morsik Posted September 16 ID:1661255 Share Posted September 16 (edited) Hi, Apparently your software blocked https://jsystems.pl website for "riskware" (whatever that means...). I am helping manage this website/server, which is simply website for training company that provides IT trainings. There's no reason to mark it as "riskware" - especially that it doesn't even have any software available to download at all... Please fix that and remove that from your list. As a non-malwarebytes user I must say - I am very disappointed with this, and I will certainly never suggest anyone to use your products since it blocks legit websites :/ By the way: not being able to fill my real name in "Display Name" in order to make my credibility better on this forum is some kind of sad joke... Edited September 16 by TeMerc Disabled live link(s) Link to post
Staff TeMerc Posted September 16 Staff ID:1661285 Share Posted September 16 2 hours ago, morsik said: Hi, Apparently your software blocked https://jsystems.pl website for "riskware" (whatever that means...). I am helping manage this website/server, which is simply website for training company that provides IT trainings. There's no reason to mark it as "riskware" - especially that it doesn't even have any software available to download at all... Please fix that and remove that from your list. As a non-malwarebytes user I must say - I am very disappointed with this, and I will certainly never suggest anyone to use your products since it blocks legit websites :/ By the way: not being able to fill my real name in "Display Name" in order to make my credibility better on this forum is some kind of sad joke... Hello, this url linked below is still active, downloading the following file as well: VirusTotal - URL VirusTotal - File - 6b568628c01f294834149fd0213d0b41f0bc6c57aaebd0b39e891763cc133038 Link to post
morsik Posted September 16 Author ID:1661297 Share Posted September 16 Dear @TeMerc, I am not sure if you're joking right now or are you serious... You pointing to a file literally called "sms-send training.zip" that teaches beginner Android devs how to send an SMS from Android app is marked as a malware that... sends SMS?! I am really confused right now, because this VirusTotal entry just simply confirms the name of the file itself. YES, IT SENDS SMS! Can you actually point to any virus/malware behavior of this file? Or can you actually manually try to identify malware that is inside besides basic functionality of this app - which is sending SMS? Because from what you showed here there is no real explanation to why this would have been virus at all... - Either original compiler that author of that training was malware itself and it was injected somehow into compiled binary - Or the basic code is so basic that fancy heuristics think that so basic code is only in malware - Or this is very huge false-positive... Thanks for more detailed explanation, because I am really confused right now... Link to post
Staff TeMerc Posted September 16 Staff ID:1661303 Share Posted September 16 8 minutes ago, morsik said: Dear @TeMerc, I am not sure if you're joking right now or are you serious... You pointing to a file literally called "sms-send training.zip" that teaches beginner Android devs how to send an SMS from Android app is marked as a malware that... sends SMS?! I am really confused right now, because this VirusTotal entry just simply confirms the name of the file itself. YES, IT SENDS SMS! Can you actually point to any virus/malware behavior of this file? Or can you actually manually try to identify malware that is inside besides basic functionality of this app - which is sending SMS? Because from what you showed here there is no real explanation to why this would have been virus at all... - Either original compiler that author of that training was malware itself and it was injected somehow into compiled binary - Or the basic code is so basic that fancy heuristics think that so basic code is only in malware - Or this is very huge false-positive... Thanks for more detailed explanation, because I am really confused right now... You'll need to contact the companies who detect the file, there are 22 of them who consider it a threat. Link to post
Porthos Posted September 16 ID:1661307 Share Posted September 16 @morsik Here are some links to contact all of those vendors. https://github.com/yaronelh/False-Positive-Center https://docs.virustotal.com/docs/false-positive-contacts Link to post
morsik Posted September 16 Author ID:1661310 Share Posted September 16 I guess it's blocked because "modern greatest heuristics" thought that this most basic code that simply sends basic SMS that's available in every basic Android tutorial and GitHub and whatnot is malware because this very simple code is alse inside every malware (for same reason - it's simple and copy-pasted from random tutorials?). But this doesn't change the fact that this sounds very stupid. @TeMerc It's Malwarebytes who blocked whole website, so... that's why I'm reporting this as false-positive to Malwarebytes in the first place. You blocked whole website because of 10-year old file noone probably ever opened in all that time... @Porthos thanks, I will check that list. But again - this is stupid to mark random tutorial app to be malware... Link to post
morsik Posted September 16 Author ID:1661322 Share Posted September 16 @TeMerc: we decided to took the file down since it was 10 years old code anyway. Please confirm on Malwarebytes side and unblock page please. I'll write to those Vendors in the meantime for further explanation why that was blocked in the first place. 1 Link to post
Staff TeMerc Posted September 16 Staff ID:1661326 Share Posted September 16 14 minutes ago, morsik said: @TeMerc: we decided to took the file down since it was 10 years old code anyway. Please confirm on Malwarebytes side and unblock page please. I'll write to those Vendors in the meantime for further explanation why that was blocked in the first place. Hi, very well the url in question is no longer active, the block has been disabled 1 Link to post
morsik Posted September 16 Author ID:1661327 Share Posted September 16 Thank you very much for your help! Link to post
morsik Posted September 26 Author ID:1663471 Share Posted September 26 Hi, coming back to you @TeMerc... Apparently you are blocking our Blog now for "phishing" (WHY?!). Could you explain what's wrong this time? :/ Link to post
Porthos Posted September 26 ID:1663478 Share Posted September 26 This is a Browser Guard exclusive "Heuristic" block. I have moved your post to the correct section so the Browser Guard team can address it. @JPopovic@BjelakovicL 1 Link to post
morsik Posted September 26 Author ID:1663480 Share Posted September 26 Oh thank you @Porthos, I didn't want to spam with another topic for the same website and this still looks looks like false-positive for me, so... didn't know it should be in another section. Link to post
Porthos Posted September 26 ID:1663482 Share Posted September 26 @morsik I would also suggest the following and see if it corrects the issue. If you're having issues with Malwarebytes Browser Guard you may want to try to update the program manually. Click on the extension icon If you can not see the Browser Guard icon in the browser toolbar, click the puzzle icon and unhide or pin the icon. Click the Kebab Menu -> then Support Click the Check for database updates button If still having an issue then click Clear Browser Guard Storage, Restart the Browser, and check for Database Updates again Link to post
morsik Posted September 26 Author ID:1663484 Share Posted September 26 @Porthos I don't use MalwareBytes. Our clients reported us this issue and the screenshot comes from one of them. Link to post
Porthos Posted September 26 ID:1663486 Share Posted September 26 Then we will have to wait for the browser guard team to address this. Link to post
Staff JPopovic Posted September 27 Staff ID:1663565 Share Posted September 27 The domain will be whitelisted. Thank you! Link to post
Recommended Posts