MachineLearning/Anomalous.100% on our .NET product IDEP/CN8 for Windows

[Marius_Revolux]

Our product IDEP/CN8 for Windows, built for Microsoft .NET Frameworks 2.X and 4.X is being detected as a false positive

This product is being updated regularly thus the signature, version and size of the file may change over the year.

We are currently rolling out our version for the year 2019 and some of our clients are experiencing problems.

We would appreciate a quick remediation to this problem.

Thanks in advance,

  Marius

idep.zip

[Marius_Revolux]

FYI, the detection logs

mbam-idep.txt

4659fb20-fec4-11e8-822f-00ffb0dfa50f.txt

[miekiemoes]

Hi,

This is detected by our MachineLearning engine, which helps to protect even better against 0day threats. Unfortunately, as this is a heuristic engine, it's possible False Positives happen. Also see here for more explanation: https://forums.malwarebytes.com/topic/238670-machinelearninganomalous-detections-and-explanation/
Thanks for reporting these, as this helps to finetune the engine, so these won't be detected in the future anymore.

This should be fixed by now. Please give it some time (max 10 minutes) in order to have it populate, so detection won't happen anymore.
 

[Marius_Revolux]

Ik ben benieuwd. Bedankt voor het snelle antwoord.

Many thanks for your prompt reply!

[miekiemoes]

In some cases, it might take a bit longer for it to populate, as this is a fix in the cloud, where some ISP providers have cached previous results already.

This only applies for when it was detected before already.

In order to bypass this easily, so it re-forces to get the fresh (non cached one), quit Malwarebytes, navigate to the C:\ProgramData\Malwarebytes\MBAMService folder and locate the file HubbleCache in there. Then delete that file.

When you start Malwarebytes again, it will redownload the hubblecache again where it won't be detected anymore.

Edited December 13, 2018 by miekiemoes