Vsshelper.exe which is a component of Anti-Ransomware by Endpoint Central is marked as malicious by security applications.
Vsshelper reserve's the shadow storage space and creates regular backups, security vendors may falsely label the binary as malicious despite the fact that it is signed by ManageEngine's parent organization Zoho Corporation.
Why does vsshelper create regular backups?
A ransomware intrusion - as we already know, targets files in the system, infecting them and thereby encrypting them. To combat, vsshelper creates regular backups periodically, that are used to recover the infected files, to the latest backed-up state.
Functionalities of vsshelper :
Allowlist vsshelper.exe/ Mark vsshelper.exe as false positive.
