exclusion for malware / trojan detection (false positive)

[toto1988]

Hi Guys,

hope you could help me out. We have a small tool called nettool.exe which is searching for some network printers. Our employees need this tool every day. since a few weeks or months the tool will be deleted by VSE.

https://www.virustotal.com/#/file/7d932fc5f520b1d6152fd1e7aa74d989ce2c79d648ec5366d1a25a5063a0da67/d...

How is it possible to exclude this file from detection? If tried to add some exclusion for on-access scanner and so on without success.

Thanks in advance,

Tobi

[cdinet]

These type questions should be posted under the ENS/VSE team group.  However, my suggestion would be to submit it as a sample as a false positive.  Is it being detected as a virus or as an unwanted program?  Your exclusions would depend on how it is being detected. 

I will also be transferring this over to the appropriate team.

[tzemva]

Hi @toto1988

Either one of this bellow KB Articles will help you:

Potentially Unwanted Programs continue to be detected when excluded by name only
Technical Articles ID: KB50383

How to submit samples when an application vendor disputes a PUP detection
Technical Articles ID: KB85569

[toto1988]

Hi,

I did like described in KB50383 (see screenshot below). I set the exclusion on our ePO.

Nettool.exe is detected as RDN/Generic.RP and I add a exclusion for RDN/Generic.RP without success.

is there any other way to fix?

[jess_arman · Accepted solution]

@toto1988 This file is not being detected as a PUP, and so excluding it in your PUP-policy isn't going to resolve the issue. This type of detection is a "generic" threat detection driver that encompasses a wide range of files underneath its scope, and as such, it would not be advised that you do an exclusion for this detection name as you could then be vulnerable to a "real" threat, even if you could exclude it in this way.

Instead, you need to engage Support by opening a ticket with the Malware team for potential false positive investigation. You can submit the file as a sample for this purpose by following the instructions in KB85567. They will be able to assist you in validating the reputation of this file, and resolving the detection in your environment.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[vnaidu]

We had the similar issue for some time. In our case, we contacted the malware team and submitted the file. McAfee helped us with a negative Extra DAT. That fixed our issue permanently.

So submit the file and get the solution....