Supposedly quarantined file seems to be deleted

[NotMyFaultTolerant]

I got a popup warning this morning that "Malware.Ransom.Agent.Generic" had been blocked and quarantined.

I suspect this was a false positive and may have been an automatic update for my cloud file sync software. I'd like to confirm by examining the file but when I open Malwarebytes and look in the Quarantine there's nothing listed. I see the history entry on the notifications but it contains very little information.

The popup said it was quarantined but it seems that it was simply deleted. Is this the usual expected behavior?

Thanks!!

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

• For use when you are on the forums and need to provide logs for assistance
• For use when you don't need or want to create a ticket with Malwarebytes
• For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler

1. Download Malwarebytes Support Tool
2. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
3. Place a checkmark next to Accept License Agreement and click Next
4. Navigate to the Advanced tab
5. The Advanced menu page contains four categories:
   • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
   • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
   •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
   • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
6. To provide logs for review click the Gather Logs button
7. Upon completion, click OK
8. A file named mbst-grab-results.zip will be saved to your Desktop
9. Please attach the file in your next reply.
10. To uninstall all Malwarebytes Products, click the Clean button.
11. Click the Yes button to proceed. 
12. Save all your work and click OK when you are ready to reboot.
13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
14. Select Yes to install Malwarebytes.
15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler

 

 

 

 

Spoiler

 

 

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

Based on the type of detection, I believe all it did was block an app from executing so nothing was actually quarantined.  If Malwarebytes does remove an item it will create a backup in quarantine first before doing so.

You can view additional details about the detection, including the specific application/process that was detected/blocked so that you can verify that it still exists on disk by clicking on the Detection History card on the main dashboard then selecting the History menu item and opening the report from the detected item either by double-clicking on it or by hovering your mouse over it and clicking the eye icon.  If an item was quarantined it will say as much under Action, but if it simply says Blocked then it did not remove anything and only blocked execution of the file/process when it tried to run in memory.

If you believe the detection to be a false positive please create a new post in this area and include a copy of the report, either by exporting it to a text file and attaching it or by copying it to the clipboard and pasting it into your post in that area.  Both functions are available by clicking on the Export link at the bottom left of the report when viewing it.

I hope this helps and if we may be of assistance with anything else please let us know.

Thanks

[NotMyFaultTolerant]

The file was gone but I found the JSON log file and it contained the SHA256. A matching file is up on VirusTotal and it does appear to be an update for the program I suspected. I've posted the details as you suggested. Thanks!!

[exile360]

 Excellent, thank you.  It will also likely be helpful if you could post the log there as well, that way the Research team can determine exactly which signature/component made the detection so that they can modify/tune it accordingly to correct the FP.  If need be you can simply copy/paste the contents of the .JSON log or export/copy/paste it as mentioned in my post above.