Adlice forum

Software feedback => RogueKiller PREMIUM => Topic started by: mrmike570 on November 27, 2018, 01:41:28 pm

Title: False Positive
Post by: mrmike570 on November 27, 2018, 01:41:28 pm
Hello and Good Morning...
I recently installed a new antivirus called IMMUNET, believe its new from Cisco Systems..
I ran a check this morning with Rogue Killer and there was a hit for the following. 

Process: [Test.EICAR (Malicious)] sfc.exe (3860) -- (Cisco Systems, Inc.) C:\Program Files\Immunet\6.2.0\sfc.exe -> Found

I do know EICARis a test file, however, id like a second opinion..Thank You.   Michael   

I attached the text file also...for your perusal...
Title: Re: False Positive
Post by: Curson on November 27, 2018, 04:14:35 pm
Hi Michael,

Thanks for your feedback.
Could you please zip the file detected as EICAR (sfc.exe) and attach the archive with your next reply ?

Regards.
Title: Re: False Positive
Post by: mrmike570 on November 27, 2018, 04:28:07 pm
Hello..I have attached the zip file as requested..Thank You for responding so quickly.. 
Title: Re: False Positive
Post by: Curson on November 27, 2018, 05:38:51 pm
Hi Michael,

You zipped RogueKiller's report, not the file triggering the detection :
Quote
C:\Program Files\Immunet\6.2.0\sfc.exe

Could you please do it again ?

Regards.
Title: Re: False Positive
Post by: mrmike570 on November 27, 2018, 11:56:41 pm
Ok, lets try this one...sorry about that..kinda new at this..
Title: Re: False Positive
Post by: Curson on November 28, 2018, 05:15:08 pm
Hi Michael,

That's the right one.
This is a confirmed false positive. We will whitelist it as soon as possible.

Thanks again for your feedback.

Regards.
Title: possible false positive info
Post by: mrmike570 on December 11, 2018, 03:01:29 pm
Hello...just got a windows 10 pre-release update...18298..I rana a scan with Rogue Killer and it alerted to a few things...that it classified as potential threat...I am enclosing a couple of files for your perusal.. would appreciate any input you have...Thank You.. Michael
Title: Re: possible false positive info
Post by: mrmike570 on December 11, 2018, 03:02:48 pm
forgot to add the json file...
Title: Re: False Positive
Post by: Curson on December 11, 2018, 07:55:13 pm
Hi Michael,

A [VT.Unknown] detection means the file is unknown on VirusTotal. Itís probably because itís quite new and hasnít been uploaded yet. Simply accept the upload when asked. Once scanned , RogueKiller shouldnít detect the file anymore, unless itís malicious.

Regards.