Part of secure agent installation triggers a false positive

[FinventoryIT]

Part of our secure agent is being quarantained by your antivirus. after investigation we concluded that this is in fact a false positive. please contact us so we can send the file and other details. this information is confidential and cannot be posted on a forum due to contractual obligations.

[Spud]

We can't do anything unless we have the detected sample to examine. Please submit the MBAM log showing the detection. Un-quarantine the file and submit it to https://www.virustotal.com/gui/home/uploadthen post the link.

Edited October 11, 2022 by Spud

[FinventoryIT]

https://www.virustotal.com/gui/file/999839d3509137296af3612180945ba15aa958f7d32fcdf691101ae9cbee3cb0?nocache=1 we already uploaded it yesterday. it seems like MB sometimes triggers but not always. we reran the scan multiple times.

sometimes it pops up sometimes it doesnt. however when our clients update their malware byte installations their day to day business can be cripled. i attached a screenshot showing malwarebytes in a recent virustotal scan

[FinventoryIT]

@Spud also there is no MBAM log that we have acces to since the code is part of an installation on our clients' server

[cli]

Thanks for reporting, it looks like it's no longer detected. 

https://www.virustotal.com/gui/file/999839d3509137296af3612180945ba15aa958f7d32fcdf691101ae9cbee3cb0?nocache=1

Edited October 12, 2022 by cli

[FinventoryIT]

@cli @Spud well it still is..  it doesnt always show up on virustotal though.

[cli]

There is an issue where VT sometimes has problems reaching our cloud and this might be one of those times. Not to mention, our engine format and configuration in VirusTotal is different than our products' default configuration. In VirusTotal we use a command-line engine with more aggressive detection techniques and heuristics which might detect more than the commercial product. This is the norm with most if not all other antivirus vendors in VirusTotal. For more information please read https://forums.malwarebytes.com/topic/288906-virustotal-only-detections-not-detected-in-desktop-product/.

I whitelisted it and ran a scan with MBAM to double check. The file is not detected locally despite what VT shows.

Can you have your client re-run a scan on the file? 

Thanks.

Edited October 12, 2022 by cli

[FinventoryIT]

@cli thanks, i will contact them and have them rerun it.