MBAE Premium 2016 false positive for HP Printer Assistant

[Leo2552]

Starting April 19, 2017, two PCs running Malwarebytes Anti-Exploit Premium 2016 started generating a false positive on MSHTA running UDC_device_2.json.

That is associated with the HP Printer Assistant, which is no surprise since one machine uses an HP OfficeJet 8620 and the other uses an HP OfficeJet 8740.

Has anyone seen this false positive on Malwarebytes AV 2017? I have been intending to switch to that when MBAE Premium expires in May.

Any thoughts or suggestions?

 

Edited April 21, 2017 by Leo2552
Make it clearer

[Manjuni]

[Leo2552]

This is the screen, but how do we stop it the false positive from occurring?

[Arthi]

Hi All,

Can you try this build and let me know if it fixes it or not? 

https://malwarebytes.box.com/s/1wfy1x2dbjud4bt6i5f97qm8v3wq19rf

Thanks.

[wadp1]

Arthi, I can't try the build you linked us to because I am getting the same message with the free version.

Do you have any suggestions for people like me?

Thanks!

[Arthi]

Hi wadp1,

You can try the below version. It is the latest consumer build version 1.09.1.1403. 

https://malwarebytes.box.com/s/lv4ti6rik7m1w4wa45fdcd9wnh3zkqfi

Thanks.

 

[Leo2552]

On 5/1/2017 at 7:30 PM, Arthi said:

Hi All,

Can you try this build and let me know if it fixes it or not? 

https://malwarebytes.box.com/s/1wfy1x2dbjud4bt6i5f97qm8v3wq19rf

Thanks.

Hi, Arthi,

On the two machines that are using HP  Printer Assistant we have uninstalled MBAE 201l6. 

However, I have no problem with MBAV 2017 on two other PCs with Epson Workforce printers.

Thanks.

[Bastionpoint Technology]

We had Anti-Exploit block it today. Version 1.09.2.1384.

5/16/2017 12:35:10 Exploit payload process blocked BLOCKC:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe \C copy \Y C:\ProgramData\HP\HP ENVY 5540 series\HPUDC\TH6AL2T0G70671_USB\UDC_device.json C:\ProgramData\HP\HP ENVY 5540 series\HPUDC\TH6AL2T0G70671_USB\UDC_device_2.json

[Anjoland]

Yesterday my HP printer had an update.  I did the update and I had to restart my scan to PC program on my PC and I am getting the exact same MBAE block on the same file as listed in message #2.

 

MBAE: 1.12.1.139

[Arthi]

Thanks for reporting. I have sent a PM to you.

[Arthi]

Hi,

Can you please try the below build and let me know if it fixes your issue

https://malwarebytes.box.com/s/x4tymleh82850j8cld3v39dcwtn7ktgp

Thanks.

Edited December 3, 2018 by Arthi