remove Generic.Ransom.VxLock.E31AD1D6

[Chris Haslam]

I can send you one of the zip files in SS&D\Quarantine, if that would be helpful --- and safe. These are spooky times!

 

[Juliet]

I have heard back from one of the advisors:


Yes, that does look like a false positive. Send them to post in the false positives forum,
https://forums.spybot.info/showthread.php?19117-How-to-report-possible-False-Positives
Then link to the false positive forum section:
https://forums.spybot.info/forumdisplay.php?16-False-Positives
It would be helpful if you asked him to post a link to his "remove Generic.Ransom.VxLock.E31AD1D6" thread in his false positive post as well, so they can look at the thread if they want any further info.

 

[Chris Haslam]

Working on reporting it

 

[Chris Haslam]

Do I need to subscribe to the False Positives thread?

 

[Chris Haslam]

I found that I was already subscribed: back in 2019

 

[Juliet]

I'm not sure how that forum works but would think you would need to subscribe to the topic you create.

 

[Chris Haslam]

I have posted to False Positives and linked by thread to our thread.

 

[Chris Haslam]

Posted to False Positives:

"A scan last night and again today, after the daily update, did not show VxLock. It appears that the problem is resolved."

Thank you for your help.

I will check my wife's PC to see whether it is also OK.

 

[Juliet]

Got my fingers crossed.

 

[Chris Haslam]

My wife's PC no longer shows VxLock

favicons.sqlite on her PC is 44 MB ! I found a way, in Mozilla Help, of copying existing bookmarks to a newly installed Firefox. Perhaps this will reduce size of favicons and stop Firefox crashing.

 

[Juliet]

Good deal

Use this tool to remove quarantined items:

Please download KpRm by Kernel-panik and save to your Desktop.

• Click on KpRm.exe to run the tool.

Vista/Windows 7/8/10 users right-click and select Run As Administrator.​

• Put a check mark next to these items:

- Delete tools
- Delete now​

• Click the "Run" button.

• When the tool has finished, it will create and open a log report and delete itself.

 

[Chris Haslam]

Done, on my PC

 

[Chris Haslam]

I just looked at C:\ProgramData\Spybot - Search & Destroy\Quarantine using PowerDesk.

There are 146 files in this folder, including Generic.Ransom.VxLock.886DC9DE;Generic.Ransom.VxLock.*.zip The other zip files date from 2019.

 

[Chris Haslam]

KpRm .txt file
-------------
# Run at 2022-04-23 15:51:47
# KpRm (Kernel-panik) version 2.9.3
# Website https://kernel-panik.me/tool/kprm/
# Run by Chris from C:\Users\Chris\Desktop
# Computer Name: MOLLY
# OS: Windows 7 X86 (7601) Service Pack 1
# Number of passes: 2

- Checked options -

~ Delete Tools
~ Delete Quarantines

- Delete Tools -

No tools found

-- KPRM finished in 1.67s --

 

[Chris Haslam]

Files are dated 2022-02-26 thru 2022-04-23 and from 2019-10-07

 

[Chris Haslam]

Would it be safe for me to delete all files in C:\ProgramData\Spybot - Search & Destroy\Logs ?

Or just Check*.txt files?

 

[Juliet]

If their in a quarantine folder those files aren't going anywhere but, I'm unsure which exactly can be deleted without it effecting the program in some way.

 

[Juliet]

This might help

false positive in 2019, Gen.Variant.Graftor:
https://forums.spybot.info/showthrea...ht=#post482945
That was a false positive from dropbox. Though for there to be 146 files in quarantine, some could just be old .zip files quarantined from usage tracks, if he scans for those, or various other little things.

 

[Juliet]

Glad we could help.

Since this issue appears resolved ... this Topic is closed.