Boxcryptor detected as Ransomware?

[ottchris]

Reason for the question-mark is I can find no trace of the event. An hour or so ago got a prompt for a new version of Boxcryptor. All the subsequent prompts appeared to be normal for a Boxcryptor software update and I chose the 'restart later' option  as I had already done a windows restart for an Acronis True Image software update. Maybe a minute or so after the Boxcryptor update completed (short of restarting windows) a MalwareBytes pop-up appeared. I'm 99 per cent sure it was Malewarebytes and it included the text "Boxcryptor" and "Ransomware" and I think "quarantine". Problem is there is no record in the log of the event and quarantine is empty. I won't know the state of Boxcryptor until I restart windows later today. I also run ESET Smart Security and although I pretty sure the pop-up was from MB I have checked ESET logs just in case and as expected found no record of the event. So this is a tentative report to see if anyone else has experienced the same event.

[miekiemoes]

Hi,

This could have just been something temporary. If it wasn't quarantined, then it means, it probably only killed the process (not deleting) based upon behavior.

Boxcryptor is indeed safe software, so if this happens again, then please go to the following folder: 

C:\ProgramData\Malwarebytes\MBAMService\logs\

and zip and attach the MBAMSERVICE.LOG from there.

 

Thanks!

[ottchris]

On 2017-4-26 at 3:51 PM, miekiemoes said:

Hi,

This could have just been something temporary. If it wasn't quarantined, then it means, it probably only killed the process (not deleting) based upon behavior.

Boxcryptor is indeed safe software, so if this happens again, then please go to the following folder: 

C:\ProgramData\Malwarebytes\MBAMService\logs\

and zip and attach the MBAMSERVICE.LOG from there.

 

Thanks!

Not sure what process it killed but following an overnight 'power reset' (should really have been a simple Windows restart but I forgot the pending update install) Boxcryptor update completed successfully. I understand the 'not quarantined' aspect and it's possible the pop-up may have stated that (it didn't stay up for long) but the event should have been logged.  An complete event audit trail should be a minimum requirement of any security application.