False Positive

[jschoppert]

False positive detecting Cisco/Meraki Systems Manager Network Agent as "Malware.Ransome.Agent.Generic".

Jason

[1PW]

Hello jschopert and

Please carefully read the locked and pinned topic in this sub-forum, How to report a False Positive and for developer analysis, kindly attach the 3 requested .zip archives to your next reply in this thread.

If an exclusion has not already been entered, a temporary exclusion entry might then be made available to prevent a re-occurrence for your individual system.

Thank you for beta testing MBARW and your feedback.

[jschoppert]

Here is what you asked for, one is a registry export.

Jason

logs.zip

m_agent_service.zip

Malwarebytes Anti-Ransomware.zip

Meraki-Agent-Registry.zip

[1PW]

Reference: https://www.virustotal.com/en/file/dd74c39e03889d170e55a6430119d4ad0a805e40c6b72fd07a42ecf55a91edba/analysis/1461099497/ Unsigned

Hello jschoppert:

Available data strongly suggests a false positive and, since the following pathname has been entered in MBARW GUI -> Exclusions, and the binary has been uploaded to the developers, please allow the entry to remain until you are requested to remove it:

                                 C:\Program Files (x86)\Meraki\PCC Agent 1.0.86\m_agent_service.exe

At any time, a MBARW development team member, QA team member or Staffer may request the above temporary exclusion be altered/removed.

Thank you for beta testing MBARW and your valuable feedback.

 

Edited April 19, 2016 by 1PW