False Positive Submission for Removal

[natechadwick]

File Hash: MD5 157ceac1f3eb730d3c844c332ad67a60

Link to Virustotal report for the file: https://www.virustotal.com/#/file/07ab4c147fa9534b2384a47e9b86761018da634d1da1211781becaad85bf7735/d...

Current VirustTotal Verdict: DesktopContentExplorer.jar verdict: Clean (0/42)

Description: This is our Desktop ContentExplorer Web Start application for editing content with Percussion Software's Rhythmyx CMS. It is currently be flagged as  “Win32.WGeneric.pmlqw” virus:

Here are it's hashes. 

MD5 42863d38e8e1333d279284e87076a6ca

SHA1 ec94c9a050a585ff07044a81465f10ec4aa0abab

SHA256 658c275cb64affafd7fc16e54b000dc1204514f600ba3104eced6ebd577b2dc4

This is blocking users from editing / maintaining production content. 

The file can be downloaded here.

[bvandivier]

We have submitted this file for analysis and a possible verdict change.  Please allow our analysts 24 to 48 hours to process this request.  Also, both files posted in your threads (ContentExplorer Applet & Desktop ContentExplorer Web Start application) appear to have the same hash.  Please provide clarification if necessary.

[natechadwick]

Thanks!

The MD5 hashes's do seem different for the files?

Do you mean the virus hashes that they are being flagged with are the same?  Both files are being flagged as being same virus and are being blocked on the network.

[bvandivier]

The MD5s are different and both come up clean.  The second SHA256 hash you have referenced in both of your posts are the same.

[natechadwick]

The second set of hashes were supplied to me by our mutual customer. As I understand it, they are the hashes that your system is reporting for the specific virus that our tools are being flagged with.   We can remove them from the posts if it will cause confusion - we just weren't sure if it would be helpful for you to have. 

-n