AMP for Endpoints false positive detection?

[jared]

I have been notified from AMP of detecting Auto.A29577.201440.in02 from a file with SHA-254: a2957772fba9827bf5fda166282b557947ebf07ca9beadb76ff63c129ee336ea.

I've researched in:

https://supportforums.cisco.com/discussion/12702996/amp-blocking-windows-updates

https://supportforums.cisco.com/discussion/12701831/malware-false-positives-after-windows-update-releases-10november

http://www.talosintelligence.com/amp-naming/

for support and information. 

I am still unsure if the file is still a false positive. Any further information and guidance is welcome.

Thank you. 

[Matthew Franks]

I would suggest opening a TAC case so the file can be analyzed.  The hash is currently listed as malicious but there is no copy that I can run further analysis on.  Please open a case and provide the file for analysis.

Thanks,

Matt

[jared]

Will do.

Thank you,

Jared

[Matthew Franks]

You're welcome!

[Farhan Mohamed]

Please see the support forum below:

https://supportforums.cisco.com/discussion/12702996/amp-blocking-windows-updates

If solution is not found, Please send me screen shot i will further investigate.