MalwareBytes Detects Safe File All the Time.. What to do?

User Help for Mozilla Firefox
Post Reply
User avatar
zlaer
Posts: 505
Joined: June 29th, 2018, 11:11 am

MalwareBytes Detects Safe File All the Time.. What to do?

Post by zlaer »

When i run Malwarebytes it identifies 'pref.js' in the firefox directory as unsafe. I then choose the option to quarantine it even if its a needed and safe file thats part of firefox. When I run Malwarebytes again, it detects it again! Malwarebytes fails to quarantine it, if its supposed to do that. Should I leave this file alone?
User avatar
costark
Posts: 548
Joined: July 14th, 2004, 5:03 am

Re: MalwareBytes Detects Safe File All the Time.. What to do

Post by costark »

In a Mozilla.org Forum a Moderator suggested putting - prefs.js - in the Exclusion module, although for a different issue.
I can't speak to What is Triggering the "unsafe" BUT IF it's a False Positive you can exclude - Prefs.js - from Mbam Scanning per ...............
Settings/ Exclusion tab/ Add Exclusion/ Exclude File-Folder ... and Browse to where the FF Profile is containing - prefs.js -.
Starts w (Win 7/ 10 likely same)-- C:\users\AppData\Roaming\Your name (usually)\ Mozilla\Profile\target Profile\prefs.js

As you probably know ... Mbam Forum ---- https://forums.malwarebytes.com/forum/4 ... ort-forum/

EDIT: https://support.mozilla.org/en-US/questions/994795

The above is a 2014 Thread about Mbam not liking FF and this Forum's (not a surprise) jscher2000 contributed to a Solution. This seems to involve - user.js - and a "you don't want" Babylon Toolbar somehow installed. THAT toolbar was triggering a PUP alert in Mbam, BUT How - prefs.js - is causing anything maybe - jscher2000 / other Experts here - can deduce IF / WHEN he sees this.
W10 22H2 - SSD-HDD i5 12G -
User avatar
zlaer
Posts: 505
Joined: June 29th, 2018, 11:11 am

Re: MalwareBytes Detects Safe File All the Time.. What to do

Post by zlaer »

costark wrote:In a Mozilla.org Forum a Moderator suggested putting - prefs.js - in the Exclusion module, although for a different issue.
I can't speak to What is Triggering the "unsafe" BUT IF it's a False Positive you can exclude - Prefs.js - from Mbam Scanning per ...............
Settings/ Exclusion tab/ Add Exclusion/ Exclude File-Folder ... and Browse to where the FF Profile is containing - prefs.js -.
Starts w (Win 7/ 10 likely same)-- C:\users\AppData\Roaming\Your name (usually)\ Mozilla\Profile\target Profile\prefs.js

As you probably know ... Mbam Forum ---- https://forums.malwarebytes.com/forum/4 ... ort-forum/

EDIT: https://support.mozilla.org/en-US/questions/994795

The above is a 2014 Thread about Mbam not liking FF and this Forum's (not a surprise) jscher2000 contributed to a Solution. This seems to involve - user.js - and a "you don't want" Babylon Toolbar somehow installed. THAT toolbar was triggering a PUP alert in Mbam, BUT How - prefs.js - is causing anything maybe - jscher2000 / other Experts here - can deduce IF / WHEN he sees this.
Looking into your info and links. Thanks.
Brummelchen
Posts: 4480
Joined: March 19th, 2005, 10:51 am

Re: MalwareBytes Detects Safe File All the Time.. What to do

Post by Brummelchen »

malwarebytes software can read content of prefs file and if found a malicious value the whole file is flagged. the logfile should explain which one.

btw which software of malwarebytes is concerned? adwcleaner oder mbam?
User avatar
therube
Posts: 21703
Joined: March 10th, 2004, 9:59 pm
Location: Maryland USA

Re: MalwareBytes Detects Safe File All the Time.. What to do

Post by therube »

That's particularly odd, I would think?
Given that in Quantum, extension prefs are not stored in prefs.js, so all that should be there would be "mozilla" prefs.
So, wondering what it is not liking?
Fire 750, bring back 250.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript
User avatar
makaiguy
Posts: 16878
Joined: November 18th, 2002, 6:44 pm
Location: Somewhere in SE USA
Contact:

Re: MalwareBytes Detects Safe File All the Time.. What to do

Post by makaiguy »

MalwareBytes Detects Safe File All the Time.. What to do?
Well, the FIRST thing I'd do is edit the first post and change the title to indicate an UNsafe file is being detected. :-"
Doug Wilson
Win10 64bit: FF 115.0.02 64bit, TB 102.12.0 32-bit ║ Android 13/10: FF 115.2.0/115.0.1 ║ No TB for Android available, dammit!
What a fool believes he sees, no wise man has the power to reason away - Doobie Brothers
User avatar
jscher2000
Posts: 11742
Joined: December 19th, 2004, 12:26 am
Location: Silicon Valley, CA USA
Contact:

Re: MalwareBytes Detects Safe File All the Time.. What to do

Post by jscher2000 »

Are you getting PUP.Conduit in the report about the file? That came up in another thread. I don't know what in the file was being detected. Possibly there is a reference to a sketchy extension in the preference that stores toolbar button information?
User avatar
zlaer
Posts: 505
Joined: June 29th, 2018, 11:11 am

Re: MalwareBytes Detects Safe File All the Time.. What to do

Post by zlaer »

jscher2000 wrote:Are you getting PUP.Conduit in the report about the file? That came up in another thread. I don't know what in the file was being detected. Possibly there is a reference to a sketchy extension in the preference that stores toolbar button information?
I just ended up reinstalling ff. Thanks anyway.
Post Reply