Malwarebytes blocking app access due to Malware.ai detection

Support
1

What issue or error are you experiencing?

Malwarebytes suddenly started quarantining a temporary file that gets generated when the Local app starts up. This just started today (5/24/2024), even with the latest version of the Local app on Windows 11. It blocks the app from running entirely.

The message from Malwarebytes looks similar to this:

  • Blocked Malware Details-
  • Malware.AI.3744253770, C:\Users******\AppData\Local\Temp\bc9b065b-d94c-4207-bfe6-83a4bb863b20.tmp.node

I’m guessing this is a new detection method Malwarebytes is using? I don’t really know. It was working fine yesterday with Malwarebytes running.

The document Malwarebytes links to about this detection method is located here:
Malware.AI | Malwarebytes Labs

What steps can be taken to replicate the issue? Feel free to include screenshots, videos, etc

If anyone runs the Local app and uses Malwarebytes on Windows or Mac, I’d be interested to know if you’re having this issue. I can still run the app if I close Malwarebytes first, but I don’t think I should have to.

System Details

AMD Ryzen 7 7800X3D, 64GB RAM,

  • Local Version:
    Local v9.0.3+6684
  • Operating System (OS) and OS version:
    OS: Windows 11 Home v23H2, OS Build 22631.3593

Local Logs

local-lightning.log (96.6 KB)
local-lightning-verbose.log (304.4 KB)

Security Reminder
Local does a pretty good job of scrubbing private info from the logs and the errors it produces, however there’s always the possibility that something private can come through. Because these are public forums, always review the screenshots you are sharing to make sure there isn’t private info like passwords being displayed.

2

Hi @Haugendaus

Does Malwarebytes have any way to “allow” or “ignore” a certain app or file?

If you downgrade your Local app does this still happen?

3

Hi @Nick-B

I looked for a way to allow the file, but Malwarebytes, for this case anyway, doesn’t have that option. However, even if it did have a way to allow the file, that file would have a different file name next time I ran Local, since it’s a temporary file. Every time I run the app, the file that’s quarantined has a new generated file name. I didn’t see a way to ignore the app in Malwarebytes either, unfortunately.

As for downgrading the app, I was running the previous version of Local, which was running fine alongside Malwarebytes as of yesterday. I only upgraded the app to the latest version today, after I started having this issue with Malwarebytes.

Hope that helps!

4

Checking in the forums I can see that users have reported some issues with Malwarebytes in the past. Some have even had success in reporting false positives:

5

Yep, I saw that post. I’ll see if there is anything else I can do in Malwarebytes to get past this. If I just quite Malwarebytes, I can run Local just fine, then restart Malwarebytes without issues.

6

Okay thank you for the details here. I’m not sure how we can influence this from our end but if issues persist or change keep us posted and we’ll be happy to continue investigating.

7

It does seem like an issue with Malwarebytes, but thanks for your feedback!

I’ll post any updates if/when they happen.

Thanks!

1 Like
8

Anytime @Haugendaus! If you have any other questions or concerns don’t hesitate to reach back out. We are always happy to help!

9

Well, one final follow-up (I think): I found where in Malwarebytes to allow both the Local app and the Local/Temp/ folder where the .tmp file is saved and was getting flagged. Seems to let me get past the quarantine at least.

For my case, the folder to exempt is located at:
"C:\Users\username\AppData\Local\Temp"

Thanks again!

1 Like
10

Awesome! Thank you for sharing that. It might help other users running into the same.

11

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.