False Positive AV block

Reply
Highlighted

False Positive AV block

Hi,
Not sure if this is under the correct category but here we go.
I have a false positive in my FWs, I have a file called Pv7_00_169SetupFull.exe which the FWs are detecting as Virus/Win32.WGeneric.qxdip

If I upload and scan the file with VirusTotal it gives all green lights: https://www.virustotal.com/#/file/e36d3bb4f9eaff256ecd50f4a6875e41d65d12ef87d06bf7bde79874e989e259/d...

Thanks in advance


Accepted Solutions
Highlighted
L6 Presenter

Re: False Positive AV block

Sounds like a signature collision.

https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-is-a-signature-collision/ta-...

 

Sometimes benign files collide with signatures generated for False Positives, and the collision can be resolved by fixing the FP.

There are other instances where a file may be colliding with the signature of a true malware sample.


In that case the general recommendation will be to configure an Antivirus exception.

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/create-threat-exce...

 

In very particular situations, (where a signature for a true malware file causes a massive amount of collisions) we can work with PE files to make the signature more specific.

 

In any case, your issue should be worked through a Support case.

Please open a case with Support.

View solution in original post


All Replies
Highlighted
L6 Presenter

Re: False Positive AV block

Sounds like a signature collision.

https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-is-a-signature-collision/ta-...

 

Sometimes benign files collide with signatures generated for False Positives, and the collision can be resolved by fixing the FP.

There are other instances where a file may be colliding with the signature of a true malware sample.


In that case the general recommendation will be to configure an Antivirus exception.

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/create-threat-exce...

 

In very particular situations, (where a signature for a true malware file causes a massive amount of collisions) we can work with PE files to make the signature more specific.

 

In any case, your issue should be worked through a Support case.

Please open a case with Support.

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!