MB Anti Ransomware stops excluded executable

[SimonKravis]

Problem 1 : MB Anti Ransomware stops a locally developed executable as ransomware even though it has been added to the exclusion list.

Problem 2: No file is placed in quarantine after the executable has been stopped.

[1PW]

Hello SimonKravis:

Please carefully read the locked and pinned topic in this sub-forum, How to report a False Positive and for developer analysis, kindly attach the 3 requested .zip archives to your next reply in this thread.

If an exclusion has not already been entered, a temporary exclusion entry might then be made available to prevent a re-occurrence for your individual system.

Thank you for beta testing MBARW and your feedback.

[SimonKravis]

This not a false positive - the file has been added as an exclusion, but is still treated as malware by stopping execution but no file  is placed in quarantine

[1PW]

Hello SimonKravis:

The identical archive file set is still required.  This will give the MBARW development team the crucial data that is required for a proper analysis.

Thank you.

[SimonKravis]

Requested files attached

Malwarebytes Anti-Ransomware.zip

LaunchFindAlike.zip

logs.zip

[1PW]

Hello SimonKravis:

Available data strongly suggests a false positive, and since the following pathname may have been entered in MBARW Dashboard/GUI -> Exclusions, and the binary has been uploaded to the developers, please allow that possible entry to remain until you are requested to remove it:

                         C:\Users\Simon\AppData\Roaming\FindAlike\LaunchFindAlike.exe

Reference: https://www.virustotal.com/en/file/6293be3c48b050750bca25aaf8c721ef6de9645882d74bdaaf8bbda428a0150f/analysis/1468817954/ Unsigned

Note: The executable in question may have resisted inclusion during the whitelisting process and likely needs to be further analyzed by the MBARW Beta development team and is likely in a queue.

At any time, a MBARW development team member, QA team member or Staffer may request the above temporary exclusion be altered/deleted.

As many improvements and fixes have been included with the 10-June-2016 release of MBARW Beta7 v0.9.16.484, it is strongly recommended this upgrade be made to the system in question.

Reference: Malwarebytes Anti-Ransomware BETA 7 Now Available.  Thank you for beta testing MBARW and your valuable feedback.

Edited July 18, 2016 by 1PW