hpcEN114.chm false positive?

[User84466004]

In our environment I seem to have an ongoing issue with virus alerts being triggered under specific circumstances. The malware notice is as follows:

Threat Category: Malware detected

Threat Type: Potentially Unwanted Program

Threat Name: Susp Attachment!chm

Threat Severity: Critical

Threat Event ID: 1027

File Infected: C:\Users\redacted\AppData\Local\Temp\hpcEN114.chm

Event Description: Infected file deleted.

Threat Handled: True

Detection Method: On-Access Scan

Detection UTC Time: 03/15/23 13:23:23 UTC

Received UTC Time: 03/15/23 13:27:11 UTC

DAT: 5101.0

Source Process: C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE

The way these alerts are triggered is always when the user is using Outlook, opens an attachment, tries to print the attachment.

Research leads me to believe the .chm file is an HP printer help file that is detected as potentially malicious.

The HP printers installed for these users range in models but I have been unable as of yet to confirm if they are all using a similar version of a HP universal driver.

Has anyone dealt with this issue in the past or have any insight?

[ueno]

Hi @User84466004,

Although we could not immediately confirm the information on the file detected in this case, it is possible that it is a false positive if it is a file used in an HP printer, but we need to analyze it once in our lab to accurately determine if it is a false positive or not.

Therefore, if you need to determine for sure whether a detected file is malware or not, please submit a service request for analysis.

Please refer to the following KB for instructions on how to send detected files to us.

[Submit potential false positives from the product or through GTI to Trellix Advanced Research Center]

https://kcm.trellix.com/corporate/index?page=content&id=KB85567