Latest WinRar beta reported as Ransomware and EXE deleted

[Malebox]

Latest WinRAR x64 english beta - http://www.rarlab.com/rar/winrar-x64-55b2.exe - is occasionally detected as ransomware by the realtime ransomware protection module while it is archiving multiple directories of images with the "delete files after archiving option" flag set. This leads to the executable being deleted and WinRAR cannot be used until the computer is rebooted and winrar is reinstalled.

[miekiemoes]

Hi,

This has been fixed already.

Also, please update to Malwarebytes 3.1 as it has fixed an issue, so similar FPs won't happen anymore. (Note, these are still generic detections, so an occassional FP is always possible, that's why it's always a good idea to add the filepath to exclusions)

Thanks!

 

[Malebox]

Thank you. I wasn't aware it was dependent on the program version. I updated and I hope it won't be detected anymore.

However after the update and restart I cannot enable exploit protection. All the other types are working fine.

[miekiemoes]

Hi,

Fixing FPs aren't program dependent, but the 3.1 version has an improved methodology to prevent Ransomware FPs.

As for the exploit protection, try to reboot once again and see if that helps. Note, the exploit protection might appear to show as disabled in the User Interface while it's only a delay there and it's actually enabled.

In either way, if still the same issue, I suggest you report this here: https://forums.malwarebytes.com/forum/41-malwarebytes-3/

Note - seems for some, the uninstall and reinstall of MB3 also worked.

[Malebox]

I will do that then. Thanks again for all your help.