topic Re: False positive in 2022 update in VirusTotal

False positive in 2022 update

ericsia — Wed, 23 Feb 2022 18:05:51 GMT

Dear respected Antivirus company,
Hi, I updated the app on 13/February/2021 to fix a bug and add translation per users' request.
Your detection engine is flagging my app as detected.
My website is https://medlexo.ml/

32bit: https://www.virustotal.com/gui/file/0530f3c0637b7687fe313dd18f988f164e5fec0bc5c0c3db2383187609bafbb5

64bit: https://www.virustotal.com/gui/file/42819e2f8c0e0cb3e9df083ce207965aeae609974e31e1ce5bbcc8e35ed6c7be

please check, thank you

Re: False positive in 2022 update

DaBone — Wed, 23 Feb 2022 18:38:09 GMT

From the VT links provided, these appear to be malicious by just the volume of other vendors reporting these files to be malicious.

Can you give a better description of these files and their purposes and what they are doing that could lend them to be seen as malicious?

Re: False positive in 2022 update

ericsia — Wed, 23 Feb 2022 18:59:28 GMT

I will report to them next week after I finish my works. Anyway, if you look closely most of them are flag by AI or ML (machine learning).

Medlexo is a video toolbox for

MP4 and M4A Merger
.ts to .mp4 converter
Any file format to mp4
Real Video Joiner
m3u8 downloader
MP4 Compressor
audio extractor

Just a guessing, the reason machine learning flagged it is because the ffmpeg dropped by medlexo which is necessary for converting video.

Re: False positive in 2022 update

ericsia — Thu, 24 Feb 2022 22:42:47 GMT

MalwareByte just informed me they've whitelisted Medlexo. Check the virustotal link again.

If that isn't convincing enough, I also updated the screenshot where other av company updated the result in the homepage https://medlexo.ml/

And for the other av company with poor customer service and response time, I don't think you guys wanted to compete with them which is worst.

Re: False positive in 2022 update

DaBone — Fri, 25 Feb 2022 01:21:36 GMT

I've submitted these files for review.

Re: False positive in 2022 update

DaBone — Fri, 25 Feb 2022 19:44:31 GMT

File: 42819e2f8c0e0cb3e9df083ce207965aeae609974e31e1ce5bbcc8e35ed6c7be
Is no longer deemed malware by us. Still awaiting for the review for the other file.

Re: False positive in 2022 update

DaBone — Fri, 25 Feb 2022 22:04:30 GMT

File 0530f3c0637b7687fe313dd18f988f164e5fec0bc5c0c3db2383187609bafbb5

This file is not seen as malware by us now.