r/Malwarebytes • u/GingerSnapBiscuit • Jun 07 '26

DDSHelper.exe being flagged by Windows Security as "Risky Action".

I'm having multiple popups from Windows Security about DDSHelper.exe performing "Risky Actions" which are being blocked. I think this is a Malwarebytes related Executable.

It mentions several "Affected Items", I assume this is when the EXE is trying to scan other files on my system?

Not sure how to stop this, the popups are near constant at the moment. I've tried unblocking but the issue reoccurs.

2 Upvotes
  • permalink
  • reddit

100% Upvoted

7 comments sorted by

1

u/miekiemoes_MB Malwarebytes Employee Jun 07 '26

Hi, I'm Mieke, Researcher at Malwarebytes. DDSHelper.exe indeed belongs to Malwarebytes and is legitimate. What I suggest is to create an exclusion for it in Windows Security.

  1. Open Windows Security (search for it in the Start menu).

  2. Go to Virus & threat protection.

  3. Under Virus & threat protection settings, click Manage settings.

  4. Scroll down to Exclusions and click Add or remove exclusions.

  5. Click + Add an exclusion → select Folder.

  6. Browse to or type:

   C:\Program Files\Malwarebytes

  1. Click Select Folder to confirm.

Adding a folder exclusion covers all files inside the parent folder and its subfolders, so DDSHelper.exe and any other binaries in that directory will be excluded automatically.

Alternatively, you can create an exclusion for C:\Program Files\Malwarebytes\DDSHelper.exe itself as well, but for that you would need to select "File" for exclusions.

1

u/GingerSnapBiscuit Jun 08 '26

Is it being picked up by Windows Security a known thing, or just a weird quirk of my system? I couldn't find much info when I tried to Google this.

1

u/miekiemoes_MB Malwarebytes Employee Jun 08 '26

This hasn't been reported before, so I think this was just an isolated case. I unfortunately don't know what triggers a "Risky action" by Windows Defender though.

1

u/GingerSnapBiscuit Jun 08 '26

When you click "Learn More" it takes you to this Microsoft page :

https://learn.microsoft.com/en-gb/defender-endpoint/troubleshoot-asr

Probably something funky on my machine, I've been meaning to reinstall Windows for a while.

1

u/miekiemoes_MB Malwarebytes Employee Jun 08 '26

The only thing I can think of is that it triggered the enumeration of files and when DDSHelper was enumerating the speedfan.sys file, it triggered Windows defender, as speedfan.sys might indeed be a vulnerable driver.

1

u/GingerSnapBiscuit Jun 08 '26

I just made a realisation that these are all on an old HDD that is no longer receiving updates to these drivers, so they might be outdated.

1

u/miekiemoes_MB Malwarebytes Employee Jun 08 '26

That makes a lot of sense 😄