[Solved] False Positive detection on EvernoteMarkup.exe VPS:131114-1

Hi all

I am seeing a detection on a file called EvernoteMarkup.exe.

I don’t believe this to be a correct detection. I have submitted via the program, and tried to send via email but it seems to fail. (I think because of the file size)

VT:
https://www.virustotal.com/en/file/5d1100cb40f45d44d0982c0b9bbf79c1f6394e6ad2dd065492beabd7a9508f87/analysis/1384543254/

Thanks

Scott

EDIT: Fixed in 131116-0

First submission 2013-11-15 19:20:54 UTC (37 Minutes ago)

Maybe this is not a false positive.

Are you sure?

Upload to ThreatExpert and see what it does http://www.threatexpert.com/submit.aspx

Nope… file is to big… max 5mb upload

You can also use Malwr: https://malwr.com/submission/

Hello,
send the file to virus@avast.com put “False positive” to email subject.

Milos

That was me, sure. This is a new file from Evernote as part of a new beta released today. I feel that it is a false positive, yes.

That failed with an error:

ERROR :-( Uploaded file over size limit.

I have tried that, a few times now. The email fails to send. I think this is because of the size. It is 46 MB uncompressed.
Do you have an alternative way for me to send you the file?

Scott

Put the into a zip folder and set a password on it.

Maybe it works then.

You can also send files via chest. Right click on file in chest and choose send to virus lab.
Fill the form and send it. File will be sent in next update.

It is the zipped/passworded file that is failing to be emailed.

Like I said in the first post, I have sent it via the virus chest.

Can you upload it somewhere like Google Drive and send a link?

Or can you send a direct download link?

Duh, forgot about a link :smiley:

It is found in the install file here:
http://cdn1.evernote.com/win5/prerelease/Evernote_5.1.0.1869.exe

Okay, send that link to Avast and explain the problem to them.

Done

Link in an email.

How to send big files :wink: Filemail www.filemail.com reciver get a download link

Hello, Thank you for your message. The detection will be fixed in the next VPS - please update your virus definitions. We are sorry for the inconvenience. Best regards,

Lukas Havel
Technical Support Specialist

Fixed in 131116-0

Thanks all :slight_smile:

Scott