False positive Malware.Ransom.Agent.Generic for Zotero.exe

[DavidRaco]

C:\Program Files (x86)\Zotero\zotero.exe MD5: da76aeca106e12c11b7812c5f312058f SHA256: baed6465ad324fba6ec94b5a4181777807e835a5efea44cb9a7c381c08167a03

No hits on VirusTotal -- https://www.virustotal.com/gui/file/baed6465ad324fba6ec94b5a4181777807e835a5efea44cb9a7c381c08167a03/detection

Seems to be a known issue -- https://forums.zotero.org/discussion/91594/updater-detected-as-ransomware

I verified that the user downloaded the executable from the legitimate zotero.org website.

Edited November 10, 2022 by AdvancedSetup
Disabled live hyperlinks

[Porthos]

Could you post the log showing the detection.

You can find Scan and Protection logs within the Malwarebytes 4 program in the following location

 

 

RTP stands for Real-Time Protection and is where automatic protection operations would normally be logged

 

 

If you click on the View option you should get something similar to the following with other options available.

 

 

 

 

Thank you

[DavidRaco]

This detection came through Malwarebytes Enterprise. We use Nebula to manage our deployments. Is there a way to pull the logs without going directly to the endpoint for them? If not, please send me whatever instructions I should follow to get you what you need from the Enterprise version.

[Porthos]

We will then wait for staff to respond with further instructions.

[miekiemoes]

Hi,

This should no longer be detected anymore.

[DavidRaco]

Thank you, Mieke! I appreciate your swift response.

[miekiemoes]

You're most welcome :)