Jump to content

False Positive ci-sign.exe


JensWagner2
 Share

Recommended Posts

We have a false positive with a program that we are using for years now. It is called CI-Sign Signature Manager, the company website is https://en.ci-solution.com/

I attach two zip-files. The third zip-file produces an error after the upload-process has finished, see attached jpg. Can I send this file to an email address?

Thank you, guys!

J. Wagner, Germany

MBAMService_logs.zip

RestoredFile_CI-Sign.zip

upload-problem-anti-ransomware.zip.jpg

Link to post
Share on other sites

Reference: https://www.virustotal.com/en/file/a9309643af72066a047379a0f9df7812bf67cf39459ec4f5ddd19c4842368d6c/analysis/1459519957/

Hello JensWagner2 and :welcome:

Please reply with the file size of the archive that produces the -200 error. The teams may want that archive later. Thank you.

Available data does suggest a false positive and, if it has not already been done, you may wish to make the following temporary full pathname file entry in MBARW GUI Dashboard -> Exclusions:

     C:\Users\ADMINI~1\AppData\Local\Temp\CI-SIGN.TMP\ci-sign.exe

Please post a reply to this topic if the exclusion entry above resolves the False Positive errors you experience.  At any time, a development team member, QA team member or staffer may request the above temporary exclusion be altered/removed.

Thank you for beta testing MBARW and your valuable feedback.

Link to post
Share on other sites

Hello JensWagner2:

The CI-Sign.exe zipped file sent in the first post in this thread has a filesize of 1.1MB, and has a File Version/Product Version of 5.0.0.19, and a TimeStamp of  2014:07:24 10:04:31+01:00.

Would you please more closely identify the 26.3MB file you have referred to above?

Thank you.

 

Link to post
Share on other sites

Hello JensWagner2:

When .zip archives of logs are requested from a MBARW Beta6 user with issues, they are:

                                       C:\ProgramData\Malwarebytes\Malwarebytes Anti-Ransomware\
                                       C:\ProgramData\Malwarebytes\MBAMService\logs\

...and in the case of a False Positive (FP) report, additionally a .zip archive of the:

                                       QuarantinedExecutable or a copy if the quarantine was empty

It would be extremely rare that an archive of C:\Program Files\Malwarebytes\Anti-Ransomware would be requested.

Malwarebytes' staffers monitor this sub-forum and they are aware of your issue.  Please reconsider posting a .zip archive of C:\ProgramData\Malwarebytes\MBAMService\logs\.

Thank you.

Link to post
Share on other sites

Hello JensWagner2:

The MBARW Beta development team monitors this sub-forum, and they are also aware of similar reports for which they are working on a solution.

Hopefully the data you provided will shed new light on this issue.

Thank you again.
 

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.