GeekFreak #1 Posted June 21, 2016 Microsoft Office's ClickToRun.exe was flagged sometime around June 21st at 3am Again, MAR says it's quarantined, but it doesn't show up in quarantine and I am unable to restore these legitimate files. It's deleted everything from the following directory: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates I'm going to stop beta testing. This program is doing more damage than protection. If you can tell me how to restore these files, I might reconsider. Thanks and good luck. MBAMSERVICE.zip Malwarebytes Anti-Ransomware.zip Share this post Link to post Share on other sites
1PW #2 Posted June 21, 2016 Hello GeekFreak: Available data strongly suggests a false positive, and if it has not already been done, you may wish to make the following temporary full pathname file entry in MBARW GUI Dashboard -> Exclusions: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.6965.2058\OfficeClickToRun.exe Reference: https://www.virustotal.com/en/file/4acc419736027184278915345bf10cbaafb93b6f50a789cbc675fa126dafc1a6/analysis/ Signed At any time, a MBARW development team member, QA team member or Staffer may request the above temporary exclusion be altered/deleted. Thank you for beta testing MBARW and your valuable feedback. Share this post Link to post Share on other sites