topic Re: False Positive Submission for Removal in VirusTotal

False Positive Submission for Removal

natechadwick — Fri, 02 Feb 2018 21:39:15 GMT

File Hash: MD5 157ceac1f3eb730d3c844c332ad67a60

Link to Virustotal report for the file: https://www.virustotal.com/#/file/07ab4c147fa9534b2384a47e9b86761018da634d1da1211781becaad85bf7735/detection

Current VirustTotal Verdict: DesktopContentExplorer.jar verdict: Clean (0/42)

Description: This is our Desktop ContentExplorer Web Start application for editing content with Percussion Software's Rhythmyx CMS. It is currently be flagged as “Win32.WGeneric.pmlqw” virus:

Here are it's hashes.

MD5 42863d38e8e1333d279284e87076a6ca

SHA1 ec94c9a050a585ff07044a81465f10ec4aa0abab

SHA256 658c275cb64affafd7fc16e54b000dc1204514f600ba3104eced6ebd577b2dc4

This is blocking users from editing / maintaining production content.

The file can be downloaded here.

Re: False Positive Submission for Removal

bvandivier — Fri, 02 Feb 2018 22:17:40 GMT

We have submitted this file for analysis and a possible verdict change. Please allow our analysts 24 to 48 hours to process this request. Also, both files posted in your threads (ContentExplorer Applet & Desktop ContentExplorer Web Start application) appear to have the same hash. Please provide clarification if necessary.

Re: False Positive Submission for Removal

natechadwick — Fri, 02 Feb 2018 22:24:07 GMT

Thanks!

The MD5 hashes's do seem different for the files?

Do you mean the virus hashes that they are being flagged with are the same? Both files are being flagged as being same virus and are being blocked on the network.

Re: False Positive Submission for Removal

bvandivier — Fri, 02 Feb 2018 22:31:13 GMT

The MD5s are different and both come up clean. The second SHA256 hash you have referenced in both of your posts are the same.

Re: False Positive Submission for Removal

natechadwick — Fri, 02 Feb 2018 22:35:18 GMT

The second set of hashes were supplied to me by our mutual customer. As I understand it, they are the hashes that your system is reporting for the specific virus that our tools are being flagged with. We can remove them from the posts if it will cause confusion - we just weren't sure if it would be helpful for you to have.

-n