False Positive on Heidleberg Engineering Software Still

[BobSoul]

I have had this happen a few weeks before and it was corrected but once again its detecting the software again this time other files in the program folder

 

• Category: Malware
• Group name: NF
• Public endpoint IP: 
• Endpoint name: 
• OS platform: Windows
• OS release name: Microsoft Windows 10 Home
• Location: C:\PROGRAMDATA\{54EBF5CA-E498-4C12-9E66-E1831EEFE584}\SPECTRALIS.EXE
• Policy name: 
• Report time: October 7th 2022, 14:13:22 UTC
• Scan time: October 7th 2022, 14:01:01 UTC
• Action taken: Quarantined
• Threat name: Malware.Sandbox.1
• Type: file
•  

• Category: Malware
• Group name: 
• Public endpoint IP: 
• Endpoint name: 
• OS platform: Windows
• OS release name: Microsoft Windows 10 Home
• Location: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{999594F7-3B8F-45A7-9DCA-7C3EF1287CB0}
• Policy name: 
• Report time: October 7th 2022, 14:13:22 UTC
• Scan time: October 7th 2022, 14:01:01 UTC
• Action taken: Quarantined
• Threat name: Malware.Sandbox.1
• Type: reg_key
•  

• Category: Malware
• Group name: 
• Public endpoint IP: 
• Endpoint name: 
• OS platform: Windows
• OS release name: Microsoft Windows 10 Home
• Location: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Heidelberg SPECTRALIS Software
• Policy name: 
• Report time: October 7th 2022, 14:13:22 UTC
• Scan time: October 7th 2022, 14:01:01 UTC
• Action taken: Quarantined
• Threat name: Malware.Sandbox.1
• Type: reg_key

I wasnt in office today to get the diag files or the exe file ... wont be able to till when we re open on monday since machine is now turned off, however the following threads show the history of theses detections before with links to previous ones as well in same post

 

 

Edited October 10, 2022 by BobSoul

[BobSoul]

I did just check the nebual dashboard and they do not appear in the quarantine list - though on the endpoints scan shows they where quarantined... maybe cause the endpoint is offline -- or was it fixed since this morning and files not actually quarantined?

 

[BobSoul]

I was wondering if there was any update on this detection

 

[miekiemoes]

Hi,

Can you zip and attach the following file, so I can have a look? : C:\PROGRAMDATA\{54EBF5CA-E498-4C12-9E66-E1831EEFE584}\SPECTRALIS.EXE

Thanks!

[BobSoul]

I wasnt able to get to the file till this morning so I have it and the diag file now as well

Malwarebytes Diagnostics (6).zip Spectralis.zip

[miekiemoes]

Thanks. This should no longer be detected anymore.

[BobSoul]

thank you!

 

[BobSoul]

Still happening again  - this morning - different machine -- same thing heidleberg software  once again

 

• Category: Malware
• Group name: OP
• Public endpoint IP:
• Endpoint name: 
• OS platform: Windows
• OS release name: Microsoft Windows 10 Home
• Location: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Heidelberg Eye Explorer
• Policy name: 
• Report time: October 10th 2022, 14:26:05 UTC
• Scan time: October 10th 2022, 14:01:01 UTC
• Action taken: Quarantined
• Threat name: Malware.Sandbox.1
• Type: reg_key

• Category: Malware
• Group name: OP
• Public endpoint IP
• Endpoint name: 
• OS platform: Windows
• OS release name: Microsoft Windows 10 Home
• Location: C:\PROGRAMDATA\{9F5B1D86-96A8-483E-948D-07A8B60BA16A}\SPECTRALIS.EXE
• Policy name: 
• Report time: October 10th 2022, 14:26:05 UTC
• Scan time: October 10th 2022, 14:01:01 UTC
• Action taken: Quarantined
• Threat name: Malware.Sandbox.1
• Type: file

• Category: Malware
• Group name: 
• Public endpoint IP:
• Endpoint name: 
• OS platform: Windows
• OS release name: Microsoft Windows 10 Home
• Location: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Heidelberg SPECTRALIS Software
• Policy name: Retina Consultants
• Report time: October 10th 2022, 14:26:05 UTC
• Scan time: October 10th 2022, 14:01:01 UTC
• Action taken: 
• Threat name: Malware.Sandbox.1
• Type: reg_key

• Category: Malware
• Group name: OP
• Public endpoint IP: 
• Endpoint name:
• OS platform: Windows
• OS release name: Microsoft Windows 10 Home
• Location: C:\PROGRAMDATA\{68C74785-CBE5-4ED8-A4BC-24DAADFC09B7}\SETUP.EXE
• Policy name: 
• Report time: October 10th 2022, 14:26:05 UTC
• Scan time: October 10th 2022, 14:01:01 UTC
• Action taken: Quarantined
• Threat name: Malware.Sandbox.1
• Type: file

• Category: Malware
• Group name
• Public endpoint IP:
• Endpoint name: 
• OS platform: Windows
• OS release name: Microsoft Windows 10 Home
• Location: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{CA920751-9922-42DB-AD51-F199D40F2F0A}
• Policy name: Retina Consultants
• Report time: October 10th 2022, 14:26:05 UTC
• Scan time: October 10th 2022, 14:01:01 UTC
• Action taken: Quarantined
• Threat name: Malware.Sandbox.1
• Type: reg_key

• Category: Malware
• Group name: 
• Public endpoint IP:
• Endpoint name:
• OS platform: Windows
• OS release name: Microsoft Windows 10 Home
• Location: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{999594F7-3B8F-45A7-9DCA-7C3EF1287CB0}
• Policy name: 
• Report time: October 10th 2022, 14:26:05 UTC
• Scan time: October 10th 2022, 14:01:01 UTC
• Action taken: Quarantined
• Threat name: Malware.Sandbox.1
• Type: reg_key

Same files as before and the previous linked posts -- adding files again

and logs

Trying to make an exclusion for these is problematic cause the programdata folder name may not always be the same based on install 

Running these files against Emsisoft always comes up clean and they are the original files from heidleberg this i have verfied

 

 

Spectralis.zip

Setup.zip

112810017_MalwarebytesDiagnostics(7).zip

[miekiemoes]

Hi,

It looks like these are slight different versions, so I compared the versions and could use a more generic whitelist rule for this.

This will be applied in next database update.

[BobSoul]

Ok thank you the versions may vary like you noticed based on the types of features installed for the hardware ( OCT or FA functions workstation with camera or without etc )

When would the next database update appear ? just so I know not to bug you if more machines get flagged ... :)

 

[miekiemoes]

Since we just have done an update, I expect that the next update will be in 3-4 hours time. :)