topic Re: False Postive genercl.ml in VirusTotal

False Postive genercl.ml

dmajews — Fri, 24 Nov 2017 16:33:42 GMT

A product we develop is listed by you as a generic.ml detection. Can you please have this removed by your engineers?

VirusTotal: https://www.virustotal.com/#/file/bafe7b47a322a74434c60cfcf8ea7702509642d3f907dd4a8446f4e4edd51bc6/detection

SHA-256

bafe7b47a322a74434c60cfcf8ea7702509642d3f907dd4a8446f4e4edd51bc6

I can send the file if needed.

Thank you.

Re: False Postive genercl.ml

dmajews — Tue, 28 Nov 2017 14:31:25 GMT

Hello, Is there any update on this? We're trying to ensure our customers don't have this dll flagged anymore since it's a false positive. If more information is needed please let me know. Thank you in advance.

Re: False Postive genercl.ml

mivaldi — Fri, 01 Dec 2017 22:44:41 GMT

Sending the file doesn't really help. We already have it.

You need to provide additional context.

What is this DLL, what is its purpose, is it publicly available?

Any links to a reputable site that is hosting it?

Re: False Postive genercl.ml

dmajews — Mon, 04 Dec 2017 13:38:21 GMT

The dll is a part of a software that we develop for out clients and it's released publicly to any of our paid subscribers. I'm not sure what additional information to give on that but the dll is not malicious. I'm just trying to get any false-positive addressed before this shows up directly on a clients installation. Thank you in advance.

Re: False Postive genercl.ml

mivaldi — Mon, 04 Dec 2017 21:18:26 GMT

After further research I found the verdict on this sample was already changed to Benign by one of our Threat Researchers on 11/22. The signature is currently disabled.

Re: False Postive genercl.ml

dmajews — Mon, 04 Dec 2017 21:19:34 GMT

Thank you!

Re: False Postive genercl.ml

mivaldi — Mon, 04 Dec 2017 21:30:57 GMT

Happy to help.