False Positive on Heidleberg Engineering software -- that has reoccured .

[BobSoul]

This has appeared once again with the next updated driver - This File is from Heidleberg Engineering Software for FA and OCT machines.

This is the last post from before

 

Todays detection :

 

 

OS platform: Windows Category: Malware Type: file Location: C:\PROGRAMDATA\{9F5B1D86-96A8-483E-948D-07A8B60BA16A}\ACQUISITIONMODULE\43A61262\C567ED7E\HEDRIVERUPDATEFORCED_T1.36_I2.21.EXE Action taken: Quarantined Scan time: 2021-11-12T18:01:02Z Report time: 2021-11-12T18:24:56.943701428Z Threat name: Malware.Sandbox.23

HEDriverUpdateForced_t1.36_i2.21.zip

[BobSoul]

I have ran a forced update on the machine to verifiy latest updates etc .... Stand alone malwarebytes says its clean nebula detects it as not .. Also ran scan with emsisoft as well came back clean.  Scan in morning said file was clean then 3 hours later said it wasnt -- so assuming false detect like before ( after it updated)

 

Edited November 12, 2021 by BobSoul

[shadowwar]

This file is over 6 years old so maybe was a different detection last time? I have whitelisted this file. 

 

[BobSoul]

Ok thanks -- the file is for the actual camera's firmware aquisition module that works with the laser so depending on the make year model of the physical camera the files can be old or new based on that.. Medical equipment tends to run longer lifespans then other software :)  the last detection was for version 35 this is version 36 so I think that may be the trigger that changed. Different model serial number of the camera in question