OwlyShield detect taskhostw.exe or svchost.exe like Ransomware activity during Windows Update execution about owlyshield HOT 1 OPEN

Hi,

Thank you for your feedback!

We have indeed observed false positives with extreme disk activities, especially those arising from Windows updates.

We are working on implementing additional features to our model, which is time-consuming. We aim to release these updates by the end of September or early October (and take this opportunity to refresh our lagging GitHub repository).

You got it right: in the meantime, please ensure that you populate the file C:\Program Files\Owlyshield Ransom Community\config\exclusions.txt with the following content:

taskhostw.exe
svchost.exe

Then, restart the Owlyshield service.

from owlyshield.