iTunes blocked

[thegyrofrog]

Immunet blocked iTunes.exe.  This occurred when I was using iTunes to bulk modify some tracks.  Afterward, I can't find the iTues files under Program Files (where I'd expect them to be -- I don't recall having to go look for them before now).

Event Type: Process Blocked
Detection Name: W32.MAP.Ransomware.rewrite
File Path: C:\Program Files\WindowsApps\AppleInc.iTunes_12124.1.57017.0_x64_nzyj5cx40ttqa\iTunes.exe
Date: 8/10/2022 21:48:12

(I've already submitted this via https://www.immunet.com/false_positive)

P.S. I ended up reinstalling iTunes, and the program runs.  It looks like iTunes went ahead and completed what I was trying to do; I've not tried doing that again so far.

Edited August 11, 2022 by thegyrofrog
add what happened

[ritchie58]

Did you try to "Restore" the Program Files iTunes folder from Quarantine the first time around? If not that's something you should have first tried.

It is good that you submitted a FP report to the devs. If the program is running normally perhaps the devs have fixed this. Let us know if you run into any more issues with the iTunes app & Immunet.

Best wishes, Ritchie...

[thegyrofrog]

On 8/17/2022 at 5:41 PM, ritchie58 said:

Did you try to "Restore" the Program Files iTunes folder from Quarantine the first time around? If not that's something you should have first tried.

I didn't see your response until now, so I can't quite remember exactly what I did or didn't do.  But I do know that I checked under "Quarantine" (in the app) and there was nothing in there.  This surprised me, I've had it move other programs there (that I wasn't using at the time, or rarely use at all), but iTunes wasn't in there (in fact, nothing was in there, not even the ones that had been in there before).  What I don't remember is where, or even whether, I looked through the file system to see where it might have quarantined iTunes.

It hasn't done it again since and I've been able to use iTunes without incident (although I don't think I've had another occasion to renumber songs/tracks).  I did just go under the Blocked Processes history and the iTunes event is no longer in there...

[ritchie58]

Glad to hear that iTunes are now working for you thegyrofrog!

Don't hesitate to post additional info if you run into anymore issues between Immunet & iTunes.

I love my tuneage as well! I've got a killer music library on a separate drive. " A little over 50 gigs of mainly WMA 128bit CD audio quality music files (some MP3's) that's taken me years to accumulate!"

Cheers, Ritchie...