topic Re: FALSE Positive in VirusTotal

FALSE Positive

GunProtect — Tue, 12 Jun 2018 15:30:42 GMT

Hi
We are anti-cheat software developed, and our product were tagged as virus.
But as you can see it isn't a virus, it's a game based DLL packed with WinLicense to make it harder to get hacked by cheat developers, please we ask you to look every byte in this DLL because everytime we update our product and when we scan the file it's been detected again, please trust our files. We are here to provide you all the details you want.
Please take a look on our case.

Download link: https://www.sendspace.com/file/mg9wyd

Password: gitzac
Thanks in advance
Rizzo
GunProtect Team
www.gunprotect.com.br

Re: FALSE Positive

dparris — Tue, 12 Jun 2018 16:58:26 GMT

Hello,

Can you please supply the SHA256 of the file in question. We do not download from links, this ensures that we submit the correct file for review.

Re: FALSE Positive

GunProtect — Tue, 12 Jun 2018 17:48:41 GMT

9ba7ffb7c62ce4062cfc60a4564e19004c2c6e7512fc98d24a1c6ec419be6d0a

Re: FALSE Positive

dparris — Tue, 12 Jun 2018 17:54:56 GMT

I have requested a review of the file that you submitted.

Re: FALSE Positive

GunProtect — Tue, 12 Jun 2018 17:57:55 GMT

Ok and we are here to provide everything you want to fix this FALSE positive forever.

Re: FALSE Positive

mivaldi — Tue, 12 Jun 2018 18:09:30 GMT

Look into DLL signage. If you get your DLL's signed we can work with you to whitelist the signer.

Re: FALSE Positive

GunProtect — Tue, 12 Jun 2018 18:56:18 GMT

Our DLL's is signed, take a look

Re: FALSE Positive

mivaldi — Tue, 12 Jun 2018 19:04:29 GMT

Already did.

Re: FALSE Positive

GunProtect — Tue, 12 Jun 2018 19:43:59 GMT

Sorry, this version went online unsigned.

But this one is signed:
https://www.virustotal.com/#/file/0f8b93833f4c860d1b9817d3ef2cbaf8c3f6d488786cbefc9f8fb2a4157eb9f5/detection

Re: FALSE Positive

dparris — Tue, 12 Jun 2018 20:56:31 GMT

You requested the verdict be changed to benign. This request has been completed successfully.

Re: FALSE Positive

mivaldi — Tue, 12 Jun 2018 21:16:36 GMT

0f8b93833f4c860d1b9817d3ef2cbaf8c3f6d488786cbefc9f8fb2a4157eb9f5 is showing clean for Palo Alto Networks.

That doesn't give me an indication that your signer *is not* in the trusted list already.

You can request the signer to be added if we come across a signed FP in the future.