Ransomware FP

[Boswell19]

Been running a image conversion program successfully for some time. However this time Malwarbytes stopped it working as it reported it had blocked it as ransomeware.

However I am unable to delete the program (it is purely an .exe application - not installed) but when I try to delete it, it asks for Administrator. 

I have confirmed my Administrator owner rights on my PC. and tried to apply it to this file, but it just repeats it need administrator permission so I can delete this program.

How do I get rid of it?

[exile360]

Greetings,

Please try restarting your system and then disabling Ransomware Protection in Malwarebytes temporarily by right-clicking on the Malwarebytes tray icon near your system clock and clicking on Ransomware Protection: On and then clicking Yes if prompted by User Account Control and then you should be able to delete the EXE.  Most likely Malwarebytes' protection is preventing the file from being accessed/deleted, but restarting and disabling Ransomware Protection should allow you to remove it.  Once that is done right-click the tray icon again and click Ransomware Protection: Off to turn it back on again.

If it still doesn't work then please try restarting your system in Safe Mode and deleting it there (Malwarebytes' protection doesn't run in Safe Mode so it shouldn't interfere with deleting the file there).

Additionally, if you believe this detection is a false positive and that the image conversion program is safe then please create a new topic here by zipping and attaching a copy of the EXE being blocked to your post so that a member of the Research team may take a look and whitelist the file if it proves to be safe.

You can also exclude the file from Malwarebytes' Ransomware Protection if you wish to run the program without it being detected in the meantime.  If you need instructions on how to do so please let us know which version of Malwarebytes you are using (Malwarebytes 3 or Malwarebytes 4) and we will provide instructions.

Please let us know how it goes and if the issue is resolved or not.

Thanks

[Boswell19]

Hi exile360 and many thanks for your reply - much appreciated.

Prior to receiving your comment, I did in fact restart my Windows 10 PC and tried a simple delete on the .exe file and it worked.  It now sits in my Delete Folder presently.  It did not ask for Administrator permissions either.

The little program, which has worked perfectly for a month or so, is called Bulkimageconverter.exe  (71kb). I suspect it could well be a false positive, so I will do as you suggest and attach a 'zip' copy once I figure out how to manage that.

I have Malwarebytes v 3.8.3

[exile360]

Excellent, I'm glad that it worked.  Yes, it does indeed sound like a false positive.

Thanks

[Boswell19]

Hi again.

I have posted it to the link you suggested with a zip file of the exe program.

Thanks

[exile360]

Excellent, a member of the Research team should analyze the file soon and then they will let you know if it was a false positive and if it was they'll push out an update to the signatures to get the file whitelisted.

[Boswell19]

Many thanks.

[exile360]

You're welcome, and if you need any help with anything else please let us know.

Thanks