Please Whitelist our signature

[NSchwartz]

Dear Malware Bytes Team,

We are a small company located in France providing cloud data storage and we are experiencing AV blocking of our sync software (WinPE32) with our Malwarebytes clients (Installer is corrupted after extraction as the AV removes files). We already got this issue with Avast users but none with Windows Defender nor Norton.

Could you white-list our signature ?

Here is a link for download of the installer https://fdrive.fenritec.fr/link/66e19e16-1f6c-4e2c-8967-29058ac38b57 ("Télécharger" means Download)

Thanks in advance,

Best regards,

[miekiemoes]

Hi,

I can't reproduce detection on the above file, so can you provide the detection report where we display this as detected?

As a sidenote, preventive whitelisting by signature only is often being abused as you can read here: https://www.nascus.org/2022/08/04/wolf-in-sheeps-clothing-how-malware-tricks-users-and-antivirus/ - that's why we prefer other whitelisting approaches instead of a signature whitelist only. But given above file isn't detected, there's no need to whitelist either.

[NSchwartz]

"Preventive whitelisting by signature only is often being abused as you can read here" : I totally agree with this, I'm an ancient Pentester / Cyber security consultant.

The issue is that the client has 2 AVs and does not provide me with enough info here, one is Bullgard and the other is Malwarebyte. Which is of course a bad habit as conflicts can occur within kernel modules.

Could you just confirm that no blocking is raised during the installer extraction ? What I have for now is that he needs to accept the exe within the browser (Malwarebyte popup which is normal) and after has to pass Windows Smart screen (also normal). The issue occurs during the extraction process.

I have already submitted all my releases to Virus total to avoid such scenarios but it always occurs ...

Thanks in advance,

[miekiemoes]

Hi,

Yes, I verified the file while installing as well and Malwarebytes didn't block anything. :)