Malware detected in ePolicy Orchestrator due to Deep Freeze

[off2]

My origination is getting ePolicy Orchestrator notifications that are saying that malware is detected and handled due to deep freeze. This seems like a mistake as deep freeze has been used for some time. Just wanted to bring this McAfee's attention. Any suggestions?

[cdinet]

Submit a sample to be sure that your deep freeze hasn't been infected for any reason.  You can submit it as a false detection so if it is not infected, they can reverse the detection in the dats.  

https://www.mcafee.com/enterprise/en-us/threat-center/how-to-submit-sample.html

[Pinard]

Hi,

We're also having multiple detection related to Faronic Deep Freeze console and client services. Is this an known issu? Can it be concidered has false positive. If so, what would be the recommended step? Create a path excusion?

Regards

[cdinet]

I am going to move this over to the team that handles malware, but we would always recommend, in every detection that might be thought to be false, to submit a sample for analysis.  I would never recommend a blind exclusion without it being analyzed first if it was detected as anything.

[off2]

According to Faronics this is a known issue they are monitoring currently. I am working on submitting this as a sample for MacAfee right now to determine my next step. I believe this is a false positive but I don't want to get ahead of myself.

[Pinard]

We have open a service request and support have confirmed that it is a false positive in AMCore 4641 and 4642. It's fixed in AMCore 4643.

[Eddies]

Good morning, has this been fixed? we are pulling 4848 and still seem to have this issue.