Hi we are a software company and our new soft 2018 are detected by avast like a virus Win32-EvoGen or FileRepmalware. We have now a huge quantity of call from our clients.
We have declare our soft like false positive (Thursday 05/07) but we dont’ any news from avast.
What do we have to do ? When can we expect a correction?
For information, all installations are digitally signed with an EV certificate sha256 and we had so far protected from these problems.
By example, you can find some download url :http://tele5.index-education.com/telechargement/edt/v2018.0/exe/Install_EDTserveur_IT_2018.0.1.1_win32.exe http://tele5.index-education.com/telechargement/edt/v2018.0/exe/Install_EDTmonoposte_FR_2018.0.1.0_win64.exe http://tele5.index-education.com/telechargement/edt/v2017.0/exe/Install_EDTmonoposte_FR_2017.0.2.10_win32_maj.exe
What do you recommend as action in general before publishing a version?
Here, a report from virus total site : https://www.virustotal.com/fr/file/81ad44ae35c6283df717efdc878992d88b4d4f644f151794a9ce4e21e0759022/analysis/1530959483/
Only AVG detect our software like a virus.
Do something quickly please, a year’s work of a hundred people is being ruined!
Best regards
Laurent ESPARIAT
Thanks Adam for your quick reply.
system
July 8, 2018, 10:43am
6
Thanks Adam !
When you say “And I make whole certificate clean which should suppress a new false positives.”, it means that all installations signed by our certificate would never be considered like a virus ?
Publishing a version of our software includes 200 installations and we are likely to release a new version at any time. I am therefore very worried about these abusive detections.
Other question, when do you think your transaction will take effect on client computers ?
In any case, I thank you for your responsiveness.
Best regards
Laurent
Pondus
July 8, 2018, 11:38am
7
Other question, when do you think your transaction will take effect on client computers ?
If this was released by stream updates (evry 5-15 minutes) it is already out
You may run manual update and reboot
system
July 8, 2018, 11:50am
8
hello everybody,
on “https://support.avast.com/en-ww/article/Threat-Lab-file-whitelist ”, i can read “Vendors who sign their applications with digital signatures can apply for whitelisting via their digital signature. This type of whitelisting is provided to a limited number of digital signatures, and only if the software developer has a clean track record.”.
It’s very interesting for us ! How can i submit our digital signature ?
Thanks
Best regards
Laurent ESPARIAT
Pondus
July 8, 2018, 12:01pm
9
It's very interesting for us ! How can i submit our digital signature ?
Click and read chapter > How can I submit a file?
system
July 8, 2018, 1:07pm
10
hello
Good news ! All installations aren’t detected as a virus anymore.
Last problem, our update servers urls are blacklisted :maj1.index-education.com maj2.index-education.com
and perhaps our official download servers url :tele3.index-education.com tele5.index-education.com
Perhaps an other whitelisting form ? I’m searching …
Hi,
yes, files signed by your certificate would never be considered like a virus. Only if we see very suspicious activity, but this is not the case.
Detections were disabled via stream update so it’s few minutes how was said.
Glad to help,
system
July 8, 2018, 1:20pm
12
Thanks Adam !
Latest problems with our download urls exposed in my last message.
Logically, with the false positives and the number of our customers, the urls have been blacklisted.
maj1.index-education.com maj2.index-education.com
and perhaps our official download servers url :tele3.index-education.com tele5.index-education.com
Thanks again.
Laurent
I’am disabling all urlblocks which were created because they were registered as the source of false positive exe files, which were clean.
URL mask: *.index-education.com
Give me a few minutes.
Adam
system
July 8, 2018, 2:17pm
14
Hi Adam,
url seems good.
But now, avast detects setup.exe as a virus !
Let’s me explain.
With Installshield, we can do a setup (setup.exe and some data files) and we can package these files in a single exe (package for the web) which is signed by our certificate. Setup.exe isn’t signed. It’s an internal process of installshield.
This setup.exe is the same for months and now it’s detected !
I am completely disappointed.
What can I do now ?
Laurent
Can you please send me the sha or the link to https://www.virustotal.com ?
system
July 8, 2018, 2:57pm
16
I’m analysing Installshield project and I see that I can sign setup.exe.
Building installation makes a new setup.exe (installshield compiler).
I will change installations tomorrow for next releases.
Just for now, I can analyse setup.exe with virustotal if you want.https://www.virustotal.com/fr/file/2824b5d61b41cb040a3bf1c8cfb4d17f47aecf4d0bd24a38bcafcf669d7cc811/analysis/1531061627/
But, in fact, i think that our 200 differents installations have 200 differents setup.exe (Slightly different with differents properties for example).
Can we hope that these setup.exe aren’t detected right now ?
Hi,
detection disabled, thanks for signing the setup.
Adam
system
July 8, 2018, 3:53pm
18
Hi I can t test right now.
But is your last operation impacts all my setup.exe ?
Thanks
Interesting,
I was digging in the submit DB and found these samples by name of parent process and the location on a customer machine:
04433D326B4E14A380CDC8BFA27394D178744A19061EF31817823BE8E918D90C
There was about 5 detections on them. I disable them and whitelisted samples, but this is not the generic solution.
Adam
system
July 8, 2018, 9:06pm
20
Hi
Perhaps i can give you all sha256 thumbprint of setup.exe.
In a simple text file ?
