We look after multiple sites for various clients and over the last couple of weeks we have stared getting reports of the virus name in the subject (Heur.AdvML.B) being detected on multiple PC's. Some of these PC's have no relation with another site as they are from different clients in different geographical locations. The reports are coming from both Windows 7 and Windows 10 (both 64bit & Pro) operating systems.
While the reports we receive state that the issue is resolved and that no action needs to be taken we then find that the following day we will receive another report for the same virus but a different TMP file name, some examples below:
c:\windows\temp\wax7ae1.tmp
c:\windows\temp\wax8938.tmp
c:\windows\temp\wax6fee.tmp
c:\windows\temp\wax845e.tmp
c:\windows\temp\wax7862.tmp
c:\windows\temp\wax87b3.tmp
c:\windows\temp\wax9d9f.tmp
c:\windows\temp\waxc902.tmp
Is this a true detection or a false positive?
And if it is a false positive what can we do to stop the detections?
The clients also receive the reports and are questioning why they are seeing so many alerts.