marktheshark

The latest windows beta version. Probably a false positive right?

I did have that on, thanks for the advice. I will consider it.

This happend when running the windows 10 audio troubleshooter. It recommended me to open the audio enhancements, which I did. Then the protection kicked in. I doubt this is a real threat. Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 1/20/23 Protection Event Time: 7:56 PM Log File: 0f22a804-98f4-11ed-b6cb-7085c26c98b2.json -Software Information- Version: 4.5.20.230 Components Version: 1.0.1868 Update Package Version: 1.0.64819 License: Premium -System Information- OS: Windows 10 (Build 19045.2486) CPU: x64 File System: NTFS User: System -Exploit Details- File: 0 (No malicious items detected) Exploit: 1 Exploit.PayloadProcessBlock, C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe Shell32.dll,Control_RunDLL mmsys.cpl,,{0.0.0.00000000}.{9f532df0-b515-41c6-9426-f22a8bbc6c05},sysfx, Blocked, 0, 392684, 0.0.0, , -Exploit Data- Affected Application: Windows Control Panel Protection Layer: Application Behavior Protection Protection Technique: Exploit payload process blocked File Name: C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe Shell32.dll,Control_RunDLL mmsys.cpl,,{0.0.0.00000000}.{9f532df0-b515-41c6-9426-f22a8bbc6c05},sysfx URL: (end)

And again, this time Sabnzbd detected as ransomware, also stop blocking teamredminer please. Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 3/21/21 Protection Event Time: 5:50 PM Log File: 7b28fa70-8a65-11eb-b14c-7085c26c98b2.json -Software Information- Version: 4.3.0.98 Components Version: 1.0.1217 Update Package Version: 1.0.38489 License: Premium -System Information- OS: Windows 10 (Build 19041.867) CPU: x64 File System: NTFS User: System -Ransomware Details- Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) File: 2 Malware.Ransom.Agent.Generic, C:\Users\het_v\Desktop\SABnzbd.lnk, Quarantined, 0, 392685, 0.0.0, 416EDC451767C77AD363C4CFC5F62F69, DC718B3BEF8F076D89BEFCA5328F37CD2CDAA9EEAD4245BA878963F8B9EE9A7A Malware.Ransom.Agent.Generic, C:\PROGRA~1\SABnzbd\SABnzbd.exe, Quarantined, 0, 392685, 0.0.0, A5F76291BD4AC8B4427343D150D8CEC4, 9C003DFDFB5D034A46BF08DF5FCC883B132D3000BD76DE8506EC10662608255E (end)

Some mysql related things got detected as generic ransomware. Is this a false positive or real?

Thank you kindly

Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 6/15/20 Protection Event Time: 9:21 AM Log File: e1878c8c-aed8-11ea-9fc5-7085c26c98b2.json -Software Information- Version: 4.1.0.56 Components Version: 1.0.931 Update Package Version: 1.0.25504 License: Premium -System Information- OS: Windows 10 (Build 18362.900) CPU: x64 File System: NTFS User: System -Blocked Malware Details- File: 1 Spyware.PasswordStealer, C:\Program Files\SABnzbd\SABnzbd.exe, Quarantined, 553, 831335, 1.0.25504, , ame, (end)

running it, used to work fine before though. Today is the first time it got blocked.

Today malwarewbytes blocked sabnzbd on my pc. I'm using mbam 4.1.0.56 Update package 1.0.25504 Component package 1.0.931 and SABnzbd 3.0.0Beta2 https://github.com/sabnzbd/sabnzbd/releases/download/3.0.0Beta2/SABnzbd-3.0.0Beta2-win-setup.exe

Hello MBAM, I live in the Netherlands, and recently received a new modem from my ISP Ziggo. It's called the "Connect Box". I'm seems that the web protection from MBAM is blocking the login part of the local login page (192.168.178.1). It shows the page, except for the login box. There is no information given by MBAM that it blocked anything and I can't find it in the log. When I turn off the web protection, the page loads correctly. I don't really understand why this is happening, any help would be appreciated. Thanks, Mark

It worked. Thanks

will do!

Thanks for the fast reply Aura. I have done as you said and tried the 'ignore' option. It completed the installation but after rebooting i got the mbam message "unable to connect to service". So I guess it failed. Will try the FRST solution now.

having the same problem Operating System Windows 10 Pro 64-bit CPU Intel Core i5 750 @ 2.67GHz Lynnfield 45nm Technology RAM 8,00GB Dual-Channel DDR3 @ 668MHz (9-9-9-24) Motherboard MICRO-STAR INTERNATIONAL CO.LTD P55-GD65 (MS-7583) (CPU 1) Graphics BenQ G2400W (1920x1200@60Hz) G2460 (1920x1080@144Hz) 3072MB ATI AMD Radeon R9 200 Series (MSI)

Is this a real infection? Are these register values safe to delete? Deleting windows related stuff without asking someone seems stupid.