Foobar2000 flagged as Ransomware

[Scott_M]

Was unable to add an exclusion for foobar2000.exe as MWB blocked the ability to select it (error message about can't open it). I ended up rebooting and while the log still showed the block, I was able to open and use Foobar. Went back into MWB and the log entry had disappeared.

-Log Details-
Protection Event Date: 11/11/18
Protection Event Time: 10:35 AM
Log File: 87859174-e5e0-11e8-b634-544810ab2078.json

-Software Information-
Version: 3.6.1.2711
Components Version: 1.0.482
Update Package Version: 1.0.7797
License: Premium

-System Information-
OS: Windows 10 (Build 17763.55)
CPU: x64
File System: NTFS
User: System

-Ransomware Details-
File: 1
Malware.Ransom.Agent.Generic, C:\Program Files (x86)\foobar2000\foobar2000.exe, Blocked, [0], [392685],0.0.0

[tetonbob]

Hi @Scott_M- Can you please attach a copy of this log file?
C:\ProgramData\Malwarebytes\MBAMService\ArwDetections\87859174-e5e0-11e8-b634-544810ab2078.json

[Scott_M]

Here you go

87859174-e5e0-11e8-b634-544810ab2078.txt

[tetonbob]

Hi @Scott_M  - this file should no longer be detected, as long as the Malwarebytes client is allowed to reach our whitelisting server

 

            "cleanAction" : "block",
            "cleanResult" : "successful",

Note the "block" rather than "quarantine". When this happens, the file is temporarily prevented from running. A reboot releases that temporary hold on the file.

This also means our whitelisting server could not be reached. You may want to add this file to local exclusions.