Attachment!script.a PUPs detected in \AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\

[User21257322]

Hi,

We have many *.js files deleted by PUP:

C:\Users\xxxxxx\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DK7Y23Q0\xxxx-v1.0.1 (002).zip\handleErrors.js C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE xxxxxx xxxxxx Susp Attachment!script.a 

the xxxx-v1.0.1 (002).zip is a small program created by ourself. 

May I know how was the program detected as a PUP? do we have to add the detection name exclusions in order to use it?

based on the file path, I saw it was detected when end user add the file as a outlook attachment, why the program not detected under other scenarios?

[johma]

HI User21257322
Please submit the script/package for us to analyze. It would be helpful if you can run a MER on the system also to collect the logs so we can see the detection. 

Information on how to do this can be found in : 
https://kc.mcafee.com/corporate/index?page=content&id=KB68030

If you can submit the case as a "false Positive" detection we can see if it can be resolved that way.