Jump to content
Boswell19

Ransomware FP

Recommended Posts

Been running a image conversion program successfully for some time. However this time Malwarbytes stopped it working as it reported it had blocked it as ransomeware.

However I am unable to delete the program (it is purely an .exe application - not installed) but when I try to delete it, it asks for Administrator. 

I have confirmed my Administrator owner rights on my PC. and tried to apply it to this file, but it just repeats it need administrator permission so I can delete this program.

How do I get rid of it?

Share this post


Link to post
Share on other sites

Greetings,

Please try restarting your system and then disabling Ransomware Protection in Malwarebytes temporarily by right-clicking on the Malwarebytes tray icon near your system clock and clicking on Ransomware Protection: On and then clicking Yes if prompted by User Account Control and then you should be able to delete the EXE.  Most likely Malwarebytes' protection is preventing the file from being accessed/deleted, but restarting and disabling Ransomware Protection should allow you to remove it.  Once that is done right-click the tray icon again and click Ransomware Protection: Off to turn it back on again.

If it still doesn't work then please try restarting your system in Safe Mode and deleting it there (Malwarebytes' protection doesn't run in Safe Mode so it shouldn't interfere with deleting the file there).

Additionally, if you believe this detection is a false positive and that the image conversion program is safe then please create a new topic here by zipping and attaching a copy of the EXE being blocked to your post so that a member of the Research team may take a look and whitelist the file if it proves to be safe.

You can also exclude the file from Malwarebytes' Ransomware Protection if you wish to run the program without it being detected in the meantime.  If you need instructions on how to do so please let us know which version of Malwarebytes you are using (Malwarebytes 3 or Malwarebytes 4) and we will provide instructions.

Please let us know how it goes and if the issue is resolved or not.

Thanks

Share this post


Link to post
Share on other sites

Hi exile360 and many thanks for your reply - much appreciated.

Prior to receiving your comment, I did in fact restart my Windows 10 PC and tried a simple delete on the .exe file and it worked.  It now sits in my Delete Folder presently.  It did not ask for Administrator permissions either.

The little program, which has worked perfectly for a month or so, is called Bulkimageconverter.exe  (71kb). I suspect it could well be a false positive, so I will do as you suggest and attach a 'zip' copy once I figure out how to manage that.

I have Malwarebytes v 3.8.3

Share this post


Link to post
Share on other sites

Excellent, a member of the Research team should analyze the file soon and then they will let you know if it was a false positive and if it was they'll push out an update to the signatures to get the file whitelisted.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.