.net and nvidia applications being flagged as ransomeware and pups

[RThomas]

Autodesk\Autodesk_Plant_Design_Suite_Ultimate_2015_English_Win_64bit_R1_dlm\3rdParty\NET\35SP1\wcu\dotNetFramework\Install35Net.exe AND  Autodesk\VWC2016_ENU_32_64bit_dlm\3rdParty\NET\35SP1\wcu\dotNetFramework\Install35Net.exe are being flagged as  a pup.optional.amonetize by Anti-malware while anti-ransomware is flagging nvidia geforce experience as ransomware.  Last month  C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe and  HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\MDM were flagged as Petya, which Malwarebytes addressed arleady.

We haven't had MWbytes long but our head admin is getting very concerned with the number of false positives we have been getting.

 

[shadowwar]

Can you please attach the file being detected by Malwarebytes and if possible a scan log.

[shadowwar]

Also please make a separate post for the Malwarebytes Anti Ransomware fp here:

 

https://forums.malwarebytes.org/forum/172-malwarebytes-anti-ransomware-beta/

 

 

 

 

Edited October 19, 2016 by shadowwar

[shadowwar]

I believe this is the file that MBAM fp on.

https://www.virustotal.com/en/file/d4ac326931c9a9f1e19762abfd961187ee3e5d6091a6363c90e12f53ff12cf2a/analysis/1476904262/

This was already fixed. Are you running the latest defs?

[RThomas]

 

We are, the original issues occurred on 10/2-4/16, just created an account per mwbytes support. I guess my superior's biggest issue is that there has been an uptick in false positives lately and he's wondering how microsoft applications are getting flagged. :-( thank you Shadowwar for the info though.

[shadowwar]

Well Mbarw is behaviour based and still a beta. Fps unfortunately may occur with that. We aim to fix all though as quick as possible. We have a system in place to avert critical fps. Our next client version will have a bunch more safeguards in place.

The forum here though for the Main MBAM is the quickest way to get something fixed. We monitor this forum 24x7. They are usually fixed very quickly.

[RThomas]

Thanks Shadowwar, will submit here directly from here on out.

[shadowwar]

Thanks. Also MBARW fps need to go in that other forum. A different set of researchers monitor that forum and fix those being still in beta.

[RThomas]

Noted and already created a new thread for the nvidia anti-ransomware issue

[shadowwar]

Thanks! Btw we have dedicated people that monitor MBARW to fix those ASAP..