Malware detected - false positive

[kblowe]

Hello,

ENS On-Access Scans (OAS) and On-Demand Scans (ODS) are triggering that "GenericRXWE-OT!2210F62E6B5A" is detecting software in C:\Windows\cmcache\ as Malware Detected on many Windows Server operating systems. We are on the latest ENS 10.7.0 April 2023 Update Repost. I have made exclusions to exclude the directory from OAS & ODS and did a quarantine restore. But the detection keeps occuring for On-Access Scan.

Its clearly a false positive. What can be done about this?

[Daveb3d]

Using low/high risk processes? That might impact your exclusion.  

Is ccmexec.exe the accessing process? If so, better to set that as a low risk process than exclude the folder, and then don't scan low risk processes. 

[kblowe]

Yes using low/high risk processes.

The file in the directory is setup.exe being deleted from malware/torjan majority of the time.

I don't want to exclude setup.exe, because that will allow setup.exe from any application/software.

Not to mention this all started on 6/30/2023 and we haven't had this problem before.

I take its something with the AMCore update that triggered this the GenericRXWE-OT!2210F62E6B5A detection.

[Daveb3d]

I would just submit it to Trellix as a false positive.  

[kblowe]

Yup i'm going to do that, becasue I was able to do a ENS restore from quarantine, but on a few servers it continues to happen. thanks.