Hello,
One of our machines is generating this alerts when user is trying to run automations on the chromedriver. It says ransomeware detected. CryptoGuard trying to encrypt files. Can someone please assist or have experienced the same. Let me know what to do and how to resolve it.
Hi Jayesh,
Thanks for reaching out to the Sophos Community Forum.
I suggest checking the detection details in Event ID 911 in the Windows Application Event log. You can also find the same information in Sophos Central by clicking the "Details" button on the detection event.
If the observed operations match what the automation is programmed to do exactly, then the app/automation may be working as intended, and an exclusion can be considered.
If you can provide the event details here, I can try to advise further. A similar topic was raised in the thread I linked below, the details shared may provide more insight into why/how these detections are generated.
- False positive for javaw.exe
Could you post the full detection details? It will look similar to the one posted here.
Reply from Reinaldo Flamino
Are you seeing this detection on a macOS device or Windows? If this is a Windows device, the detection details will be much easier to find.
If the device you're seeing this on is a macOS device, I suggest running SDU log collection. You can find details within the SophosDiagnostic logs corresponding to the detection event.
Send the logs to me via private message and I'd be happy to take a look.
