BitCoinMiner found in Express VPN - False Pos?

[topangajack]

Today, MWB scans of two Win 7 PCs detected RiskWare.BitCoinMiner in Express VPN. The files were quarantined and the vpn no longer works. I contacted Express VPN and they claim this is a False Positive.

Scan log:

"Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 9/12/17
Scan Time: 11:30 AM
Log File: MWB Scan 9-12-17.txt
Administrator: Yes

-Software Information-
Version: 3.1.2.1733
Components Version: 1.0.160
Update Package Version: 1.0.2786
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: System

-Scan Summary-
Scan Type: Hyper Scan
Result: Completed
Objects Scanned: 2124
Threats Detected: 4
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 0 min, 59 sec

-Scan Options-
Memory: Enabled
Startup: Disabled
Filesystem: Disabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Disabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 1
RiskWare.BitCoinMiner, C:\PROGRAM FILES (X86)\EXPRESSVPN\BOOTSTRAP\AMD64\NSSM.EXE, No Action By User, [94], [434082],1.0.2786

Module: 1
RiskWare.BitCoinMiner, C:\PROGRAM FILES (X86)\EXPRESSVPN\BOOTSTRAP\AMD64\NSSM.EXE, No Action By User, [94], [434082],1.0.2786

Registry Key: 1
RiskWare.BitCoinMiner, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ExpressVpnService, No Action By User, [94], [434082],1.0.2786

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
RiskWare.BitCoinMiner, C:\PROGRAM FILES (X86)\EXPRESSVPN\BOOTSTRAP\AMD64\NSSM.EXE, No Action By User, [94], [434082],1.0.2786

Physical Sector: 0
(No malicious items detected)

(end)"

Can you confirm that this is a FP? Thanks

[shadowwar]

This will be fixed next update.

This is slightly risky as it does replace a microsoft file but it is not a bitcoinminer.

[topangajack]

Thanks for the speedy reply! So, do you think I should white list it, or wait for the update. I don't need the vpn immediately. Edit: I think I answered my own question

Edited September 12, 2017 by topangajack

[topangajack]

Good News! The lastest MWB update fixed the problem! The quarantined files were restored and Express VPN is again working.  THANKS Rich Matteo /shadowwar and all the other fine folks at MWB! This is how customer service should work - I'm very impressed. 

Edited September 12, 2017 by topangajack

[shadowwar]

Glad to hear. Thanks for reporting!