AMP Blocking Windows Updates

[deyster94]

I have an ASA 5516 installed at two clients and both are reporting some Windows Updates are being blocked by AMP.  I looked at the Files->Malware events and there are a number of .cab files being tagged as malware.  Not sure why this is happening and would like to know if there is a solution other than adding those files to the clean list.  

Here is one of the alerts (scrubbed) from one of my clients:

><*- Network Based Malware

>From "192.168.x.x" at Thu Nov 12 02:43:57 2015 UTC -*>

>Sha256: c185927546db202a75dd47d7c32d19dbd2e477326741686d08b65e5b44f0834b

>Disposition: Malware

>Threat name: W32.Variant:GenMaliciousDYI.18mf.1201

>IP Addresses: 192.168.x.x<-69.31.21.26 ------> This address is owned by Akamai Technologies, who is a Content Delivery Network.  I assume MS uses them to deliver updates. 

My laptop is also running AMP for endpoints and popped up about these threats.  

TIA for any suggestions,

Dan

[deyster94]

In case anyone runs into this issue, I talked to two people at Cisco and this is a known issue.  Both recommended opening a case.  One of them is our GSSO CSE and he told me to forward him the case information so he can send it off to someone who can get more help.  

If you are a Cisco partner and have clients with this issue, I would recommend open the case.  Other idea is to put a threshold on the alerts until this is resolved.

[deyster94]

Received from TAC: On Tuesday November 10, beginning at approximately 6pm Eastern time, Cisco Engineering began implementing updates to the AMP cloud servers. After the updates were complete, customers began experiencing a flood of false positive AMP events. Cisco Engineering has since implemented workarounds to alleviate the false positives, but it will take some time to correct the situation completely. Cisco AMP Engineering is still investigating the root cause of the issue. Cisco AMP Engineering will provide a Root Cause Analysis document for customers requesting this, within five business days.