Q&A False positive with Bitdefender

[Guilhermesene]

Hello my friends from MalwareTips forum!

I am working/studying some code that I am developing for the university where I study and I decided to put them online so that a friend can work together with me on the project.

I decided to download it from GitHub Desktop when I ran into my BTS saying that the GitHub Desktop installer page was blocked (because it's a dangerous page).

Could someone please test with another antivirus engine? I tested it with virustotal and it shows that the page is clean (it doesn't make sense, since GitHub is very "famous", so to speak, and would not be infected).

I have already reported the false positive (which I believe is to Bitdefender), but I confess that I was a little disappointed with the product because the site with this situation is from a worldwide well known company.

I am thinking about how I am going to work now, because according to the email I received from Bitdefender (automatic email) it will take up to 72 hours to analyze whether it is really a false positive or not.

Source: GitHub Desktop
Download link: GitHub Desktop Application

Thank you all.

 

[The_King]

Not blocked by my BTS. The file is downloading.

Ok spoke too soon download was quarantine.

 

[Guilhermesene]

Not blocked by my BTS. The file is downloading

Here for me the file is downloading... but when it finishes, it loops and starts again, and simultaneously the BTS keeps telling me that it is blocking the connection.

 

[SecureKongo]

I am thinking about how I am going to work now, because according to the email I received from Bitdefender (automatic email) it will take up to 72 hours to analyze whether it is really a false positive or not.

Whitelist and continue as planned. Definitely a false positive.

 

[Shadowra]

Undetected VirusTotal

Website : VirusTotal

Files : VirusTotal

 

[Guilhermesene]

Undetected VirusTotal

Website : VirusTotal

Files : VirusTotal

Yes I did that too, first thing I did actually was to check with VirusTotal

 

[RoboMan]

Here with ESET...

Downloaded OK, no issues or red flags

 

[Shadowra]

Yes I did that too, first thing I did actually was to check with VirusTotal

False positive confirmed !

F-Secure SAFE : Undetected

 

[The_King]

Add to file to OTP Exclusion list.

https://desktop.githubusercontent.com/github-desktop/releases/2.9.4-24101633/GitHubDesktopSetup-x64.exe

 

[Guilhermesene]

Here with ESET...

Downloaded OK, no issues or red flags

Thank you @RoboMan

I knew you wouldn't let me down, great master robot destroyer of all chains, great explorer of new paths, destroyer of all dragons, father of all robots

 

[Guilhermesene]

View attachment 262058

False positive confirmed !

F-Secure SAFE : Undetected

Thanks @Shadowra , great malware tester!

 

[Guilhermesene]

Add to file to OTP Exclusion list.

https://desktop.githubusercontent.com/github-desktop/releases/2.9.4-24101633/GitHubDesktopSetup-x64.exe

Thank you noble @The_King!

 

[JB007]

Hello my friends from MalwareTips forum!

I am working/studying some code that I am developing for the university where I study and I decided to put them online so that a friend can work together with me on the project.

I decided to download it from GitHub Desktop when I ran into my BTS saying that the GitHub Desktop installer page was blocked (because it's a dangerous page).

View attachment 262056View attachment 262057

Could someone please test with another antivirus engine? I tested it with virustotal and it shows that the page is clean (it doesn't make sense, since GitHub is very "famous", so to speak, and would not be infected).

I have already reported the false positive (which I believe is to Bitdefender), but I confess that I was a little disappointed with the product because the site with this situation is from a worldwide well known company.

I am thinking about how I am going to work now, because according to the email I received from Bitdefender (automatic email) it will take up to 72 hours to analyze whether it is really a false positive or not.

Source: GitHub Desktop
Download link: GitHub Desktop Application

Thank you all.

Hello @Guilhermesene
Try to contact directly the support with the integrated tool.
It worked fast and fine for me in France.

 

[Guilhermesene]

Hello @Guilhermesene
Try to contact directly the support with the integrated tool.
It worked fast and fine for me in France.
View attachment 262059

Hello @JB007

So I reported the GitHub Desktop site and the executable file to the Bitdefender site via this here.

But anyway, I had a look here in my BTS about what you said.

I hope the Bitdefender team will solve this problem as soon as possible.

Thank you for your comment.

 

[JB007]

Hello @JB007

So I reported the GitHub Desktop site and the executable file to the Bitdefender site via this here.

But anyway, I had a look here in my BTS about what you said.

I hope the Bitdefender team will solve this problem as soon as possible.

Thank you for your comment.

I never got an answer (only the automatic one) with this site https://www.bitdefender.com/consumer/support/answer/29358/
but the direct support is very fast.

 

[Guilhermesene]

I never got an answer (only the automatic one) with this site https://www.bitdefender.com/consumer/support/answer/29358/
but the direct support is very fast.

I did what you said @JB007.

I contacted the direct support and they answered me instantly.

However, unfortunately they sent me the link where I quoted and you also quoted, then basically did not solve the problem, I was only indicated to send the false positive by the site that I had already done .

 

[Nautilus]

both the source site and the file downloaded are clean by avast standards here so it might be a false positive at bitdefenders end.

 

[Guilhermesene]

both the source site and the file downloaded are clean by avast standards here so it might be a false positive at bitdefenders end.

Yes, it is a false positive from Bitdefender.

ESET => clean
Avast => clean
Kaspersky => clean

 

[JB007]

Here Free Automated Malware Analysis Service - powered by Falcon Sandbox

and here Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'https://desktop.githubusercontent.com/github-desktop/releases/2.9.4-24101633'

 

[JB007]

I did what you said @JB007.

I contacted the direct support and they answered me instantly.

However, unfortunately they sent me the link where I quoted and you also quoted, then basically did not solve the problem, I was only indicated to send the false positive by the site that I had already done .

Hello @Guilhermesene
You are right !
I am unpleasantly surprised because in the previous version there was the possibility to contact directly the support opening the integrated tool and after reproducing the problem the tool collected the logs.
Unfortunately this very useful feature seems to have disappeared.