False Positive or real thing?

[nickel78]

I keep getting a notification that a file has been detected and quarantined.  I just want to know if it is legit or not.  I am attaching the zip files of the logs and program data.  Also a picture of the error I get when I try to restore the file

Malwarebytes Anti-Ransomware.zip

MBAMSERVICE.zip

[nickel78]

Anyone out there have any thoughts???

[kenr28]

I have the exact same problem with the same file and I also cannot restore either. It is the Windows 10 mail and calendar app I believe. Is your windows cal and email still working?

[TragicDragon]

I had 2 back-to-back alerts this morning for a file. The software said the files were quarantined but when I checked there were no files listed.

[1PW]

Hello @kenr28 & @TragicDragon and

It is disappointing to read your testing system is having MBARW Beta issues but each computer is unique. Problems that seem "the same" frequently are not.

The same is true for solutions. Solutions may often need to be individualized for your unique testing system.

It is less confusing for everyone if a "One Member Per Topic" policy is adhered to instead of posting to the topic of another member.

Development Team Members, Staffers and helpers will be able to more easily provide both you, and the OP/Topic Starter, with individualized assistance.

Please start a NEW, and SEPARATE topic by left-clicking this >>Start New Topic<< link now.

Thank you always for your patience and understanding.

[nickel78]

ok. with that being said, is there anyone that can give me some info on my problem?????

[1PW]

Hello nickel78:
 
In a similar manner to step #4 within the How to report a False Positive procedure, please zip the following executable from the Windows 10 system in question:

C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6568.46271.0_x64__8wekyb3d8bbwe\HxTsr.exe

Then please attach the above archived file in your next reply to this topic.

Optionally and temporarily, and if you have not already done so, you may wish to add the same above pathname to the MBARW GUI > Exclusions list.

Thank you too for beta testing MBARW and your valuable feedback.

[nickel78]

The file is not present in the folder anymore.  Malwarebytes quarantined it and it will not allow me to put it back, as described in my attached picture.  What else can I try?

[1PW]

Hello nickel78:

 

Please allow the gathering of some additional information for the development team and/or staffers.

 

Do you use Microsoft's Outlook 2016?

 

Does the computer in question run a Windows 10 x64 en-US version? If yes - what edition? Home, Pro, Enterprise, Education, Etc.?

 

Thank you nickel78.

[Decrypterfixer]

Also, you you please do a full reboot on your machine and see if the file can then be recovered? 

 

As for the False Positives, thanks for the logs, it will help us take care of this.

[nickel78]

I am using Outlook 2013, not 2016.  I am running Windows 10 Pro x64.  I purchased the full retail version when it was released because I run an IT business and didnt want to wait for the free update, so I am not using the free upgrade.

 

 

I have attempted the reboot and file recovery method and it does not work.

 

Thank you both for helping me on this issue.

[nickel78]

I could not get that particular file restored, but I could restore the same file in a similar folder that was detected as well.  Maybe this will be just as good.  This file was found in the directory:

 

C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6568.46121.0_x64__8wekyb3d8bbwe

 

The same file that cannot be restored was located in the directory:

 

C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6568.46271.0_x64__8wekyb3d8bbwe

HxTsr.zip

[1PW]

Hello nickel78:

Until a more permanent solution is made available, you may consider "White Listing" HxTsr.exe using its then current location by entering the file's existing full pathname in MBARW GUI Dashboard > Exclusions.
 
If you experience another false positive for HxTsr.exe, you may consider the following restore procedure:
 

How to Repair a Microsoft Office application.

• Please consider producing a hard copy of the procedure within Repair an Office application.
• Restart the computer in question into the Windows Normal mode and terminate unnecessary applications.
• Follow Microsoft's procedure within step 1.
• Again, restart the system into Windows Normal mode.
• Confirm the previously missing file has been restored.

Thank you.