Perspective tagged as (Malware.Ransom.Agent.Generic)

[gdiObjects]

Hello,

A software product I develop (Perspective for Windows) has suddenly been tagged as Malware.Ransom.Agent.Generic.

I'm attaching the digitally signed installer, the exported report and the log file (C:\ProgramData\Malwarebytes\MBAMService\logs).

 

Additionally, here's a link to the virustotal scan results page:

https://www.virustotal.com/#/file/c89d08c4848f0e0cba194ea6d4a95aa6d6825025a2807d0063f750587dc991c9/detection

Thank you for your help.

 

MBAMSERVICE.LOG PWCInstall.zip False Positive - Perspective.txt

[miekiemoes]

Hi,

Thanks for reporting. Can you verify if this is still detected? This since I can't reproduce detection here anymore.

I remember we have fixed this earlier today already.

Thanks!

[gdiObjects]

What's interesting is that it never detected this until I created an updated build last night.  I was editing the help file (while Perspective was running in the background) and all of the sudden I saw the red malwarebyes box asking for a reboot.

I added it as an exclusion so I could keep developing.

What do you mean by "I remember we have fixed this earlier today already."  This is the first time I've posted here.

I also have another product "fotoXplorer" not yet released but also generates the same false positive because it uses available threads/cores to process (transform) images.  Can I upload it even if it hasn't been officially released (the help file is incomplete)?

[miekiemoes]

Hi,

My mistake, it wasn't perspective.exe we have fixed earlier today, I confused with another program.

In either way, this shouldn't be detected anymore either.

[gdiObjects]

Do I need to do something to malwarebytes..clear a cache or simply remove the exclusions and all will be ok? Do you whitelist based on code-signing certificate or product release versions and do I need to resubmit when there is a new build?

Also, with regards to fotoXplorer.  Can I submit an unreleased software product?  Technically, I can't release it until the false positive is address.

Note: it's easier to recreate the problem with fotoXplorer because malwarebytes' signatureless (behavioral) detection sees it as ransomware because it can operate on multiple photos at the same time (multi-threaded processing).

[miekiemoes]

As for FotoXplorer, before releasing it, yes please submit to us (you can post it in a private message to me if you don't want to post it public), so we can verify if detected and fix it.

And no, normally you don't need to clear a cache or anything, so you can remove your exclusions.

However, on the other hand, while you are developing, it's still a good idea to create an exclusion for the folder where your files are in. Then when you're about to release, you can verify if the new one is getting detected again and  submit it to us as well.

Thanks!

 

[gdiObjects]

Hello,

 

I've updated my code signing certificate (2 year renewal) and hope you can check it and whitelist Perspective again.

Also, fotoXplorer is really almost done.  Some minor fixes and I need to complete (start) the help file.  Should I post the Installer for an unfinished product?  It really triggers the generic.ransomware issue because it processes multiple images at the same time (multithreaded).

Thanks!

PWCInstall.zip

[miekiemoes]

Hi,

This has been whitelisted.

As for fotoXplorer, I suggest you post the installer once the product has been finished, so the whitelisting sticks.

Thanks!

[gdiObjects]

Hi,

So the new certificate has been whitelisted?  It's OK for me to upload the updated installer and files to my server?

 

Thanks!

[miekiemoes]

Hi,

This file shouldn't be detected anymore. I just verified/checked here as well and no detections occur. So yes, it's OK to upload the updated installer to your server

 

[gdiObjects]

Hello,

I was running a new build of Perspective and malwarebytes tagged it as ransomware again...It is digitally signed.

 

Attached is the exported log.

Thanks,

Steve Wehrmann

Perspective-Ransomware-log.txt

[Porthos]

Off topic, you might want to update your Malwarebytes as well. Probably will not fix the detection though.

Quote

Components Version: 1.0.875

Under settings-general click check for updates.

Edited May 6, 2020 by Porthos

[gdiObjects]

On 5/5/2020 at 6:12 PM, Porthos said:

Off topic, you might want to update your Malwarebytes as well. Probably will not fix the detection though.

Under settings-general click check for updates.

Hello,

Thanks for the tip...but my MalwareBytes is always up to date (I code daily).  The problem is MB sees my app (Perspective) operating (rapidly) on Wallpaper images (for desktop transitions) and tags it a RansomWare...its not!

-Steve

[Porthos]

16 minutes ago, gdiObjects said:

Thanks for the tip...but my MalwareBytes is always up to date (I code daily)

The logs you posted showed it out of date (Components Version: 1.0.875 ) which is actually 2 releases behind. The component packages are metered outt so if you do not check for applications manually each day you can be out of date some times weeks.

Below is the current release version.

 

The company has program updates pushed through the normal updater (the one that checks for database updates) metered in such a way that it is throttled so not every user is offered the new build once it has been released, so it becomes a matter of probability and is somewhat random.  This means that you might be offered it early, or it might take a really long time before it is offered to you, it just all depends.  Basically a luck of the draw kind of deal.

If you wish to avoid the wait you may open Malwarebytes and navigate to Settings and click on the Install Application Updates button

Edited May 8, 2020 by Porthos

[Porthos]

11 minutes ago, gdiObjects said:

The problem is MB sees my app (Perspective) operating (rapidly) on Wallpaper images (for desktop transitions) and tags it a RansomWare...its not!

That is up to staff to research and fix if possible.

[Porthos]

On 5/5/2020 at 8:06 PM, gdiObjects said:

I was running a new build of Perspective and malwarebytes tagged it as ransomware again...It is digitally signed.

 

@miekiemoes

[miekiemoes]

@gdiObjects Can you zip and attach the latest file that was being detected?

[tetonbob]

@gdiObjects - in addition to Mieke's request for the file, can you please also attach the log located at
C:\ProgramData\Malwarebytes\MBAMService\logs\MBAMService.log

Thanks.

[gdiObjects]

Hello,

Here's a zip file containing my installer.  I added the installed path as an exclusion so I could test from a user environment.  Can't upload or zip the requested log.MBAMSERVICE.LOG

PWCInstall.zip

[Porthos]

31 minutes ago, gdiObjects said:

Can't upload or zip the requested log

Exit Malwarebytes from the system tray and try again.

[miekiemoes]

Thanks, I can't reproduce detection here, so please make sure you upload the exact executable that is being detected.

Thanks!

[gdiObjects]

Hello,

You need to have several thousand wallpaper photos queued (I test with over 30,000+ images) and set the Schedule to "Computer's Speed - No Delay" and let it run (possibly hours) to recreate the problem.  I let it run all day (and night) when testing.  If you watch the folder (D:\Documents\My Perspective\Temp) in real-time you will see how Perspective quickly preps the wallpaper images.  I don't think MB likes it.  Constant reading of source images and writing to a temp folder ...

I can't see how the log will help.  The ransomware tagging happened on Tuesday and I had to add the folder (C:\Program Files (x86)\Perspective) as an exclusion to test the release.

-Steve

MBAMSERVICE.LOG

[tetonbob]

The log can help us assess why a detection took place. That being said, with Enhanced (debug) logging enabled, the event is no longer in the main MBAMService.log so we'd need the entire C:\ProgramData\Malwarebytes\MBAMService\logs folder.

 

[gdiObjects]

Hello,

Attached is a zipped file containing all of the logs in the folder.

-Steve

logs.zip

[tetonbob]

Thanks, Steve. Unfortunately with debug logging enabled during a scan, the logging which could have shown this detection event is gone.

Let's try this another way. Can you send the entire C:\ProgramData\Malwarebytes\MBAMService\ArwDetections folder, please?

Thanks,
-Bob