False Positive: VueScan (Scanning Software) is not Ransomware

[Nerds]

VueScan from:

[hxxps://www.hamrick.com/]

hxxps://www.hamrick.com/files/vuex6497.exe

hxxps://d2bwyyzfw77fhf.cloudfront.net/vuex6497.exe  

is not Ransomware, it is a universal program for image scanning (and a good one at that).

 

Malwarebytes Premium blocked the CloudFront subdomain (please whitelist this [Amazon] CloudFront subdomain). I had to create an exception to be able to download the program update.

Malwarebytes Premium also blocked the program from running (please whitelist this program as well). I had to temporarily turn off Ransomware protection to run it.

 

 

fp.log

[cli]

Thanks for reporting, this will be fixed in the next update.

[LiquidTension]

Hi @Nerds,

When you encountered the program being blocked from running by Ransomware Protection, were you notified of the block by Malwarebytes or was this silent?

Please could you run the Malwarebytes Support Tool so we can gather more details on the Ransomware block:
https://support.malwarebytes.com/hc/en-us/articles/360039023453-Upload-Malwarebytes-Support-Tool-logs-offline

[Nerds]

I believe MBAM blocked the program silently as ransomware (FP).

MBST results attached, per your request.

 

P. S. more of a kudos to the program's developers:

I talked to the developers of the program and they already know about MBAM's ransomware block issue with their program.

They programmed an error message to proactively help users work around the issue, while it exists.

 

mbst-grab-results.zip

[LiquidTension]

Hi @Nerds,

Thank you for the file. We're currently reviewing the data.

Unfortunately, we've been unable to reproduce this issue in all our attempts. Are you able to actively reproduce it on a consistent basis (e.g. by installing an older version and then upgrading)?

If you are, it would be a big help if we could obtain some additional troubleshooting data:

• Process Monitor log as the issue is reproduced: https://docs.microsoft.com/en-us/sysinternals/downloads/procmon (from start to finish of the upgrade attempt).
• Zipped up contents of C:\ProgramData\Malwarebytes\MBAMService\Logs and C:\ProgramData\Malwarebytes\MBAMService\ARW.
• Farbar Recovery Scan Tool logs: https://support.malwarebytes.com/hc/en-us/articles/360039025013-Run-Farbar-Recovery-Scan-Tool-to-gather-logs

[Nerds]

I have the exe's from 1/22/20 , which initially installed from, and the update installed on 6/17/20. 

Here are those exe files compressed in a 7z file. The -o suffix is the older version.

I will see if I can reproduce the FP on my end again as well when I get a bit more time.

Thank you

 

vuex6497.7z