False Positive

[thevolikov]

False positive on uTorrent:

https://www.virustotal.com/#/file-analysis/MDAyZjAzNzNjNDc5NGZmYjkxOTdmNzRmNTRlZThiM2M6MTUyODI4Mjc5O...

[mivaldi]

Where can the original installer be downloaded from? Can you provide the download link?

[thevolikov]

Uploaded it to sendpsace: https://www.sendspace.com/file/531fhi

You'll probably have to click "Download" twice because there's ad.

[thevolikov]

Any news?... Still have a false positive...

[mivaldi]

The uTorrent installers available at https://www.utorrent.com/downloads/win are 2.6MB in size.

The file you provided is 6.2MB.

Can you explain the difference in file size?

[thevolikov]

Ehm... this is the first time I get a question like this from an AV support representative. Your AV claims that the file is generic whereas it's just a clean uTorrent installer. Check — approve — done, that's how it always worked with all the other AVs. And if you look at the official uTorrent installer, you can see it's a bundle with ads.

Anyway, the installer I uploaded — it's a repack. I removed all ads so it's just clean uTorrent without anything else. That's it.

[mivaldi]

The sample exhibits suspicious behaviors. I'll work with our malware research team to verify this sample.

[mivaldi]

f46a162f52d93172da4ccfd208c7cb4b53b6f890a786630ba46b1435cfd02c3a has been submitted for verdict reconsideration.

[mivaldi · Accepted solution]

f46a162f52d93172da4ccfd208c7cb4b53b6f890a786630ba46b1435cfd02c3a verdict has been changed to grayware.

It will now show as 'clean' in VirusTotal.

The associated Antivirus signature (beginning with tomorrow's release) will be removed from the Palo Alto Networks Antivirus database.

[thevolikov]

Thanks!