False Positive ci-sign.exe

[JensWagner2]

We have a false positive with a program that we are using for years now. It is called CI-Sign Signature Manager, the company website is https://en.ci-solution.com/

I attach two zip-files. The third zip-file produces an error after the upload-process has finished, see attached jpg. Can I send this file to an email address?

Thank you, guys!

J. Wagner, Germany

MBAMService_logs.zip

RestoredFile_CI-Sign.zip

[1PW]

Reference: https://www.virustotal.com/en/file/a9309643af72066a047379a0f9df7812bf67cf39459ec4f5ddd19c4842368d6c/analysis/1459519957/

Hello JensWagner2 and

Please reply with the file size of the archive that produces the -200 error. The teams may want that archive later. Thank you.

Available data does suggest a false positive and, if it has not already been done, you may wish to make the following temporary full pathname file entry in MBARW GUI Dashboard -> Exclusions:

     C:\Users\ADMINI~1\AppData\Local\Temp\CI-SIGN.TMP\ci-sign.exe

Please post a reply to this topic if the exclusion entry above resolves the False Positive errors you experience.  At any time, a development team member, QA team member or staffer may request the above temporary exclusion be altered/removed.

Thank you for beta testing MBARW and your valuable feedback.

[JensWagner2]

The file size is 26.3 MB, the exclusion is not working. At every Computer start, the ci-sign.exe is found as ransomware again.

[1PW]

Hello JensWagner2:

The CI-Sign.exe zipped file sent in the first post in this thread has a filesize of 1.1MB, and has a File Version/Product Version of 5.0.0.19, and a TimeStamp of  2014:07:24 10:04:31+01:00.

Would you please more closely identify the 26.3MB file you have referred to above?

Thank you.

 

[JensWagner2]

This zip  contains the folder "C:\Program Files\Malwarebytes\Anti-Ransomware".

[1PW]

Hello JensWagner2:

When .zip archives of logs are requested from a MBARW Beta6 user with issues, they are:

                                       C:\ProgramData\Malwarebytes\Malwarebytes Anti-Ransomware\
                                       C:\ProgramData\Malwarebytes\MBAMService\logs\

...and in the case of a False Positive (FP) report, additionally a .zip archive of the:

                                       QuarantinedExecutable or a copy if the quarantine was empty

It would be extremely rare that an archive of C:\Program Files\Malwarebytes\Anti-Ransomware would be requested.

Malwarebytes' staffers monitor this sub-forum and they are aware of your issue.  Please reconsider posting a .zip archive of C:\ProgramData\Malwarebytes\MBAMService\logs\.

Thank you.

[JensWagner2]

As a posted in my firstpost, here is the C:\ProgramData\Malwarebytes\MBAMService\logs\ zip-file again.

 

MBAMService_logs.zip

[1PW]

Hello JensWagner2:

The MBARW Beta development team monitors this sub-forum, and they are also aware of similar reports for which they are working on a solution.

Hopefully the data you provided will shed new light on this issue.

Thank you again.