"Possible ransomware detected" alert on my screen now

What application is this that triggered the warnings?  Figure that out and if you trust that application trusting the processes should be fine.  If you do not know what app is causing this I would not allow it.  The run32dll has been used by malware to deliver payloads in some cases.

Thank you very much for your reply, Enchantech!

I couldn't figure out what app caused it.  All my startup items, and Event Viewer, looked good.  And googling didn't explain to me what C:\Windows\AppCompat\Programs... is about, so I couldn't ascertain the likelihood of malware being at fault.

So I blocked it.  About 3 times before I talked myself into a permablock on it (hopefully that means whatever caused it, not on run32dll.exe itself!).

Only one of about 18 affected files could be recovered.  But all seems well with the system.

Still, I'm considering restoring a system drive backup from perhaps a week ago.  Does that seem prudent?
 

coyote, I would suggest taking a look at the contents of some of the XML data files that are found in the C:\Windows\AppCompat\Programs\Install folder - you can open these in Notepad.

Doing that on my computer shows updates from various programs, including my Security Suite, as well as my email client and FTP client etc.

Thank you very much for your reply, Steve!

Ah yes, I see that everything in that folder reflects an install or update of one of my programs.

But to be honest I don't know if this is a good or bad sign (that is, suggests I shouldn't be concerned, or suggests I restore a system backup).

FWIW Malwarebytes scans clean.

Actually I've been a bit tempted to restore a system backup for a completely unrelated reason in any case.  (I just solved the other unrelated reason.)

Here's a link that also discusses rundll32:

https://forum.acronis.com/forum/acronis-true-image-2018-forum/active-pr…

Very interest, thank you very much, FtrPilot!

I'll definitely try that command (which Enchantech suggested in that other thread) if this pops up again.  (Now it just returns: "No tasks are running which match the specified criteria.")

Here's a followup a week later:

I had no issues for a week.  Every malware scan I threw at Win8.1 was clean.  I didn't see any cause to conclude that the AAP warning had been of concern.

But yesterday just in case I restored a system drive backup from 3 weeks ago.  Because after all, "just in case" is why ATIH is so very important to me in the first place.

Thanks for the update / feedback coyote, hope all remains well!

Now I'm frustrated.

All was well for a month...then it happened again (that I got another Acronis Active Protection "Possible ransomware detected" warning that rundll32.exe is trying to modify files in C:\Windows\AppCompat\Programs).

So as planned I tried the "tasklist /m /fi "imagename eq rundll32.exe" command Enchantech suggested in that other thread, but that just returned "No tasks are running which match the specified criteria".

I (searched forum threads and) tried looking at the AAP logs, but honestly I couldn't understand them enough to benefit from them.

So I'm running some malware scans (which I'm guessing will be clean) then I'm going to just go ahead and restore an even older OS drive image.

Somewhere in the forum threads I read on this, I noticed Ekaterina suggesting they ought to make it easier for a user to figure out whether the AAP warning-activity was benign or not.  I sure hope so, because what is frustrating me is that I can't figure it out, and restoring from backups is time consuming (given that I first need to backup new files, and then need to apply updates since the backup).

In the meantime, what else can I do?  (For example, is there some way I can make my AAP log[s] available next time so someone can help me figure out if the program that invoked rundll32 was benign [and thus perhaps save me from unnecessary backup restorations]?)

Have you used the 'Find' option of the MVP Log Viewer tool to check for the relevant entries?

Hi Steve, thank you very much for your reply.  I did search through the log looking for rundll32.exe (just with Notepad), and then again just now with MVP Log Viewer (a 1.x version), and after examining it agasin carefully I still have no idea how to tell from it what program is invoking rundll32.

Oh, I then upgraded to the MVP Log Viewer 2.10 from the link in your sig, and 2.1 wouldn't open (filesize = 0 error) it.

Try version 2.21 from the link here - which is the one I am using.

Thanks for 2.21 Steve, yes that did open my AAP log.

And maybe I can understand something; for example here's a few consecutive lines:

Would it be safe for me to infer from that the line citing GoogleUpdate.exe comes immediately before the lines saying rundll32.exe started, and was "not trusted", that GoogleUpdate.exe was the program that invoked rundll32.exe ?

If so, then perhaps I know what to do next time!  (I'm not committed to the restore operation now, but it will be great if I can know next time if it's avoidable!)

Would it be safe for me to infer from that the line citing GoogleUpdate.exe comes immediately before the lines saying rundll32.exe started, and was "not trusted", that GoogleUpdate.exe was the program that invoked rundll32.exe ?

That is how I would probably infer here from the log information. GoogleUpdate is run as a scheduled task on my computer to keep my Google Drive application up to date but I haven't seen any warnings from AAP for this.  I do not have any other Google applications such as Chrome installed - I got fed up with their Software Reporter tool stealing CPU with no option to disable it so completely removed Chrome to get rid!

Cool, thank you very much!

It absolutely is a scheduled Task for me too, both for Google Drive and the Chrome Browser I imagine.