternals's Process Explorer, or Task Manager, or any of the other hundreds of other process management tools out there? When is it abused by ransomware? Just because something perfectly legit is being abused by malware doesn't mean it should be outright blocked (and deleted). I often use Malwarebytes on VMs, which are reset every time, so adding it to the allowlist doesn't really work. At least provide some explanation in the prompt that it isn't malware, just abused. I know what riskware is but a lot of people don't (though they probably aren't downloading process hacker). Link to post Share on other sites More sharing options...
sp123 Posted December 1, 2021 ID:1490729 Share Posted December 1, 2021 Also, it seems that the page on this detection has not been updated: Link to post Share on other sites More sharing options...
dmex Posted December 1, 2021 ID:1490757 Share Posted December 1, 2021 7 hours ago, AdvancedSetup said: It's a blog post from three years ago. I'm sorry but no one goes back and edits documents that are ancient. It becomes rather obvious to most users that something posted three years ago is highly unlikely to be relevant today, but thank you for your feedback Cheers Howdy, You said the opposite a few months ago. What's changed? 11 hours ago, cli said: This is a valid detection. We've decided to start detecting Process Hacker because it's abused by malware and especially by ransomware. If you added Process Hacker yourself and do not wish to see the detection, please add it to your allow list. Please read Exclude detections in Malwarebytes for Windows if you need assistance on how to add programs to the allow list. Thanks for reporting. How is Process Hacker being abused and why haven't you shared that information with the project developers? https://github.com/processhacker/processhacker/security/policy AV companies should be working with the industry, how are we going to fix security issues when you keep them a secret? Steven PH developer 1 Link to post Share on other sites More sharing options...
MBFan2k20 Posted December 1, 2021 ID:1490766 Share Posted December 1, 2021 Throwing my hat in for info as to the specifics regarding PH's reason for the constant flag... I rely heavily on this prog as it has a constant home in my taskbar! 1 Link to post Share on other sites More sharing options...
Staff pbust Posted December 1, 2021 Staff ID:1490779 Share Posted December 1, 2021 ProcessHacker is used in targeted attacks to companies more lately, used manually, not packaged with mass-malware. It's true it's not malicious, but when abused by malware if becomes riskware. Based on shifts in the threat landscape we sometimes have to change our minds to protect our users against shifts in thread landscape. If attackers switch to using alternatives to ProcessHacker, we might have to evaluate adding some form of detection for those as well. Likewise, if they stop using it, we can also remove the detection in the future. For those of you who use it, which I understand completely as I've used it extensively myself in the past, adding an exclusion for the path where ProcessHacker resides should be fairly straightforward. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 1, 2021 Root Admin ID:1490809 Share Posted December 1, 2021 3 hours ago, dmex said: Howdy, You said the opposite a few months ago. What's changed? No, Nothing has changed for me. I said the following Quote I feel for you and empathize with your journey. On a personal level, I think you make a good program I do like your program. Above I simply said/meant that no one on any website or business site I've seen goes back and edits ancient documents. Link to post Share on other sites More sharing options...
Porthos Posted December 1, 2021 ID:1490826 Share Posted December 1, 2021 Link to post Share on other sites More sharing options...
sp123 Posted December 1, 2021 ID:1490853 Share Posted December 1, 2021 Does anyone know how to exclude all _Riskware.ProcessHacker_ detections, so it launches regardless of location and so malware can't hide in the Process Hacker directory? I don't see that option Link to post Share on other sites More sharing options...
Porthos Posted December 1, 2021 ID:1490872 Share Posted December 1, 2021 1 hour ago, sp123 said: so it launches regardless of location You have to exclude the location wherever it is. 1 Link to post Share on other sites More sharing options...
sp123 Posted December 1, 2021 ID:1490877 Share Posted December 1, 2021 12 minutes ago, Porthos said: You have to exclude the location wherever it is. I understand, it just means that malware can hide in that location. Though who knows if any malware would be that targeted... Link to post Share on other sites More sharing options...
Porthos Posted December 1, 2021 ID:1490879 Share Posted December 1, 2021 (edited) 8 minutes ago, sp123 said: I understand, it just means that malware can hide in that location. Malwarebytes is not just hide in your folder that was created for process hacker. But if it uses the installed version, it can take advantage of it. Edited December 1, 2021 by Porthos Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 2, 2021 Root Admin ID:1490887 Share Posted December 2, 2021 (edited) Download the Portable version. Extract the files to a new folder of your choosing. In my example I created a C:\ProcessHacker folder. Then right-click and select to have Malwarebytes scan the folder It should detect the two executable files as shown below Simply uncheck both detections and click Next Set to Always ignore Those two files will be put into the Allow List and not be detected again on future scans New Scan shows the files are no longer detected And there is the program running without issue now Edited December 2, 2021 by AdvancedSetup Updated information 2 Link to post Share on other sites More sharing options...
sp123 Posted December 2, 2021 ID:1490897 Share Posted December 2, 2021 @AdvancedSetup thanks! Will do. Also, cool Kirk profile pic. @Porthos I think you misunderstood me (probably because some people call Malwarebytes 'Malware'), but thanks for your help anyway, and for donating your time to this Link to post Share on other sites More sharing options...
NEI Posted December 5, 2021 ID:1491505 Share Posted December 5, 2021 The complaint that ProcessHacker is Riskware, in as much as malware can use it to do naughty things, strikes me as disingenuous boardering on a dissembling lie. By that simple definition almost anything on the computer that can shut down a program is RiskWare. Singling our ProcessHacker, as well as not working with the PH authors to mitigate trouble, suggests something more nefarious is afoot and directed specifically at ProcessHacker. Bad form leading to distrust. 1 Link to post Share on other sites More sharing options...
sp123 Posted December 5, 2021 ID:1491534 Share Posted December 5, 2021 Idea: What if MBAM didn't block process-hacker when it is named something like ProcessHacker.exe but blocks it otherwise. It's simple to use a RegExp to test Legit users are unlikely to rename it to something totally random, while attackers aren't just going to leave it as ProcessHacker.exe. Win, win! It would be very simple Link to post Share on other sites More sharing options...
sp123 Posted December 5, 2021 ID:1491535 Share Posted December 5, 2021 Question to someone who works here: How/when can I start being able to edit my comments, because I just ending up having to create a new comment & spam that thread whenever I need to post a correction (which is often) Link to post Share on other sites More sharing options...
Porthos Posted December 5, 2021 ID:1491536 Share Posted December 5, 2021 Just now, sp123 said: How/when can I start being able to edit my comments, A few more posts will get you there. 1 Link to post Share on other sites More sharing options...
sp123 Posted December 5, 2021 ID:1491537 Share Posted December 5, 2021 Edit: I can't even delete my comments and post a new one :( Link to post Share on other sites More sharing options...
sp123 Posted December 5, 2021 ID:1491538 Share Posted December 5, 2021 Thanks, @Porthos. And sorry for my other comment, I posted send right as I saw your comment Link to post Share on other sites More sharing options...
Porthos Posted December 5, 2021 ID:1491539 Share Posted December 5, 2021 1 minute ago, sp123 said: Edit: I can't even delete my comments and post a new one :( The no edit we set in place because of abuse. 1 Link to post Share on other sites More sharing options...
Porthos Posted December 5, 2021 ID:1491540 Share Posted December 5, 2021 (edited) 2 minutes ago, sp123 said: And sorry for my other comment New users also can not edit their profile. Blame the spammers. Edited December 5, 2021 by Porthos 1 Link to post Share on other sites More sharing options...
Recommended Posts