Carestream SoftDent - MachineLearning/Anomalous Shut Down Office

[Upsilon-Epsilon]

MachineLearning/Anomalous quarantined the following files (and then some) -- shut down a client's office in the middle of the day.  Wrecked their patient management system.

Also went through and quarantined all of the installer files stored elsewhere, quarantined our backups as well.

 

C: SoftDent\PWSvr\PWSvr.exe

C:\PROGRAMDATAIPWINCIPWLICADMIN.EXE

C: WINDOWS|SYSWOW64\PWCLIENT.EXE

C: SoftDent\PWSv/\PWSvrUpdate.exe

C: PROGRAM FILES (X86)\CCWARE\UPDATE.EXE

  

[blender]

Hello,

Can you provide some detection logs for this please?

How to if needed: 

 

[cli]

Sorry for the inconvenience. The files that I can find with those paths are whitelisted, so there may have been a network glitch that caused these files to be wrongly detected.
We will add additional whitelisting to avoid this happening again.

As an additional preventative measure, you can also add some of the paths to the allow list.

Thanks for reporting.