Database v2016.08.11.05 detecting WebEx as Trojan.MalPack

[RobinCM]

As title. Lots of machines are reporting a file called atinst.exe as Trojan.MalPack.

This file is part of Cisco WebEx.

Paths detected in:

C:\ProgramData\WebEx\WebEx\1224\atinst.exe
C:\ProgramData\WebEx\WebEx\500\atinst.exe
C:\ProgramData\WebEx\WebEx\1524\atinst.exe
C:\ProgramData\WebEx\WebEx\T30_EC\atinst.exe
C:\ProgramData\WebEx\WebEx\T31_UMC\atinst.exe
C:\ProgramData\WebEx\webex\500\atinst.exe.tmp
C:\ProgramData\WebEx\atinst.exe
C:\Users\xxxxx\Downloads\atinst.exe

 

 

 

[miekiemoes]

Hi,

 

Can you zip and attach the atinst.exe file?

[miekiemoes]

Hi,

I retrieved the file from somewhere else. This is a false positive indeed and will get fixed in next database.

[thisisu]

This should be fixed in database v2016.08.11.07 which is available now. Please let us know if that is not the case for you.

[miekiemoes]

Hi,

This has been fixed in v2016.08.11.07 which we pushed out already.

Thanks for reporting!

[ClimbGuy]

Had a handful of other .exe's get quarintined for the same reason Trojan.MalPack at the same time.  Is there a way to know if they are related to the database version?

[miekiemoes]

Yes, these should be the same. Please restore these from quarantine, update the database and let me know if these are still detected.

[ClimbGuy]

That took care of it.  Thank you.  I new the webex were false per the posting - but just wanted to be safe and sure on the others.  I appreciate the quick response.