[ RESOLVED ] Malware and PUP PROTECTION Does not allow me to eject my USB after Run .exe

[juantho]

Does not allow me to eject my USB after editing files on USB or after running .exe files via USB
I'm a million percent sure that my USB without viruses is brand new and clean after a scan of some antivirus and malware

---

There is certainly no virus

---

But I'm running .exe files that are on the USB
And when I finish my work on the USB I can not safely eject the USB

After a thorough examination I found that Malwarebytes does something in the background and does not allow me to eject safely And I found that "Malware and PUP PROTECTION" is the problem that does not allow me to eject safely...
Now this is a problem because on the one hand I want files on USB not to be accidentally destroyed because they are very important to me And on the other hand it is very, very important to me protection from virus and spyware and adware and more and more

I am in a situation dilemma

Is there any way to get Malwarebytes not to mess with the files in USB I would love to get an answer

 

 

 

---

*In case there is no way to solve it as a customer, I would like developers to do something about this problem*

---

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

• For use when you are on the forums and need to provide logs for assistance
• For use when you don't need or want to create a ticket with Malwarebytes
• For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler

1. Download Malwarebytes Support Tool
2. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
3. Place a checkmark next to Accept License Agreement and click Next
4. Navigate to the Advanced tab
5. The Advanced menu page contains four categories:
   • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
   • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
   •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
   • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
6. To provide logs for review click the Gather Logs button
7. Upon completion, click OK
8. A file named mbst-grab-results.zip will be saved to your Desktop
9. Please attach the file in your next reply.
10. To uninstall all Malwarebytes Products, click the Clean button.
11. Click the Yes button to proceed. 
12. Save all your work and click OK when you are ready to reboot.
13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
14. Select Yes to install Malwarebytes.
15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler

 

 

 

 

Spoiler

 

 

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[lmacri]

Hi juantho:

Thanks for posting about this.  I've repeatedly been unable to safely eject my removable USB thumb drive in the past week or so,  and couldn't figure out what running process was causing the problem.

I believe the problem started about the same time I updated to Malwarebytes Premium v4.5.9.198-1.0.1676 (rel. 05-May-2022) or after my Component Package updated to v1.0.1689 (rel. 26-May-2022).  Note that Windows Update installed my May 2022 Patch Tuesday updates on 13-May-2022 (I also receive a daily update for my Microsoft Defender virus definitions on a daily basis) and my Malwarebytes Browser Guard for Firefox add-on updated to v2.4.2 on 25-May-2022.  I have several portable apps on that USB thumb drive and it seems the problem is only triggered when I run certain apps (e.g., the SUMo.exe for SUMo Free Portable v5.15.0). If I recall correctly, other portable apps like CCleaner Free Portable v5.92 (??) don't trigger this problem. I don't know if it's relevant but SUMo is one of my portable apps that automatically checks for a newer program version at launch.

I tested today by launching SUMo Portable v5.15.0 from my removable USB thumb drive and was unable to eject my USB after I closed SUMo.

 

When I quit Malwarebytes real-time protection from the system tray icon I still couldn't eject the USB.  However, if I prevent Malwarebytes from starting with Windows (Settings | Security | Windows Startup | Launch Malwarebytes in the Background When Windows Starts Up | OFF) then I have no problems running SUMo from my removable USB and ejecting the USB once SUMo is closed.

The attached diagnostic logs were collected with Malwarebytes Premium running and the USB still inserted (i.e., after I was unable to eject).

mbst-grab-results.zip

-----------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.0 * Microsoft Defender v4.18.2203.5-1.1.19200.5 * Malwarebytes Premium v4.5.9.198-1.0.1689 * Macrium Reflect Free v8.0.6758 * CCleaner Free Portable v5.92.9652 * SUMo Free Portable v5.15.0.522 * Malwarebytes Browser Guard for Firefox v2.4.2
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited June 4, 2022 by lmacri

[lmacri]

On 6/4/2022 at 10:31 AM, lmacri said:

...I've repeatedly been unable to safely eject my removable USB thumb drive in the past week or so,  and couldn't figure out what running process was causing the problem.

I believe the problem started about the same time I updated to Malwarebytes Premium v4.5.9.198-1.0.1676 (rel. 05-May-2022) or after my Component Package updated to v1.0.1689 (rel. 26-May-2022) ...

Further to my 04-Jun-2022 post <above> I could hear my cooling fan running while my computer was supposedly in sleep mode yesterday, and when I pressed a key on my keypad to bring my system out of sleep mode it took several seconds for the lock screen to appear.  I noticed there were multiple errors in the past week related to UsbUpdate.exe (Source = Application Error; EventID =1000; Faulting Application Path = C:\WINDOWS\TEMP\inv3253_tmp\Executables\UsbUpdate.exe).  This error first appeared in my Event Viewer on 27-May-2022, which is the day after I updated to Component Package v1.0.1689 and about the same time I noticed I was having problems ejecting my removable USB thumb drive after running a portable app.  Note my Win 10 settings at Settings | Devices | AutoPlay (which is ON) | Choose AutoPlay Defaults | Removable Drive  is set to "Open Folder to View Files (File Explorer)".

I've also had several errors related to Microsoft Defender in the past week [Source = Service Control Manager; Event ID = 7011; Description: A timeout (60000 milliseconds) was reached while waiting for a transaction response from the WinDefend service] but these WinDefend service errors started before my Malwarebytes Component Package updated to v1.0.1689 so I don't think it has anything to do with my USB ejection problem.   However, they could still be related to Malwarebytes and/or my problem yesterday bringing my system out of sleep mode. Note that Settings | Security | Windows Security Center | Always Register Malwarebytes in the Windows Security Center is turned OFF in Malwarebytes and I've created mutual scan exclusions in both Malwarebytes and Microsoft Defender.

Details for sample UsbUpdate.exe Application Error Event ID 1000 and MS Defender Service Control Manager Event ID 7011 errors are attached.

Win 10 Pro v21H2 Event Viewer UsbUpdate_exe Application Error Event ID 1000 05 Jun 2022.txt

Win 10 Pro v21H2 Event Viewer WinDefend Service Control Manager Event ID 7011 06 Jun 2022.txt

-----------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.0 * Microsoft Defender v4.18.2203.5-1.1.19200.5 * Malwarebytes Premium v4.5.9.198-1.0.1689 * Macrium Reflect Free v8.0.6758 * Malwarebytes Browser Guard for Firefox v2.4.2
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

Edited June 7, 2022 by lmacri

[AdvancedSetup]

I don't have this USB file issue on my system but I do see that many Dell customers do.

https://www.dell.com/community/Inspiron-Desktops/Inspiron-3891-Event-Viewer-error-Usbupdate-exe-fails/m-p/8209472/highlight/true#M34040

 

[lmacri]

17 minutes ago, AdvancedSetup said:

I don't have this USB file issue on my system but I do see that many Dell customers do.

https://www.dell.com/community/Inspiron-Desktops/Inspiron-3891-Event-Viewer-error-Usbupdate-exe-fails/m-p/8209472/highlight/true#M34040

 

Hi AdvancedSetup:

Thanks for that link.  That's Dell thread is quite long so it will take a bit of time to read all 12 pages but I'll see if I can find any relevant information.

In the mean time I repeated my test of 04-Jun-2021 and can confirm that I have no problem ejecting my USB thumb drive after I run SUMo v5.15.1 and a few other portable apps as long as I  prevent Malwarebytes from loading at boot-up (Settings | Security | Windows Startup | Launch Malwarebytes in the Background When Windows Starts Up | OFF).

Assuming this problem is unique to Dell computers, could there be some sort of conflict between my Malwarebytes realtime protection and my Dell software/firmware?
-----------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.0 * Microsoft Defender v4.18.2203.5-1.1.19200.5 * Malwarebytes Premium v4.5.9.198-1.0.1689 * Macrium Reflect Free v8.0.6758 * Malwarebytes Browser Guard for Firefox v2.4.2 * Inspiron 5583/5584 BIOS v1.18.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

[AdvancedSetup]

Yes, I'm still testing but it does look like something is going on there with the USB. Oddly I can eject from Disk Management or DISKPART but not via Safe Eject. But not sure why yet as nothing is shown holding a handle to the device.

I will probably have to submit a ticket and have our QA team look into it as I don't have unlimited time to work on this

 

[lmacri]

1 hour ago, AdvancedSetup said:

Yes, I'm still testing but it does look like something is going on there with the USB. Oddly I can eject from Disk Management or DISKPART but not via Safe Eject. But not sure why yet as nothing is shown holding a handle to the device.

I will probably have to submit a ticket and have our QA team look into it as I don't have unlimited time to work on this

Hi AdvancedSetup:

Thanks, after reading your last reply I submitted my own support ticket from my Malwarebytes Account, and in the mean time I've posted in the Dell thread Inspiron 3891, Event Viewer error - Usbupdate.exe fails to see if I can find any connection between the UsbUpdate.exe errors in my Event Viewer and my problem ejecting my USB thumb drive after I run a portable app.
-----------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.0 * Microsoft Defender v4.18.2203.5-1.1.19200.5 * Malwarebytes Premium v4.5.9.198-1.0.1689 * Macrium Reflect Free v8.0.6758 * Malwarebytes Browser Guard for Firefox v2.4.2 * Inspiron 5583/5584 BIOS v1.18.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

[AdvancedSetup]

I could be wrong but I think that may be a red herring adding Malwarebytes to the USB driver update in the Event Logs. I'm not running a Dell and I don't have that Event Error but I can duplicate  your issue with ejecting a USB drive after running a program from it.

 

 

[Ried]

Locking this topic for now while we work via Helpdesk ticket

[Porthos]

Closing this topic as it's been resolved.

 

[AdvancedSetup]

https://forums.malwarebytes.com/topic/281762-malwarebytes-45/?do=findComment&comment=1522874

Some Issues now addressed:

• Fixed: Windows MB4 Consumer hindering Safely Eject USB