devicenull Posted February 5, 2020 ID:1360612 Share Posted February 5, 2020 MalwareBytes is, I believe, incorrectly quarantining Backblaze's (cloud backup software) transmit agent (bztransmit64.exe) as Malware.Ransom.Agent.Generic. I have attached the logs but not the executable as I re-installed the latest version of BackBlaze trying to fix the issue. It it decides to quarantine the new version, I will attache the new log and and the file in a subsequent post. Thanks backblaze.txt Link to post Share on other sites More sharing options...
Staff shadowwar Posted February 5, 2020 Staff ID:1360621 Share Posted February 5, 2020 I would either need the file or the mbamservice.log The mbamservice.log is located here: C:\ProgramData\Malwarebytes\MBAMService\logs Link to post Share on other sites More sharing options...
devicenull Posted February 5, 2020 Author ID:1360628 Share Posted February 5, 2020 Here are the service logs. They appear to have rolled so I've included the last three to make sure the incident is in there. I was going to unquarantine the file and include it but apparently it blocked it and did not quarantine it. I then went to copy the current version to include and the file is 0 bytes....? Not sure how that happened. Temp.zip Link to post Share on other sites More sharing options...
Staff shadowwar Posted February 5, 2020 Staff ID:1360644 Share Posted February 5, 2020 You would have to either shutdown and restart mbam to release the hold on the file. Or worse case reboot the machine. Looking now. Link to post Share on other sites More sharing options...
Staff shadowwar Posted February 5, 2020 Staff ID:1360646 Share Posted February 5, 2020 This should no longer be detected. Thanks for reporting. Link to post Share on other sites More sharing options...
devicenull Posted February 5, 2020 Author ID:1360647 Share Posted February 5, 2020 Thanks, it was a little disconcerting to have my off-site backup (I also do on-site backups) suddenly get reported as ransomware... LOL Link to post Share on other sites More sharing options...
Staff shadowwar Posted February 5, 2020 Staff ID:1360649 Share Posted February 5, 2020 Yeah i could imagine. When a program looks at a whole bunch of files quickly it can sometimes trip up the heuristic. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now