False Positive On C:\WINDOWS\SYSWOW64\DPFPAPIUI.DLL

[MickSheehan]

We have started getting what we think is false possitives on the following dll ?

C:\WINDOWS\SYSWOW64\DPFPAPIUI.DLL 

This causes a reboot then a bad image notice after the reboot. 

Has anyone else had this issue ? ? 

[TheCiscoKid]

We are receiving alerts on several pc's as well on this file. Hopefully malwarebytes is in the process of figuring this out and alerting its customers. We believe it's a good file and has been quarantined, which is causing the issues mentioned.

[miekiemoes]

Hi,

Do you have the scan log for this please? Or attach the sample that was detected?

Please unquarantine the sample and don't reboot, so we can investigate.

Thanks!

[MickSheehan]

1 minute ago, miekiemoes said:

Hi,

Do you have the scan log for this please? Or attach the sample that was detected?

Please unquarantine the sample and don't reboot, so we can investigate.

Thanks!

Hi there 

 

please find attached logs - Im afraid its too late as a number of machines have the system set to auto reboot - subsequently after the reboot the following message is received - we assume this is due to the false positive? 

 

On reboot we get a Disk Image file is not compatible - "DP Agent.exe is not a valid windows 32 application"  

Threats Found

Name	Type	Location	Action	ID
Trojan.MalPack.Generic	Module	C:\WINDOWS\SYSWOW64\DPFPAPIUI.DLL	Found	9da710cc-ed8d-11e8-b484-b88a60e1dc95
Trojan.MalPack.Generic	File	C:\WINDOWS\SYSWOW64\DPFPAPIUI.DLL	Quarantined	9762b4aa-ed8d-11e8-bfbe-b88a60e1dc95

 

[MickSheehan]

11 minutes ago, MickSheehan said:

Hi there 

 

please find attached logs - Im afraid its too late as a number of machines have the system set to auto reboot - subsequently after the reboot the following message is received - we assume this is due to the false positive? 

 

On reboot we get a Disk Image file is not compatible - "DP Agent.exe is not a valid windows 32 application"  

Threats Found

Name	Type	Location	Action	ID
Trojan.MalPack.Generic	Module	C:\WINDOWS\SYSWOW64\DPFPAPIUI.DLL	Found	9da710cc-ed8d-11e8-b484-b88a60e1dc95
Trojan.MalPack.Generic	File	C:\WINDOWS\SYSWOW64\DPFPAPIUI.DLL	Quarantined	9762b4aa-ed8d-11e8-bfbe-b88a60e1dc95

 

[TheCiscoKid]

On further research, this file appears to be a file necessary for HP Protect Tools. See the following link: http://www.shouldiblockit.com/dpfpapiui.dll-23901.aspx

[miekiemoes]

Thanks for the feedback - This was a generic detection (as the detection threatname implies). We believe we found the culprit and will push out an update immediately.

Still, in case you have not rebooted yet, please zip and attach this exact DPFPAPIUI.DLL that was detected, so we can have a closer look.

 

Thanks!

Edited November 21, 2018 by miekiemoes

[miekiemoes]

Hi,

We could find the actual file already, verified, and the detection has been removed in a meanwhile starting in Following databases:

MBAM2 Version: v2018.11.21.07
MBAM3 Version: 1.0.7957

[ROBERT-HP]

I too have experienced the issue on 11/21/18 regarding the DPFPApiUI.dll is missing from your computer DPAgent.exe Sys Error.  My mbam-log (attached) contains 1 - Memory Module delete on reboot, 1 - Registry Value quarantined and 1 - File detected delete on reboot.  What action must I take to get back the now missing DPFPApiUI.dll on my Windows 7 Professional 64-bit SP1 system?

mwb_log_2018-11-21.pdf

[miekiemoes]

Hi,

You can unquarantine the items and reboot afterwards to get this back, or you can reinstall the HP ProtectTools Security Manager.
https://h30434.www3.hp.com/t5/Notebook-Software-and-How-To-Questions/How-to-download-HP-ProtectTools-Security-Manager/td-p/6843601