topic Re: We are seeing lot of Teams.nuspec as virus - are they False Positive? in VirusTotal

We are seeing lot of Teams.nuspec as virus - are they False Positive?

msb_itservices — Wed, 10 Jun 2020 06:11:58 GMT

Hi there,

Lately we have seen number of blocked connection for Teams.nuspec. Virus Total report for Destination IP is shows clean.

Re: We are seeing lot of Teams.nuspec as virus - are they False Positive?

jcharette — Wed, 10 Jun 2020 12:59:26 GMT

We've seen a bunch of these as well from when we first started using Microsoft Teams.

Since then, we have bursts of them. Yesterday was a bad day. I think they are false positives as well, but I'd love to better understand why we are getting them.

Re: We are seeing lot of Teams.nuspec as virus - are they False Positive?

mivaldi — Wed, 10 Jun 2020 19:20:00 GMT

Please open a Support case so it can be looked at in detail.

Re: We are seeing lot of Teams.nuspec as virus - are they False Positive?

jmontoya224 — Thu, 11 Jun 2020 07:07:26 GMT

I have also been seeing this file across some of our customers that we monitor. We will get Virus alerts for that file that WildFire is flagging. I don't think this is a virus and is more than likely a false+. I was looking into this a little further and found out that the file is being hosted here https://chocolatey.org/packages/microsoft-teams#files. The file passes all checks on their site which you can view the Registry Snapshot by going to the following link https://gist.github.com/choco-bot/94b957a0ae5da9a075eb88dd4c890bd9. If I get some time I will download the file on my VM and run it through some checks and will update. I agree with the above comment and open a case so that Palo can take a look into this further. Have a good day!

Re: We are seeing lot of Teams.nuspec as virus - are they False Positive?

mivaldi — Thu, 11 Jun 2020 18:41:44 GMT

We are looking at it further to understand what is causing the continued FP detections.

All the signatures listed in the screenshot are now disabled.

Re: We are seeing lot of Teams.nuspec as virus - are they False Positive?

it.tbpl — Fri, 12 Jun 2020 13:28:32 GMT

still false-positives for threat id: 346399143 filename: Teams.nuspec - Virus/Win32.WGeneric.akfdwd

Content version: Antivirus-3376-3887

Re: We are seeing lot of Teams.nuspec as virus - are they False Positive?

dparris — Fri, 12 Jun 2020 13:56:27 GMT

The signature 346399143 was disabled 06/11/2020

Re: We are seeing lot of Teams.nuspec as virus - are they False Positive?

mivaldi — Fri, 12 Jun 2020 17:57:55 GMT

The signature is removed beginning with Antivirus version 3377-3888

Re: We are seeing lot of Teams.nuspec as virus - are they False Positive?

it.tbpl — Tue, 16 Jun 2020 12:19:21 GMT

Another: teams.nuspec - Virus/Win32.WGeneric.a

signature: 346947453 (in Antivirus-3380-3891)

Filename: Teams.nuspec

Re: We are seeing lot of Teams.nuspec as virus - are they False Positive?

jcharette — Tue, 16 Jun 2020 12:34:14 GMT

Same! We've received a bunch of those as well.

The virus 346947453(346947453) was detected at Teams.nuspec

Re: We are seeing lot of Teams.nuspec as virus - are they False Positive?

mivaldi — Tue, 16 Jun 2020 17:42:53 GMT

346947453 was disabled and is now removed from Antivirus 3381

Re: We are seeing lot of Teams.nuspec as virus - are they False Positive?

LeighCostin — Tue, 28 Jul 2020 05:10:31 GMT

And it seems to be back again - Threat ID #356771745 Virus Teams.nuspec detected via an Antivirus profile.Excluded it and raising a note with PAN.

Re: We are seeing lot of Teams.nuspec as virus - are they False Positive?

mivaldi — Tue, 28 Jul 2020 21:00:45 GMT

356771745 was disabled and will be removed from tomorrow's release of the Antivirus signature package.