ENS 10.5.3 triggered by Mozilla Thunderbird startupCache .js files

[Former Member]

Recently did a format/install of Windows 10 Enterprise, Thunderbird (52), and McAfee

ENS 10.5.3. Seems as though all *.js files in users' Thunderbird profiles are triggering

ENS, e.g.

<system name> had Suspicious Attachment!script in file C:\Users\<username>\AppData\Local\Thunderbird\Profiles\<profile name>.default\startupCache\startupCache.4.little\cloudAttachmentLinkManager.js at 12/04/17 15:39:40 UTC

Threat was Malware cleaned, the action taken was IDS_ALERT_ACT_TAK_DEL and was detected by On-Access Scan

Getting 10's if not 100's of notices like these for the different *.js files in these directories.

[Olsen]

I have the Same Problems with McAfee ENS 10.6.1 and ePO 5.9.1

The OAS delete the Files and report this message in epo

<User> ran \\***\***\apps\Mozilla.org\thunderbird\***\thunderbird.exe, which tried to access C:\Users\****\AppData\Local\Thunderbird\****\startupCache\startupCache.4.little\*****.js. The Potentially Unwanted Program named Suspicious Attachment!script was detected and deleted.

neither excluding the folder nor the file in the OAS Rule work for me.

I tried it in the following ways

**\AppData\Local\Thunderbird\****\startupCache\startupCache.4.little\*.js
**\AppData\Local\Thunderbird\****\startupCache\startupCache.4.little\*.*
**\AppData\Local\Thunderbird\****\startupCache\startupCache.4.little
**\AppData\Local\Thunderbird\****\startupCache\**

Only deactivation of detect unwanted programs will be working, but this is not a option.

I don't know how i can terminated this false positive.

Pleas have anyone an idea???

[jess_arman · Accepted solution]

@Former Member @Olsen If you open a Service Request and submit some of the files and your scan log showing the detection as a False Positive submission to McAfee Labs as outlined in KB85567.  Then we can work to resolve the incorrect PUP categorization.

In order to see immediate relief from these detections you have a couple of temporary options. You can either do an OAS path exclusion for the file type with wildcards matching the syntax of what you're seeing being detected (more secure option). Though I do see that may not be working for @olsen...
Alternatively, you can temporarily exclude by detection name within your ENSTP Options policy for Suspicious Attachment!script ; be advised that this is a much less secure option as it will prevent detection of any PUP that would be categorized as this while the exclusion was in place. These are just suggestions if you feel that you are overwhelmed by the number of detections and need an interim method for mitigating them until the false could be resolved.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[Olsen]

@jess_armanThank you for the quick response.

I have send an example of the files to McAfee Labs and i am excited about the result.

Unfortunately the other hints you had give to me are doesn't work. Neither to exclude the Filetype nor the path. I doesn't know why and what can i further do in this case.

 The temporarily exclude of the detection of PUP is no option. Rather i will deactivating the Messages for the Users that a Malware were be found.

Best Regards

Olsen