topic Re: False Positive in VirusTotal

False Positive

thevolikov — Wed, 06 Jun 2018 11:01:46 GMT

False positive on uTorrent:

https://www.virustotal.com/#/file-analysis/MDAyZjAzNzNjNDc5NGZmYjkxOTdmNzRmNTRlZThiM2M6MTUyODI4Mjc5OQ==

Re: False Positive

mivaldi — Wed, 06 Jun 2018 12:47:58 GMT

Where can the original installer be downloaded from? Can you provide the download link?

Re: False Positive

thevolikov — Wed, 06 Jun 2018 14:04:16 GMT

Uploaded it to sendpsace: https://www.sendspace.com/file/531fhi

You'll probably have to click "Download" twice because there's ad.

Re: False Positive

thevolikov — Thu, 07 Jun 2018 15:15:48 GMT

Any news?... Still have a false positive...

Re: False Positive

mivaldi — Thu, 07 Jun 2018 15:23:15 GMT

The uTorrent installers available at https://www.utorrent.com/downloads/win are 2.6MB in size.

The file you provided is 6.2MB.

Can you explain the difference in file size?

Re: False Positive

thevolikov — Thu, 07 Jun 2018 17:12:53 GMT

Ehm... this is the first time I get a question like this from an AV support representative. Your AV claims that the file is generic whereas it's just a clean uTorrent installer. Check — approve — done, that's how it always worked with all the other AVs. And if you look at the official uTorrent installer, you can see it's a bundle with ads.

Anyway, the installer I uploaded — it's a repack. I removed all ads so it's just clean uTorrent without anything else. That's it.

Re: False Positive

mivaldi — Thu, 07 Jun 2018 18:14:28 GMT

The sample exhibits suspicious behaviors. I'll work with our malware research team to verify this sample.

Re: False Positive

mivaldi — Thu, 07 Jun 2018 18:20:47 GMT

f46a162f52d93172da4ccfd208c7cb4b53b6f890a786630ba46b1435cfd02c3a has been submitted for verdict reconsideration.

Re: False Positive

mivaldi — Fri, 08 Jun 2018 18:04:07 GMT

f46a162f52d93172da4ccfd208c7cb4b53b6f890a786630ba46b1435cfd02c3a verdict has been changed to grayware.

It will now show as 'clean' in VirusTotal.

The associated Antivirus signature (beginning with tomorrow's release) will be removed from the Palo Alto Networks Antivirus database.

Re: False Positive

thevolikov — Sat, 09 Jun 2018 08:48:38 GMT

Thanks!