[SOLVED] GOG client [Foxit Reader.tmp blocked]

[OliPicard]

Hi Malwarebytes,

 

Just wanted to give a quick heads up, I'm currently using a client from gog.com, The client bundles in foxit reader and upon installation of the game, the temp file foxitreader.tmp is blocked by MAE.

 

Once a game has been downloaded using the client, the foxitreader.tmp file is executed however MAE blocks the file believing that it's malware.

 

{WinDrive}:\Users\{user}\AppData\Local\temp\is-7O2RL.tmp\Foxitreader.tmp

 

{WinDrive}:\Users\{user}\AppData\Local\temp\is-BHS5U.tmp\Foxitreader.tmp

 

{WinDrive}:\Users\{user}\AppData\Local\temp\is-IRBBV.tmp\Foxitreader.tmp

 

"Foxitreader.tmp has been blocked from executing though foxit reader."

 

Just to say that this isn't malware and hopefully can be sorted out in the next update?

 

Thanks

Oliver

[pbust]

https://forums.malwarebytes.org/index.php?/topic/144403-readme-first-posts-here-need-to-include-mbae-logs/

[OliPicard]

Hey pbust, sorry about that. I'm attaching the logs now.

 

 

mbae-config.zip

[pbust]

Thanks for the logs Oliver.

 

If you open the MBAE interface and click on the LOGS tab, select the detection of Foxitreader.tmp and the "Exclude" button should enable. Click the Exclude button to add the exclusion and then try the installation again.

 

Let me know if that works.

[OliPicard]

Hey pbust,

 

 

Many thanks for clarifying, It seems like GOG is bundling in the PDF reader without user concent. MAE is detecting the request as an expliot attempt.

 

I have asked along with a couple of other users to get them to change the reader to an opt-in mode. For now i'll let MAE contiune to block the PDF reader as I have no use for it.

 

Thanks again

Oliver

[pbust]

Thanks for confirming Oliver.

 

I'll close this thread for now, but if you need me to re-open it simple send me a PM.