MalwareBytes update with Applocker

[hawks5999]

We have MalwareBytes Anti-Malware installed on our Win7 Enterprise computers and are using Applocker to control what applications can be run. We've made allow rules for mbam to run and it can perform all the functions required except for updating. When trying to run the update we get the following error:

We can't figure what temporary folder and what application is being executed as we have made allow rules that clear %ProgramFiles%\Malwarebytes' Anti-Malware\* and %programdata%\*

Using sysinternals procmon it appears that the only command line being executed is [path to]\mbam.exe with various switches

Does anyone know:

a) what executable besides mbam.exe is run during an update?

b) what is being used for the temporary folder during update?

Thank you.

hawks5999

[Firefox]

Hello and

As a licensed corporate user, technician, reseller, affiliate or non-profit user you have access to the corporate helpdesk, contact them via the email address below.

corporate-support@malwarebytes.org

They will assist you in this matter. Please provide your corporate license information when requesting help.

Please add the domains malwarebytes.org and salesforce.com to any spam filters or junk mail exclusion features in your email client to assure our replies get to you. Thank you

[hawks5999]

Thanks. I should clarify that I'm a 3rd party consultant and not involved with the mbam side of things so much as making Applocker work. I'm uncertain of the licensing in this particular case but will pass along the recommendation to the client regarding support and licensing compliance.

It looks like the .tmp is a renamed msi so I'll see if publisher information is available from that. If this is information that only licensed users should have, feel free to delete this post.

Thanks.

[AdvancedSetup]

Hello hawks5999,

Yes, your customer or client must have corporate licensing which includes an order reference number from Cleverbridge that either you or he can send to us at the posted email address and we will assist you.

I'll go ahead and close this post.

Thank you