Browser Guard not staying active!

[Lucky_Luxy]

Hi,

I recently installed the Malwarebytes Premium Trial for my iMac. I also saw there was the separate Safari extension called 'Browser Guard' so I thought I would install that as well. 

I've had no issues so far with the main Malwarebytes app, but the Browser Guard is terrible! The installation process was poor, I wasn't sure what to allow and what not to and once it was installed, when I click Browser Guard update button, it just updates continuously until I close the window and reopen it, so that doesn't seem to work. But the main issue is that the Guard won't stay on. I click the toggle for it to be on, all the other toggles remain off for some reason, but if I leave the window and go back, the Guard main switch is off again! What is going on with this extension and how do I get it to work? 

I'm using the very latest macOS version on a 2020 27" iMac. 

I've currently uninstalled Browser Guard extension, as it useless, if anyone can shed some light on it, I'll reinstall and try again. Thank you for your help.

[tomi30]

Hi @Lucky_Luxy
Sorry you had this issue, to help troubleshoot this, can you please send us the contents of this folder on your device.
/Users/<your_user_name>/Library/Group Containers/GVZRY6KDKR.group.com.malwarebytes.browserguard

[Lucky_Luxy]

Hi @tomi30

I have tried to remove the extension and reinstall it. On the 3rd attempt, it now seems to work! If you still want to see any data, let me know, but it works now. Thank you for your reply though, I appreciate it!

[tomi30]

Hi @Lucky_Luxy 
I'm glad it works now!
But I'll appreciate it if you could still send us the contents of that folder, this could help us figure out what went wrong.

Thanks!

[Lucky_Luxy]

Hi @tomi30,

I could not find the folder you mentioned. I looked in the Finder app and found Users/my name/ but couldn't see library.

[tomi30]

Hi @Lucky_Luxy 

You can access it by

1. opening the Finder app

2. Press Command + Shift + G to open a search bar

3. Type in ~/Library/Group Containers/GVZRY6KDKR.group.com.malwarebytes.browserguard

 

Thanks

[Lucky_Luxy]

Ok @tomi30, I have done that. What appears are 3 documents and 2 folders. The folders are called Library and BlockListAssets

[tomi30]

@Lucky_Luxy

Awesome, that's the one!

Could you please send the BlockListAssets and browserguard_db.sqlite.
You could zip them up before you send them.

Thank you
 

[Lucky_Luxy]

@tomi30

I've only just recently come back to using a Mac after many years, so I'm unfamiliar with how to do these things on this OS. How do I do that exactly?

[tomi30]

1. Select the two items by holding Command and clicking on each one

2. Right click on any of the selected Items and in the popup menu that appears, select Compress

I've attached an example video recording 

 

 

[Lucky_Luxy]

Thanks for the details. The example video recording wouldn't play though. 

[tomi30]

Sorry about that, 
Try this video

 

 

[David H. Lipman]

Likewise.  Video 1, unsupported video format and won't render.
Video 2, plays with no problem.  Danke.

[Lucky_Luxy]

Here is the zip file you wanted. 

Archive.zip

[tomi30]

Thanks a lot! @Lucky_Luxy

[Lucky_Luxy]

No problem @tomi30

I assume it's safe to just delete the archive.zip that was created in the finder? 

Also, just out of curiosity, does Malwarebytes search for viruses or just malware? Or is it the same thing nowadays?

[tomi30]

Yeah, you can delete the archive.zip file.

Viruses are a kind of malware (types of malware include viruses, worms, PUPs, and trojans).
Malwarebytes blocks any type of malware.

Hope this helps.

 

[Lucky_Luxy]

Thanks @tomi30 Anyway, I hope my zip file helps!

[David H. Lipman]

Malware is the top level taxonomy of malicious software.

Malware consists of mainly three sub-types;  Viruses, Trojans and Exploit code.

Where...

• Viruses are malicious code that is able to self replicate.  That is the code is able to spread autonomously.  Such as file to file and computer to computer.
• Trojans are malicious code that need assistance to spread.
• Exploit code is malicious code that takes advantage of a software code error or bug or takes advantage of a software in an unexpected or unusual way.

Malwarebytes's products are compartmentalized.  That is different products, for the most part, act in a particular fashion and don't overlap with others.  For example the Android, MAC and Windows anti malware products target only the malware of that OS and they don't share databases.  Thus Malwarebytes Anti-Malware (MBAM) for Windows won't detect a MAC or Android related malware. 

Today viruses are highly marginalized and not seen very often.  The vast majority of malware seen Today are trojans.  There are forms of malware that may combine other types of malware.  For example a Data Stealing trojan can be infected with a virus.  Thus the payload would be a PC infected with the virus and data being stolen.  Another example may be a virus that uses exploit code to infect a PC.  Such as the Lovsan Blaster worm that exploits a bug in the Windows RPC function in Windows via TCP Port 445 and uses a "Buffer Overflow with an elevation of privileges" to infect the PC.  Once infected, the infected PC seeks out other vulnerable PCs and will exploit the bug and infect them and thus spread the Lovsan/Blaster worm.  Because of this activity the Lovsan/Blaster Worm is classed as a virus.  Since it uses Networking Protocols to spread, it is sub-classed as a Internet Worm as part of its taxonomy.  Thus a Worm is a type of virus and is a type of malware.

Malwarebytes Browser Guard does not act the same as the OS based MBAM Web Protection while they may share some constructs.  For example MBAM may block a site and/or URL that is related to an Apple FakeAlert but only if that site has been added to MBAM to block.  On the other hand because Malwarebytes Browser Guard is a Browser Add-On/Plug-In it will dynamically examine the code activity of a web site and then block it.

Below is an example of an Apple FakeAlert

 

 

 

 

Edited October 25, 2022 by David H. Lipman
Edited for content, clarity, spelling and/or grammar

[Lucky_Luxy]

Wow, thanks for the detailed explanation @David H. Lipman !!! Much appreciated!

[David H. Lipman]

 

[Chas4]

@tomi30 Having a similar issue, right now scam blocker will not load, malware started to load again after I deleted the extension app and redownloaded it from the App Store.  I have the files you mentioned above and I can send them to you in a DM, might also explain what is happening here