Author Topic: Carbon Black Cloud AV seeing PM6 as a treath  (Read 510 times)

Offline hsaphoto

  • Member
  • **
  • Posts: 67
    • View Profile
Carbon Black Cloud AV seeing PM6 as a treath
« on: September 11, 2021, 09:26:27 AM »
Hello,

I've had my company laptop shutting down latest built of PM6 (6026) with a warning from Carbon Black Cloud anti-virus.

My employer's IT dept. is aware but I wanted to let you know also.

I've re-installed v.5820 without issues since.

HSA

Offline Kirk Baker

  • Senior Software Engineer
  • Camera Bits Staff
  • Superhero Member
  • *****
  • Posts: 23356
    • View Profile
    • Camera Bits, Inc.
Re: Carbon Black Cloud AV seeing PM6 as a treath
« Reply #1 on: September 11, 2021, 04:22:22 PM »
That's odd.  I can tell you that we haven't put any ransomware in our software.

-Kirk

Offline Kevin M. Cox

  • Sr. Member
  • ****
  • Posts: 450
  • PM 6 (6097) | macOS 12.0.1
    • View Profile
    • Kevin M. Cox | Photojournalist
Re: Carbon Black Cloud AV seeing PM6 as a treath
« Reply #2 on: November 15, 2021, 01:50:49 PM »
I wonder if CB detected rapid changes of multiple files (like applying the Metadata Template or Color Class to a large number of files) and triggered the warning.

I could see how sequentially changing files could appear like ransomware encrypting the content of a directory.
Kevin M. Cox | Photojournalist
https://www.KevinCox.com