Anti-Malware False-positive or Real?

MassimoRiva

hi, I have updated the signature but the problem still persist with other king of file. I send you my screenshot.

thank you.

Immagine 2023-05-05 132205.jpg

Immagine 2023-05-05 132350.jpg

Immagine3.jpg

MBS

I have the same, ATP100:

warn anti-virus FILE DESTROY

Virus infected SSI:N Type:Anti-Malware Signature Virus:Gen.Variant.MSILHeracles.da651960 File:AD2F1837.HPPrinterControl_145.1.1083.0_neutral_~_v10z8vjag6ke6. Protocol:HTTP

I have uninstalled the HP update for printers and the problem ends

PhilippeBkk

https://community.zyxel.com/en/discussion/comment/51711#Comment_51711

No matter how many time trying to update, Tread intelligence MAchine Learning remain very much outdated…. 2017…

PhilippeBkk

https://community.zyxel.com/en/discussion/comment/51713#Comment_51713

Same for me

MassimoRiva

hi to all the problem seems to be solved after the saturday signature update.

regards.

LucaPapaleo

Hello,

I've tryed again to update signature, but I still have the problem.

Attaching: signature update, signature release, firmware release and log.

Now it's too much day with this problem!

Please solve

Luca

log.png

Release Firmware.png

Release Signature.png

Updating.png

Zyxel_Jeff

Dear all users,

We are currently investigating the problem. Please add the File Pattern "AD2F1837.HPPrinterControl*" on the Allow list in your Anti-Malware settings:

Here is the on-premise firewall setting:

Here is the Nebula firewall setting:

We will provide an update as soon as we have more progress. Thank you for your patience.

LucaPapaleo

Hello,

once you've provided fix it would be better to remove this exclusion?

Just to keep trace about the settings (300 firewall to manage!)

Thanks

Luca

KS1983

I agree with LucaPapaleo, I think it would be better to delete the whitelist entry after your fix. Please confirm.

Zyxel_Jeff

https://community.zyxel.com/en/discussion/comment/51843#Comment_51843

Hi @LucaPapaleo and @KS1983

Many thanks for your update. Currently, we are fixing it now. Adding the issued file pattern to the allow list should be a temporary workaround solution, so you can add this file pattern on the site that has this false positive detection and maybe won't add it to every managed firewall. Really appreciate your patience so far. Thanks.