Maybe false positive

[KatZund]

I'm using Exif Remover 5.1 (from rlvision) for a long time and malwarebytes gives me a message that ransomware ('exiftool.exe' in c/users/name/appdata/local/temp) has been stopped.

Hash 256:   cd003e8957e75f43de4e9ca4ce965e80da73c1940663a39222ea63ef3bd35be2

https://www.virustotal.com/nl/file/cd003e8957e75f43de4e9ca4ce965e80da73c1940663a39222ea63ef3bd35be2/analysis/


/happy new year to y'all
KatZ

Edited January 4, 2018 by KatZund

[miekiemoes]

Hi,

I can't reproduce detection here.

It looks like it has only killed the process - so it wasn't removed.

This happens in the cases when our Antiransomware can't do additional checks to make a final verdict on the file (most cases because of an internet connection error), so for safety sake, it kills the process anyway, just to be sure.

Can you verify that this machine is connected to the internet? If so, mind to do another scan? This shouldn't be detected anymore then.

[KatZund]

Hi,

I've checked. Somehow strange because it was detected while running the program. Now I've let malwarebytes check c:\ and to be sure I tried again by narrowing to let it scan the appdata directory only. Nothing bad found. Ran the original Exif Remover (in c/program files x86) several times to see if I can get the ransomeware warning. Nothing. The file 'exiftool.exe' is still in the appdata/local/temp dir. I've had the warning one or two times before by running the software but had no time to check it out and write on the forum.
Three malwarebytes files have internet access btw.

thank you
Kat
-------
this pc runs win10x64,Eset Smart Security and Malwarebytes.

[miekiemoes]

Hi,

I believe you should be OK. It was probably a temporary thing where it couldn't determine additional checks, so it just killed the process (not deleting it).

[KatZund]

That could/should be it. Had no problems except the one I mentioned. All is well. Anyway thanks for attention/help.

best regards and a safe/healthy 2018
Kat