Firefox 79 triggers Ransonware alert and removal

[jdesquire]

Just installed Firefox 79 (downloaded from Mozilla's website).  The install file checks OK with Norton AntiVirus and MWB Premium.  Firefox installed without any issue.  It was the real-time ransomware protection in MWB that shut the program down.

What log file would you like to look at?

Many thanks.

[miekiemoes]

Can you attach the detected file and logs? You can get the more detailed logs by following the instructions here. Thanks.

[jdesquire]

I ran the support tool, but it produces logs that either don't deal with the ransomware alert and/or contain confidential data.

I'll post the ArwDetections log that is referenced in MWB.  I think that's what you need to see.  Please let me know if there is another log you want to look at.

DCC6E120A0CA9AF0D229517A065D815E0F0D4DA603EE491DA81A0E9771C83B12
{
   "applicationVersion" : "4.1.2.73",
   "chromeSyncResetQueryRequested" : false,
   "chromeSyncResetQueryResult" : false,
   "clientID" : "",
   "clientType" : "other",
   "componentsUpdatePackageVersion" : "1.0.972",
   "cpu" : "x64",
   "dbSDKUpdatePackageVersion" : "1.0.26363",
   "detectionDateTime" : "2020-07-03T18:13:43Z",
   "fileSystem" : "NTFS",
   "id" : "ee09d2a6-bd58-11ea-998a-ac675d351b09",
   "isUserAdmin" : true,
   "licenseState" : "licensed",
   "linkagePhaseComplete" : false,
   "loggedOnUserName" : "System",
   "machineID" : "",
   "os" : "Windows 10 (Build 18362.900)",
   "schemaVersion" : 16,
   "sourceDetails" : {
      "type" : "arw"
   },
   "threats" : [
      {
         "ddsSigFileVersion" : "",
         "linkedTraces" : [

         ],
         "mainTrace" : {
            "archiveMember" : "",
            "archiveMemberMD5" : "",
            "cleanAction" : "block",
            "cleanResult" : "successful",
            "cleanResultErrorCode" : 0,
            "cleanTime" : "",
            "generatedByPostCleanupAction" : false,
            "id" : "ee2d929c-bd58-11ea-81bd-ac675d351b09",
            "isPEFile" : false,
            "linkType" : "none",
            "objectMD5" : "0e5fe8b00c8bbbb30a31a33d717d85f7",
            "objectPath" : "C:\\Firefox\\firefox.exe",
            "objectSha256" : "65e894c299090483b25cee110d679d278360a24f98e2ccc30ad7e9f5636e1af1",
            "objectType" : "file",
            "resolvedPath" : "",
            "suggestedAction" : {
               "archiveDir" : false,
               "chromeExtensionOther" : false,
               "chromeExtensionPreferences" : false,
               "chromeExtensionSecurePreferences" : false,
               "chromeExtensionSyncData" : false,
               "chromeUrlOther" : false,
               "chromeUrlSecurePreferences" : false,
               "chromeUrlSyncData" : false,
               "chromeUrlWebData" : false,
               "disableHubbleWhiteListing" : false,
               "disableSignatureWhiteListing" : false,
               "fileDelete" : true,
               "fileReplace" : false,
               "fileTxtReplace" : false,
               "folderDelete" : false,
               "isChromeObject" : false,
               "isDDS" : false,
               "isDoppleganging" : false,
               "isExternalDetection" : false,
               "isPUP" : false,
               "isShuriken" : false,
               "isWMIEventConsumer" : false,
               "killProcess" : false,
               "minimalWhiteListing" : false,
               "moduleUnload" : false,
               "noLinking" : false,
               "physicalSectorReplace" : false,
               "priorityHigh" : false,
               "priorityNormal" : false,
               "priorityUrgent" : false,
               "processUnload" : false,
               "regKeyDelete" : false,
               "regValueDelete" : false,
               "regValueReplace" : false,
               "shortcutReplace" : false,
               "silentMode" : false,
               "singleDelete" : false,
               "treatAsRootkit" : false,
               "useDDA" : false,
               "verifyResolvedPath" : false,
               "whitelistCheckError" : false
            }
         },
         "ruleID" : 392685,
         "ruleString" : "",
         "rulesVersion" : "0.0.0",
         "srcEngineComponent" : "unknown",
         "srcEngineThreatNames" : [

         ],
         "threatID" : 0,
         "threatName" : "Malware.Ransom.Agent.Generic"
      }
   ],
   "threatsDetected" : 1
}

I uninstalled Firefox before I read your reply, so I can't upload the installed program's .exe file.  Sorry.

Many thanks for your help.

 

[Porthos]

27 minutes ago, jdesquire said:

I ran the support tool, but it produces logs that either don't deal with the ransomware alert and/or contain confidential data.

Send @miekiemoes a PM with the logs and reference this thread.

[miekiemoes]

Hi,

Can you send the other logs as well via a private message? This so we can troubleshoot why this is detected, as it shouldn't.

Thanks!

[RGuatta]

Now Malwarebytes blocks Firefox as Ransomware.
Had to switch off Ransomware protection.

[miekiemoes]

Please add an exclusion for firefox for now. Thx

[RGuatta]

I added Firefox.exe to the exclusion list for Ransomware an switched Ransomware Protection back on.

Here is the zipped Firefox.exe and the logs from the Support Tool.
The logs were gathered after adding Firefox.exe to the exclusion list with Ransomware Protection switched on.

firefox.zip mbst-grab-results.zip

[miekiemoes]

Thanks, this helps.

[jdesquire]

Miekiemoes,

Do you have an update on this?  I added Firefox to my allow list, but I'd prefer to fix the problem rather than do an end-run around MWB protection.

Many thanks.

[miekiemoes]

Hi,

A program update (CU15) will be released on Thursday in order to fix this in general.