ConEmu helper script mistakenly tagged as ransomware

[Zekka]

I don't remember if this is modified from the original installation, but if it was modified it was probably modified by me. I see no evidence of ransomware in the script itself.

Here's the detected file plus a log.

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 5/5/17
Protection Event Time: 8:11 PM
Logfile: 
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.103
Update Package Version: 1.0.1878
License: Premium

-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: System

-Ransomware Details-
File: 1
Malware.Ransom.Agent.Generic, C:\Dropbox\Workspace\Programs\ConEmu\ConEmu\CmdInit.cmd, Quarantined, [0], [-1],0.0.0


(end)

 

Thank you and good luck with fixing this detection! (Assuming it's incorrect.)

[miekiemoes]

Hi,

Can you zip and attach the following file please? (after unquarantining and rebooting):

C:\Dropbox\Workspace\Programs\ConEmu\ConEmu\CmdInit.cmd

Thanks!!!

[Zekka]

Oh, I'm sorry, I neglected to attach the right file. Thank you for writing me back.

CmdInit.zip

[miekiemoes]

Thanks.

This will be fixed. I also suggest you add the folder: 

C:\Dropbox\Workspace\Programs\ConEmu

to your exclusions in Malwarebytes for the Antimalware and Antiransomware (option 1).

[Zekka]

I have done so! Please let me know if you need any more information.

[miekiemoes]

Thanks, it should be Ok now.

Thanks for reporting and the files!