False Positive AV block

GOTRIDA — Thu, 31 May 2018 09:01:53 GMT

Hi,
Not sure if this is under the correct category but here we go.
I have a false positive in my FWs, I have a file called Pv7_00_169SetupFull.exe which the FWs are detecting as Virus/Win32.WGeneric.qxdip

If I upload and scan the file with VirusTotal it gives all green lights: https://www.virustotal.com/#/file/e36d3bb4f9eaff256ecd50f4a6875e41d65d12ef87d06bf7bde79874e989e259/detection

Thanks in advance

Re: False Positive AV block

mivaldi — Thu, 31 May 2018 15:58:59 GMT

Sounds like a signature collision.

https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-is-a-signature-collision/ta-p/79086

Sometimes benign files collide with signatures generated for False Positives, and the collision can be resolved by fixing the FP.

There are other instances where a file may be colliding with the signature of a true malware sample.

In that case the general recommendation will be to configure an Antivirus exception.

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/create-threat-exceptions

In very particular situations, (where a signature for a true malware file causes a massive amount of collisions) we can work with PE files to make the signature more specific.

In any case, your issue should be worked through a Support case.

Please open a case with Support.

topic False Positive AV block in Advanced Threat Prevention Discussions

False Positive AV block

Re: False Positive AV block