topic Re: False positive for Visual Studio extension in VirusTotal

False positive for Visual Studio extension

ionoy123 — Fri, 12 Jan 2018 08:17:36 GMT

I'm the author of this extension: https://marketplace.visualstudio.com/items?itemName=ionoy.XamarinFormsLive-18843

There is a xlserver.exe file that is a simple .NET assembly serving as a TCP server. There is nothing malicious which can be easily verified. Please remove the false positive.

Thanks!

Re: False positive for Visual Studio extension

bvandivier — Fri, 12 Jan 2018 15:08:04 GMT

Please submit the following information in the order listed below so that our team can investigate your claim and change verdicts when warranted.

File Hash: <hash>

Link to Virustotal report for the file: <link>

Current VirustTotal Verdict: <verdict>

Description: <description>

Our team will update each submission to this discussion forum at the conclusion of their research into your claim.

Re: False positive for Visual Studio extension

ionoy123 — Fri, 12 Jan 2018 15:16:19 GMT

File Hash: 6bf09b81fd56d6fdb4558018540dc5cf760c9dadc73b7c633fe76372297cc2d2

Link to Virustotal report for the file: https://www.virustotal.com/#/file/6bf09b81fd56d6fdb4558018540dc5cf760c9dadc73b7c633fe76372297cc2d2/detection

Current VirustTotal Verdict: generic.ml

Description: xlserver.exe is the file that is contained inside VSIX package, which is actually a ZIP with another extension. My client has a corporate firewall or something, that is based on VirusTotal. Out of all vendors, only Palo Alto and CrowdStrike detected it as a possible malware. It's easy to check `xlserver.exe` because it's an unobfuscated .NET assembly. There is nothing malicious inside.

Re: False positive for Visual Studio extension

bvandivier — Fri, 12 Jan 2018 15:20:00 GMT

Sample with hash 6bf09b81fd56d6fdb4558018540dc5cf760c9dadc73b7c633fe76372297cc2d2 has been queued for manual review. Please allow us 24 to 48 hours to conduct a proper review and adjust verdict as appropriate.

Re: False positive for Visual Studio extension

bvandivier — Tue, 16 Jan 2018 16:04:08 GMT

This sample has been updated to benign.

Resolved Time

2018-01-15T17:57:40.755004