Protection event ransomware

[arleetel]

It happened just at the start of the computer, while KIS was updating : it was a green popup that said it quarantined

above ransomware, I clicked on view quarantine but nothing was there. This is the line copied from the report : (C:\Progr.Data\Malwarebytes\MbamSerice\LOGS) nothing mentioned in the protection event reports.

10/04/17    " 09:53:31.436"    343313484    103c    19cc    INFO    AntiRansomwareControllerImpl    mb::arwcontrollerimpl::ArwControllerImpl::ArwShimDetectionCallback    "ArwControllerImplHelper.cpp"    1079    "The detected file is only whitelisted due to error in whitelisting (likely offline), sending an action request to the SDK to kill this process. ObjectPath=HxTsr.exe, id=0x1"
10/04/17    " 09:53:33.032"    343315078    103c    19c0    WARNING        ArwSDK    ""    0    "{Thread: 0x000019D0, Tick: 0x14769286} [KillProcess] The process {PID: 12872} is already stopped."

I'd like to know what this is and if I have to take any action.

Thanks.

 

[dcollins]

That file should be part of outlook. Can you go into your reports section of Malwarebytes and export the Ransomware detection event? That will have more relevant information to this detection

[arleetel]

I f you mean outlook, part of Microsoft office, I don't have it installed on the laptop, it's in the software list but never installed.

Strange enough malwarebytes has no entry in the reports, that's why I copied the line from the logs located in program data and it's not mentioned in the quarantine section either, only on the dashboard : real-time detections.

 

[dcollins]

Did you reboot after the detection event? I believe that file is also used as part of Windows Mail in Windows 10

[arleetel]

I did reboot but not immediately.

I am concerned about that detection but if it's part any windows program it should not be harmful, I hope.

The strange thing is that it somehow disappeared.

 

[dcollins]

I tshouldn't be harmful. It looks like we tried to check the status of that file, but couldn't reach the internet so we blocked it but didn't remove it, just to be safe. If you don't see the detection again, you should be ok

[arleetel]

Thank you for putting my mind at rest, the laptop is mostly used for bank operations and is only updated, scanned and .........kept as clean as possible.