captainhaddock

@Porthos thanks again, I updated Malwarebytes as suggested and it no longer flags the ransomware. Appreciate your help. I looked at the log file in a text editor but definitely did not change it. It may be because I had a second flagging of the error and sent the log file for that instead of the original dated error. Here are both log files ramsomdetect1.txt ramsomdetect2.txt

@Porthos many thanks for looking, here is the requested export: ramsomdetect.txt

I have just Updated my environment to localwp 7.1.0+6396, (localwp.com) on running Malwarebytes reports ransomware in php-cgi.exe and has quarantined it. I checked the SHA1 key against the downloaded install image and it checks out OK. php-cgi.zip