Jump to content

False positive HxTsr.exe?


Recommended Posts

Dear MWB,

today my anti-ransomware beta version 09.15.416 quarantined the file HxTsr.exe
I notice this has been previously reported on the forum.
I followed steps your site advised from a separate post; attempted to restore the file - a pop-up says the file cannot be restored and to visit this forum; I rebooted.
I stopped the MWARB program after reboot and created and attached the 2 zip files your site outlines for reporting possible false positives.
Malwarebytes Anti-Ransomware.zip MBAMSERVICE.zip
File location; C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6965.40901.0_x64__8wekyb3d8bbwe\HxTsr.exe
I got the above location from the log file.
My system details; windows 10 x 64. MS office365 2016.
I see this file relates to MS mail and calendar possibly, my outlook365 email continues to work after reboot.
Windows wont let me view/enter the directory C:... 'windowsapps' where the file came from due to security restrictions.  This is my home computer so not sure why as admin of the system
it wont let me change the security setting to view the sub directory. System updated to windows 10 from 7 about 1 month ago (without my permission :( seemed to occur as a push thru from MS, not sure if that effects security permissions).

Can you please help advise me how to proceed eg how to un-quarantine the file and restore it and create an exclusion?

Many thanks,

Link to post
Share on other sites

Hello Hammer and :welcome:

Available data strongly suggests a false positive, and if it has not already been done, you may wish to make the following temporary full pathname file entry in MBARW GUI Dashboard -> Exclusions:

       C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6965.40901.0_x64__8wekyb3d8bbwe\HxTsr.exe

Reference: https://www.virustotal.com/en/file/54fe4506842060d648abab5cf11d6ccb7eb4b58f8a5d7722a47c580e7594ac89/analysis/ Unsigned

At any time, a MBARW development team member, QA team member or Staffer may request the above temporary exclusion be altered/deleted.

As many improvements and fixes have been included with the release of MBARW Beta7 v0.9.16.484, it is strongly recommended this upgrade be made to the system in question.

Reference: Malwarebytes Anti-Ransomware BETA 7 Now Available

The MBARW Beta development team monitors this sub-forum, and they are also aware of similar reports for which they are working on a solution.

Thank you for beta testing MBARW and your valuable feedback.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.