False positive for Spyware.RedLineStealer from EML File Viewer Tool?

[mikew99]

Hi there.

Back in April I installed FreeViewer EML File Viewer Tool (https://www.freeviewer.org/eml/) to view certain files.

A few days ago, MB flagged three files associated with this program - EMLREADER.DLL, MAILEXAMINERCOMMON.DLL, and MESSAGINGHELPER.DLL - as Spyware.RedLineStealer threats.

I quarantined the threats using MB. But this program was installed several months ago and MB did not report this issue until very recently.

Is this a false positive or is this a malicious program?

Mike

[Porthos]

28 minutes ago, mikew99 said:

I quarantined the threats using MB.

Be sure MB is up to date. Un quarantine the file and scan again.

If it is still detected please provide the scan log.

[mikew99]

Thanks for the reply!

1. I updated MB. (MB appeared to update.)

2. Unquarantined the files and confirmed they were back in the program folder.

3. Re-ran the scan. Then re-ran it again about 15 minutes later to be safe.

4. No threats detected BOTH times.

5. The three files (all *.dll) flagged originally are attached to this reply in the .rar folder for your review.

6. I think that is a good thing? Please confirm.

 

FreeViewer_false_positive_files.rar

[Porthos]

33 minutes ago, mikew99 said:

6. I think that is a good thing? Please confirm.

I assume the program still works?

There was a false positive that was fixed as Spyware.RedLineStealer threats

[cli]

I can confirm that the files you attached were affected by the recent Spyware.RedlineStealer FP.

[mikew99]

@Porthos THANK YOU! I did not bother to test the program - it's not something I use regularly so I uninstalled it altogether.

@cli Thanks for the confirmation. Huge relief.