False flagged and quarantined file not shown in detected list...

[Btmacdou]

I had a file incorrectly flagged as malware and placed into quarantine but NOT SHOWN IN THE DETECTED LIST.  As a result, I had to spend WAY too much time fussing around to find the path to the file, and copy it into the allow list file search.

• Why don't quarantined items (files) show up in the "detected" list even while they are still in quarantine??
  • Very aggravating.
• Why is there no way to directly restore and move a quarantined item into the "Allow list" with a single button, rather than being forced to restore it and then browse for the file and add it manually?
  • If the file had shown up in the detected list, it would have been easy.
  • For cryptic files buried deep in the local drive, this is a pain to do....

What should have taken me 1 minute as soon as the file was flagged into quarantine ended up taking 40 minutes of frustration PLUS the time it took to create an account and write this post...

Arghh....

 

[Porthos]

22 minutes ago, Btmacdou said:

Why don't quarantined items (files) show up in the "detected" list even while they are still in quarantine??

Did you restart the computer before checking the quarantine? It would help to know the detected file name location.

You click here to see the detection history

Edited February 13 by Porthos

[Btmacdou]

I did not restart my PC, why would I?  The app showed my the file in quarantine.  And I noticed the issue when my program would not open it's settings window.

And when I switched to the allow list dialog and tried to add a detected item, there were none, even though the file was in quarantine... ?

[Porthos]

Let's see the detection log.

You can find Scan and Protection logs within the Malwarebytes 4 program in the following location

 

 

RTP stands for Real-Time Protection and is where automatic protection operations would normally be logged

 

 

If you click on the View option you should get something similar to the following with other options available.

 

 

 

 

Thank you

[Btmacdou]

1 hour ago, Porthos said:

Let's see the detection log.

You can find Scan and Protection logs within the Malwarebytes 4 program in the following location

Porthos,

Here is the last detection from the history log:

And here is the list of all the detections I was getting because I had to keep restoring the file multiple times until I figured out how to add it to the white list.  

Note:  My text in the screenshot below suggests to allow adding to the allow list "from here", but i took the screenshot from the history window. What I meant was that it should be possible to do from the quarantined items window....

But despite all of these, these detections never showed up as a selectable detection when I use the "add to allow list" button....

The only way to get the file on the allow list was to manually select it by browsing deep into the programs folder of my computer.

My point is that there should be a way to add a file to the allow list while I'm looking at it in the quarantine window.  A check box next to the file name combined with an "add to allow lists" button in the in the quarantine window would be (by far) the fastest, easiest and most intuitive way to do this!

Maybe something is wrong with my installation.  But to confirm again that I'm seeing it right, i'd have to remove the file from the allow list and then try to run it.  

I find it hard to believe that this is the normal process?

Btmacdou

 

[Porthos]

3 minutes ago, Btmacdou said:

it should be possible to do from the quarantined items window....

No, it is not. You have to un-quarantine it and then add it manually to the allow list.

 

5 minutes ago, Btmacdou said:

The only way to get the file on the allow list was to manually select it by browsing deep into the programs folder of my computer.

That is correct.

6 minutes ago, Btmacdou said:

My point is that there should be a way to add a file to the allow list while I'm looking at it in the quarantine window.  A check box next to the file name combined with an "add to allow lists" button in the in the quarantine window would be (by far) the fastest, easiest and most intuitive way to do this!

It has never worked that way.

Also looking at your screenshot, please read the following about that type of detection. Especially the last section False Positives.

 

[Btmacdou]

21 minutes ago, Porthos said:

No, it is not. You have to un-quarantine it and then add it manually to the allow list.

That is correct.

It has never worked that way.

Also looking at your screenshot, please read the following about that type of detection. Especially the last section False Positives.

Just because it's never worked that way does not suggest that it is the best way....

I see no reason why I should be required to switch to a different screen and manually search for a file that the software already knows about and knows where it is... that's just a waste of time!

[Btmacdou]

27 minutes ago, Porthos said:

Also looking at your screenshot, please read the following about that type of detection. Especially the last section False Positives.

Porthos,

 I read the link you added and it does not help much.  The software I am using is written by amateur radio enthusiast and is trusted by that community.  They are not professional developers nor do they sell their software.  

so it's up to me to decide whether to allow a file.  I don't fault Malwarebytes for flagging it, I'm just critical of the clunky way they handle these....

 

[Btmacdou]

PS:  Is there a way to edit my previous posts to correct spelling and other errors?  I don't see an edit button....

[Porthos]

28 minutes ago, Btmacdou said:

PS:  Is there a way to edit my previous posts to correct spelling and other errors?  I don't see an edit button....

Sorry, you have to have an undisclosed number of posts. This is because of the spammers who used to post and come back much later to edit and add their spam links. Also why profile editing is restricted as well.

[Btmacdou]

18 minutes ago, Porthos said:

Sorry, you have to have an undisclosed number of posts. This is because of the spammers who used to post and come back much later to edit and add their spam links. Also why profile editing is restricted as well.

I guess that makes sense.  We all suffer because of the spammers....