Urgent! Program falsely flagged with "malware ransom agent generic"

[Farhad]

One of our clients, who has used our program for many months on a daily basis, reported that the program was flagged as ransomware and stopped her from doing her job. They shut down their entire operation in panic and sent all their employees home. This only happened on one computer and full scan did not reveal any other problems. The same program running on other networked computers were not flagged.

The program is called Montage and is used to process medical records for independent reviews. It has been in use for at least 2 years and is the main software for a number of businesses. A trial version is available from https://opait.com/Montage.

Malwarebytes flagged Montage.exe and a couple of shortcuts to it as ransomware.

Please advise urgently as this client is awaiting resolution.

Thank you in advance!

 

 

[Porthos]

44 minutes ago, Farhad said:

Malwarebytes flagged Montage.exe and a couple of shortcuts to it as ransomware.

Please zip and attach the detected file.

[miekiemoes]

Hi,

Can you verify with your client if this file is still being detected? Because I remember seeing this and fixing this earlier today.

Thanks!

[Farhad]

Here is the flagged executable. It is a tiny driver that calls into the main program (Opait.Montage.dll). All our programs are obfuscated and digitally signed.

 

 

Montage.zip

[Farhad]

Here is the flagged executable. It is a tiny driver that calls into the main program (Opait.Montage.dll). All our programs are obfuscated and digitally signed.

 

 

Montage.zip

[miekiemoes]

Hi,

I verified that this isn't detected anymore.

[RBemis]

We ran a remediation on our side and it shows as completed.  It has not flagged the software again since then. 

[Farhad]

Thank you!