Anti-Malware False-positive or Real?

BCC

We have multiple devices reporting this detection:

Virus infected SSI:N Type:Anti-Malware Signature Virus:Gen.Variant.MSILHeracles.cf775202 File:AD2F1837.HPPrinterControl_144.1.1068.0

Is this another false-positive or another distributed supply chain infection event?

e_mano_e

I was just at the customers site and visited the ATP100 and have the same issue.

Anti-Malware
Virus infected SSI:N Type:Anti-Malware Signature Virus:Gen.Variant.MSILHeracles.cf775202 File:AD2F1837.HPPrinterControl_145.1.1083.0_neutral_~_v10z8vjag6ke6. Protocol:HTTP

MassimoRiva

hi I have also me this problem. from this morning I have a lot of notifications, any news about it?

thank you.

Omnia

https://community.zyxel.com/en/discussion/comment/51612#Comment_51612

Me too!

Tiba

me too

Virus infected SSI:N Type:Anti-Malware Signature Virus:Gen.Variant.MSILHeracles.cf775202 File:AD2F1837.HPPrinterControl_145.1.1083.0_neutral_~_v10z8vjag6ke6

Alferic

me too.

1    2023-05-04 09:22:45 95.140.230.128:80                               xxx.xxx.xxx.xxx:63792                            
     crit                anti-virus             FILE DESTROY                                    
     Virus infected Rule_id=20 SSI=N Virus=B13 Gen.Variant.MSILHeracles.cf775202 File=DzOzV9ZF9zv27MeZ6c7I1lw4fTbkwPezJo9zsO6llJ8q0JaqRddga04cvLwUwK3 Protocol=HTTP
            
1    2023-05-04 08:39:47 93.184.221.240:80                               xxx.xxx.xxx.xxx:49557                            
     crit                anti-virus             FILE DESTROY                                    
     Virus infected Rule_id=20 SSI=N Virus=B13 Gen.Variant.MSILHeracles.cf775202 File=zhTWGauq44YN Protocol=HTTP

edit:
another one ip source (from one other my internal host): 209.197.3.8
I thinks is a false positive for windows update protocol, but i'm not sure.

LucaPapaleo

I've several firewall ATP Series. All of them are detecting the same issue.

Please FIX IT!

It isn't first time

Thanks

Luca

PhilippeBkk

Same for me ATP200.
It start already 2 weeks back. I manually block IP. LAst week it was quiet and thjis week it is a disaster and CDR kick out users.

Please fix this
Philippe

Zyxel_Jeff

Dear all,

Many thanks for reporting this case to us. Please add the issued hash value to Anti-Malware's allow list now. You can refer to this FAQ article for guidance.

https://community.zyxel.com/en/discussion/15174/how-to-resolve-anti-malware-and-sandboxing-false-positive-case

Additionally, we will send private messages to you, please help to provide the necessary information to us for signature correction. Thanks.

e_mano_e

I was just at the customers site and visited the ATP100 and have the same issue.

Anti-Malware
Virus infected SSI:N Type:Anti-Malware Signature Virus:Gen.Variant.MSILHeracles.cf775202 File:AD2F1837.HPPrinterControl_145.1.1083.0_neutral_~_v10z8vjag6ke6. Protocol:HTTP

e_mano_e

As a follow up: No Hash value was shown.

I had to add a file pattern to the Anti-Malware allow list.

Zyxel_Jeff

Dear all users,

Thank you for providing us with your feedback so far, both on the public discussion page and through private messages. We greatly appreciate it. Could you update our latest Anti-Malware signature and check if the malware detection issue still persists?

If so, please share the Anti-Malware log screenshots, the model name of your device, and the Anti-Malware signature version with us. Thank you!