false positive please correct

[markh1]

Hello, one of our customers using our software product (“Vacation RentPro”) is having the vrpsetup.exe quarantined when they try to update our software.
We always scan our vrpsetup.exe and all components thoroughly when we post updates to our product.  
You can download the software on the “Download” page on our website at: 

https://www.vacationrentpro.com/download/

Please let me know if you have any questions. Thank you.

I've attached the history log.

mb_vrp_falsepositive.txt

Edited April 19 by AdvancedSetup
Disabled hyperlinks

[Porthos]

6 minutes ago, markh1 said:

I've attached the history log.

Your link does not allow download.

Please zip and attach the detected file.

 

[markh1]

oh shoot. sorry. godaddy is doing server maintenance today. so the site has been up and down today.

here's a zip file. thank you.

vrpsetup.zip

[blender]

Hello,

The file you provided and the one in your detection log are different. Do you have the one in your c:\temp as well please? This is so I can compare the 2 and potentially create a rule to exclude these and future versions.

Thanks!

 

[markh1]

we did 3 updates yesterday. i sent you the latest. apparently the customer got the quarantine on an earlier version. let me see if i can get the exact one... hang on pls

[blender]

I whitelisted the one you provided. I also found several others on virustotal when I checked your site. I was able to grab enough files to create a rule to help prevent future detections.
Hopefully that covers them.

Thanks for reporting.

[markh1]

Thank you. good. i reported a false positive here for the same software on 4/20/2022 (but it was for the actual program (after the setup installed it)). so hopefully we're all good now for both the setup.exe and the main exe. thanks again!

I'm curious, if you can share why it was suspected as malware?

[markh1]

i just checked the "site" vacationrentpro.com on virustotal and it was all clean. Did you mean to say you checked the "file" instead? because i do see 3 things flaged there for the setup file.

[blender]

I have a premium subscription to virustotal so I can see a bunch more info about sites, files, etc. I could see a bunch of files related to your site and could download them. Mind you, the ones I grabbed were not detected but did allow me to get a wider variety between versions to create a prevention sig.

There are many checks MBAM does when scanning the files. It is a machine learning detection. I'll try to find more info.

[blender]

So the file was detected by one of our heuristic engines. I couldn't tell you what exactly triggered the detection.
That being said, you can probably prevent future detections by ensuring your files have a valid digital signature.