topic Re: False Positive (virus/win32.wgeneric.vnujo) in General Topics

False Positive (virus/win32.wgeneric.vnujo)

prsi0203 — Tue, 13 Aug 2019 19:23:34 GMT

Dear Support,

Our customers have been reporting that palo alto is identifying our software as malware.

application ms-ds-smbv3
virus/win32.wgeneric.vnujo
ID 219797367

How can we proceed to whitelist our software permanently?

Thank you

Re: False Positive (virus/win32.wgeneric.vnujo)

kiwi — Wed, 14 Aug 2019 10:16:15 GMT

Hi @prsi0203 ,

You'll need to reach out to support:

How to Submit an Anti-Virus False Positive

Cheers !

-Kiwi.

Re: False Positive (virus/win32.wgeneric.vnujo)

jeremy.larsen — Wed, 14 Aug 2019 13:15:04 GMT

Have you considered this isn't a false positive and PAN is actually protecting you from yourself? Also, are you running file blocking in anyway? This appears to be related to SMB and I'm guessing is somehow associated to mounted remote directories?

Re: False Positive (virus/win32.wgeneric.vnujo)

prsi0203 — Wed, 14 Aug 2019 13:48:21 GMT

How can i have access to the support? We do not have a palo alto product, our customers do.

Re: False Positive (virus/win32.wgeneric.vnujo)

prsi0203 — Wed, 14 Aug 2019 13:50:28 GMT

It is a false positive. Thats the way our software works, it is executed from an shared folder to simplify the use to our customers.

I was wondering if there a way to work closer with palo alto to whitelist our softwares based on the application certificate or anything else permanently instead of submitting everytime it may triggers a false positive with a new/updated version.