esptool_py from the ESP32 Arduino toolset being blocked

[yorrrick]

I've discovered that MalwareBytes is blocking the esptool.exe executable that uploads code to ESP32 microcontrollers over a COM port.

I'm getting an Access is denied error and if I look at the activity on my COM port using the app from

https://serial-port-monitor.org 

I can see MBAM is interfering.

If I turn off Ransomware Protection it all works as expected.

I've tried adding an exception in MBAM for esptool.exe and for its parent folder but that doesn't seem to have any effect.

Edited January 20, 2022 by AdvancedSetup
Disabled live hyperlink

[Porthos]

1 hour ago, yorrrick said:

I can see MBAM is interfering.

Does it cause an actual block notice? If so the log would be helpful.

You can find Scan and Protection logs within the Malwarebytes 4 program in the following location

 

 

RTP stands for Real-Time Protection and is where automatic protection operations would normally be logged

 

 

If you click on the View option you should get something similar to the following with other options available.

 

 

 

 

Thank you

[yorrrick]

No. There's nothing in the MBAM log.

However, here are two logs from the Serial Port Monitor tool showing the activity on COM5 when I try to run esptool.exe with MBAM Ransomware Protection switched off and then with it switched on.

In the first trace esptool gains control of COM5 and goes about its business. 

In the second trace MBAMService.exe appears to be repeatedly accessing COM5 instead of esptool.exe.  It does this about 30 times a second for the couple of seconds before esptool gives up and throws an access denied exception.

There is no activity on COM5 before I start esptool running.

For simplicity while exploring this issue I've been executing esptool from a CMD window as:

C:\Users\xxx\AppData\Local\Arduino15\packages\esp32\tools\esptool_py\3.0.0>

esptool --port COM5 read_mac

Normally esptool is executed from the Arduino IDE tool chain at the point executable code needs to be uploaded into the ESP32.

 

[Scott14468]

I too am having this same problem.  I don't think I can add any technical details to the discussion.  Disabling Ransomware protection allows Arduino to access the serial port properly.  When enabled, access to the serial port is denied.

Any word on when this problem will be addressed?

Thanks,

Scott

 

[JimDrew]

Yep, me too... this has been driving me nuts since earlier this month.  This never use to be a problem until the last (recent) upgrade to Malwarebytes.

I can confirm that you can't set any type of allow for the file specifically or the entire path.  In fact, using Malwarebytes has always been a problem with the speed at which the Arduino IDE compiles.  I have tried adding entire folders to the allow list and it makes no real difference in compile speed.  If I physically quite Malwarebytes then the compile speed is normal. But right now, unless you quit or at least turn off the randsomware protection you can't send anything to an Arduino board using the esptool, regardless of what is using the esptool Arduino IDE, PlatformIO, etc.

I am hoping you can reverse whatever change that you made between upgrades to fix this problem and maybe fix the issue with slow compiles.

Thanks!

 

[tetonbob]

Hi all. This issue is not exactly a False Positive, so I've moved it to the more general Malwarebytes Support area.
This issue seems similar to another issue reported, which we have a fix for, but due to many circumstances, it's yet to be delivered in MBAM.

If someone in this thread would like to work with me on verifying if the fix we have also addresses this issue, let me know. We believe it should.

[Scott14468]

I can work with you.

 

Scott

 

[tetonbob]

Thanks, Scott. Please see your Private Messages.

[tetonbob]

Thanks, Scott! Working with Scott, we have confirmed that the fix we have will also address this issue. We ask for your patience while waiting for this fix to make it into a release build of Malwarebytes Premium.

[yorrrick]

Thanks Scott. I missed this exchange...

[yorrrick]

Hi @tetonbob

Glad you've found a fix. It would be interesting to know what the problem was if you can share that without divulging sensitive IP. 

Regards 

Jon

[tetonbob]

Hi Jon. @yorrrick

Thank you for your original report and your interest. Unfortunately, we are unable to share that information.

 

[yorrrick]

Any idea when the fix might be released? 

[AdvancedSetup]

Please note that we're actively working on getting a fix to release but having a tested and verified release takes time.

Once a release has been made we will reply to this topic to let those affected know.

Thank you for your patience

 

 

[andyn_ff]

Hi,

Is there any update on this?

[tetonbob]

Hi @andyn_ff and all. I know this is taking longer than any of us wanted to get the fix into a release build of MBAM, and for that I do apologize. Certain other issues have come up which required our immediate attention and have delayed the integration into MBAM of the ArwSDK (Anti-Ransomware component) which contains this fix. At this time, we unfortunately cannot provide an ETA. We ask for your continued patience.
Thank you.

Edited March 17, 2022 by tetonbob

[tetonbob]

Greetings all. I know it's been a long time since this issue was first reported. It's just taken a while to be able to finally include the fix into an MBAM release.
This fix is now available in our latest MBAM Beta build.

See Erix' post here:
https://forums.malwarebytes.com/topic/281280-malwarebytes-45-beta/#comment-1513438

[tetonbob]

The build with a fix for this issue is now released into general availability. See Erix' post:

 

[yorrrick]

Thanks