This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

CompatTelRunner.exe

Jody Marshburn over 3 years ago

Has anyone have the following issue? CryptoGuard detected ransomware in C:\Windows\System32\CompatTelRunner.exe

This thread was automatically locked due to age.

0 Shweta over 3 years ago

Hi Jody Marshburn

Could you please confirm if you have followed the steps mentioned in the KB article? Is the thumbprint of the detection same?

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Jody Marshburn over 3 years ago in reply to Shweta

Is this the KB you are asking about? KB-000036287
Cancel
Vote Up 0 Vote Down

Cancel
0 Jody Marshburn over 2 years ago in reply to Shweta

What KB are you referencing?
Cancel
Vote Up 0 Vote Down

Cancel
0 Roberto Gonzalez over 2 years ago

Yes, I received 3 of the same alerts today. Have you figured it out yet?
Cancel
Vote Up 0 Vote Down

Cancel
0 Jody Marshburn over 2 years ago in reply to Roberto Gonzalez

No sir, I have not. Please let me know if you find out anything.

-Jody
Cancel
Vote Up 0 Vote Down

Cancel
0 Roberto Gonzalez over 2 years ago in reply to Jody Marshburn

It might be a false positive. Take a look at the article below.

Ransomware and CompatTelRunner.exe - Microsoft Community
Cancel
Vote Up 0 Vote Down

Cancel
0 Jody Marshburn over 2 years ago in reply to Roberto Gonzalez

Thats what I was thinking but I put a ticket in with SOPHOS and they said it was real.
Cancel
Vote Up 0 Vote Down

Cancel
0 Roberto Gonzalez over 2 years ago in reply to Jody Marshburn

I also uploaded a copy of the file to VirusTotal and the scan came back clean. Thank you!
Cancel
Vote Up 0 Vote Down

Cancel
0 Jody Marshburn over 2 years ago in reply to Roberto Gonzalez

Thanks for the info
Cancel
Vote Up 0 Vote Down

Cancel