wreadd Posted August 14, 2020 ID:1401120 Share Posted August 14, 2020 Same thing for our entire company as well. I did some digging and it looks like trendmicro had the same thing back in 2017 and they pushed out a patch. Looks like it may be a false positive. https://success.trendmicro.com/solution/1117328-pe-expiro-ge010014-uvpm-false-detection-caused-by-smart-scan-pattern-13-377-00 Link to post Share on other sites More sharing options...
wreadd Posted August 14, 2020 Author ID:1401127 Share Posted August 14, 2020 anyone else having this reboot their machines? As users populate into the "quarantined" list getting hit by this, it's causing their computers to restart. Link to post Share on other sites More sharing options...
dblk Posted August 14, 2020 ID:1401148 Share Posted August 14, 2020 We are also getting multiple alerts for this detection, not sure if users are having to reboot their machines but below is an example of the detection alert. 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup (1).exe 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup (2).exe 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup (3).exe 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup (4).exe 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup (5).exe 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup (6).exe 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup.exe 8/14/2020 2:18:34 AM CL61397 removed IP Spyware.RedLineStealer Quarantined C:\Users\bauern\Downloads\ChromeSetup.exe Link to post Share on other sites More sharing options...
cna Posted August 14, 2020 ID:1401156 Share Posted August 14, 2020 Same here. Happened in all 3 of my satellite offices. Not getting reboots and chrome seems to be functioning normally. Link to post Share on other sites More sharing options...
wreadd Posted August 14, 2020 Author ID:1401159 Share Posted August 14, 2020 53 minutes ago, dblk said: We are also getting multiple alerts for this detection, not sure if users are having to reboot their machines but below is an example of the detection alert. 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup (1).exe 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup (2).exe 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup (3).exe 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup (4).exe 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup (5).exe 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup (6).exe 8/14/2020 2:17:35 AM CL61662 removed IP Spyware.RedLineStealer Quarantined C:\Users\kaplanh\Downloads\ChromeSetup.exe 8/14/2020 2:18:34 AM CL61397 removed IP Spyware.RedLineStealer Quarantined C:\Users\bauern\Downloads\ChromeSetup.exe Yeah, its a false positive. We got rid of malwarebytes the otherday and kept some overlap with malwarebytes and our new softwarea (crowdstrike) and they let us know it was a false positive as they investigated it for us because their product never flagged it. You get what you pay for I guess. Link to post Share on other sites More sharing options...
KDawg Posted August 14, 2020 ID:1401204 Share Posted August 14, 2020 Please update from your Management Console the Database for affected systems.We confirmed this was a False Positive and have removed from detection moving forward. Apologies for any inconvenience.The issue should no longer occur on or past Database version:v2020.08.14.07Please let us know if you are on this latest database or newer and still continue to receive detection's? Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now