Malwarebytes Anti-Malware free version Finds this log on every scan though it has informed as quarantined on each occasion?

Hi ky 331,

I think what you've said is happening.

However on my first scan (Malwarebytes Anti-Malware) I did not do with the administrator's right and after posting my question in here I went ahead to do a second scan (Malwarebytes Anti Malware) as Administrator and noted the above observation.

Now on my third scan it has not found the same....

Regards

Snow,

As I posted elsewhere (in the CryptoPrevent thread), version 6.x introduced a new FILTER MODULE which runs in real time:

"if you have the Filter Module enabled in v6 and above, your anti-malware software may report several false positives related to CryptoPrevent’s [restriction of policy] settings."

Specifically, these registry keys may be detected as ‘modified‘ or ‘hijacked‘, and the value data will point to the CryptoPreventFilterMod.exe file in your installation directory.

• scrfile\shell\open\command    <==================  
  
• cplfile\shell\open\command
• piffile\shell\open\command     <==================  
  

If using the experimental EXE/COM filter, you can also expect to see these keys:

• exefile\shell\open\command
• comfile\shell\open\command

And any key above may also have “runas” where “open” is, and affected values may include “(Default)” and “IsolatedCommand”

If these fit the category of your anti-malware detection, then they are definitely CryptoPrevent’s settings, and it is safe to tell your anti-malware software to ignore them and/or whitelist them.

--------------------

So the two entries that MBAM found are definitely consistent with the information above... see the two lines where I have placed the long arrows  <==============

-------------------

I did not enable the real-time FILTER MODULE.   Let me see if I can run some more tests, to clarify this definitively...

Hello ky331,

Thank you for your time and effort in verifying your initial suspicion.

1) Having established that these are indeed generated by CryptoPrevent, you can heed its author's advice, and safely tell MBAM to ignore these (as being F/P's).    This will allow CryptoPrevent's FILTER module to continue its real-time scanning.   [You probably will also have to remove the entries from MBAM's quarantine, placing them back (restoring them) in your registry].

I would wish for choice one:

I got the know how on how to remove the entries from MBAM's quarantine, placing them back (restoring them) in my registry.

However how do I tell MBAM to ignore these? Is this possible in the Free version of the MBAM?

I do see in MBAM->Settings-> Malware Exclusions->"Add files and folders which will be excluded from detection as malware. All sub files and folders will also be excluded for each folder added. Here I have choices for Add File Add Folder Remove.

I do not know how to locate the file or folder though!1:emotion-6:

Regards

Good observation (looking under Malware Exclusions) :emotion-1: , and good question... the problem is that you want to exclude Registry Entries [which are neither "files" nor "folders"].

As I understand things, you've successfully restored the two entries back into your registry.

Run the scan again.   When the results appear, the default ACTION suggested is [probably] to quarantine.   Instead, use the drop-down ACTION menu to select ADD EXCLUSION.   Then click on APPLY ACTIONS.

If you then look under Settings, Malware Exclusions (as you surmised), you should now see the entries listed there.   Which means that they should no longer be detected in future scans.

Same story here. Once I saw the results of the hyper scan, I cancelled out without doing anything, and came directly here. I then ran the scan again and let it add the exclusions for the two items per David's suggestion and ran the scan again, which was normal.

Thank you-That has done the trick.

Regards