Malware.Heuristic.1003 in many 'Cyberpower PowerPanel Personal' files

[darkred]

Malwarebytes has marked 132 items (50 modules and 82 files) as "Malware.Heuristic.1003" in Cyberpower PowerPanel Personal 2.3.2 installation folder C:\Program Files (x86)\CyberPower PowerPanel Personal
I recently (Sept 29 updated CyberPpower software from 2.3.0 --> 2.3.2 ) . Before that CyberPower update, MBAM never marked Cyberpower files as threats before.
Using MBAM 4.4.7.134 free with its default settings (" Expert System Algorithms" is always off, by default).

I attach the log.

 

Thank you

mbam 2021-10-3~.txt

[Porthos]

34 minutes ago, darkred said:

as "Malware.Heuristic.1003" 

 

[darkred]

I wrote in the OP that "Expert systems algorithms" is off by default. (see attached screenshot). 
Therefore the files shouldn't be found as "Malware.Heuristic.1003", right?

I could add the detected files to the Malwarebytes exclusions of course, 
but can't MBAM (core of database) be updated to not detect these CyberPower files with this heuristic?

[shadowwar]

Can you please zip and attach those files detected here. We are looking into this. 

[shadowwar]

Also please dont change any settings in mbam. We may have you run the support tool to figure out why this is happening. If mbam was obeying the setting you showed they shouldnt of been detected. Hope you wouldnt mind troubleshooting with us?

[darkred]

I attach the 82 files (zip, maintaining their paths) of Cyberpower PowerPanel Personal 2.3.2.

If anyone wants to install the program itself, you can download 2.3.0 from https://www.cyberpowersystems.com/products/software/power-panel-personal/
and after installation, as you launch the program, click the "i" button and then "Check for Updates" to update to 2.3.2 from inside the program.

 

No, of course, I won't change any settings in mbam. I'd gladly help you troubleshooting this.

the 82 files.zip

[shadowwar]

Can you please attach the mbamservice.log located in 

C:\ProgramData\Malwarebytes\MBAMService\logs

all of the log files we be great. 

 

[shadowwar]

After you get those logs can you run a scan with this enabled?  collect enhanced event log data for support

 

[darkred]

I sent it to you via pm.
It also contains some irrelevant entries (CheatTool.Agent,  Generic.Malware/Suspicious,  Malware.AI.3077952645, PUP.Optional.BundleInstaller), please ignore them all.
Also at the end of the last scan, had I clicked to "Ignore All" always. I just cleared the "Allow List" .

 

Quote

After you get those logs can you run a scan with this enabled?  collect enhanced event log data for support

Ok, I'll do it right away.

[shadowwar]

Thank you very much. This info is of great help as we cant duplicate it here so far. 

[shadowwar]

I dont see the pm yet but will give it a few mins. 

[darkred]

My mistake, the pm wasn't sent.

I just sent them both (simple + enhanced).

[shadowwar]

Thanks. Devs are looking to see what happened. 

[shadowwar]

Not sure if you still have this going on. We release a new engine update to provide some better logging for us to help to figure out what is going on. 

If you still have this happening can you please update to 1.0.1486 engine and  then scan. Then please attach the mbamservice.log after it completes. 

[darkred]

In the meantime there has been a new update for Cyberpower PowerPanel Personal, 2.3.3, which I applied.
I also upgraded Windows to Win11 21H2 from Win10.

So, I updated to 1.0.1486 engine, and scanned: unfortunately the issue is still happening.

I send you the log (with "Collect enhanced event log data for support" enabled) as pm.

 

[shadowwar]

Great can you also send me the files in the  scanresults folder? 

This wasnt a fix but this release should help us determine what is going on as we have been unable to duplicate so far. 

C:\ProgramData\Malwarebytes\MBAMService\ScanResults

 

 

[darkred]

I just sent it to you via pm.