This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ScanSnap Auto Update detected as Ransomware

as title suggest, scansnap autoupdate located in programdata folder is reported as ransomware. i dont have the exact location because i am not near the computer but i have access to it remotely and trying to find the log where it shows what it cleaned up, and cant find the right log.

This thread was automatically locked due to age.

Rincewind over 7 years ago
Jamie,

We will need the following sent to us:-

File output from Sophos Diagnostic Utility ( you find this from the program files menu )

Zip'd collection of log files from C:\ProgramData\Sophos\Clean\Logs and C:\ProgramData\HitmanPro.Alert\Logs

You can use https://www.wetransfer.com/ for free to send us the file. Suggest you zip them all together and use a password. Please send the details to me via the forum messaging.

Thanks

JG
Cancel
Vote Up 0 Vote Down

Cancel
JamiePassalacqua over 7 years ago in reply to Rincewind

sent you the log files. anyway to run the diagnostic utility remotely?
Cancel
Vote Up 0 Vote Down

Cancel
alex lafrenz over 6 years ago in reply to JamiePassalacqua

Hello,

Just had the ScanSnap update get flagged as Ransomware today. Was there ever a resolution to this?
Cancel
Vote Up 0 Vote Down

Cancel
jak over 6 years ago in reply to alex lafrenz

Can you post the contents of the event log entry for the detection? It's in the application event log with the event id of 911.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
alex lafrenz over 6 years ago in reply to jak

Jak,

Where can I find documentation on exporting these logs?
Cancel
Vote Up 0 Vote Down

Cancel
jak over 6 years ago in reply to alex lafrenz

So you can run:

Windows+R

This will open the Run Dialog box. In that type:

eventvwr

hit enter.

This will launch the Windows Event Log. Expand to find the Application Event log and scroll down or filter to find event ID 911. There should be a Hitman Pro existing filter but searching the Application event log should do.

You can copy and paste the description of the event here.

Regards,

Jak
Cancel
Vote Up 0 Vote Down

Cancel