Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 935454" data-attributes="member: 32260">[USER=91050]@LaurentG[/USER],I retested the script today and it is again blocked by AMSI-based detection Trojan:VBS/Mountsi.A!ml. This detection reappeared again when I resubmitted the script to remove another AMSI-based detection Trojan:O97M/Mountsi.D!.It seems that Microsoft has a technical problem with the effective whitelisting of AMSI-based detections, even when they accept that the file is not malicious. For curiosity, I will resubmit the script last time.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />Here is my question included in the submission:&quot;This file was already submitted 3 times Submission ID: 20b966a5-96e8-4b0e-8eed-81dff67d19ad, Submission ID: ac783499-ad48-42fe-8d8b-2a674ef0e13f and Submission ID: 9644028f-e75f-4f10-b26f-dabdcb60bb43. The first submission should remove the detection TrojanDownloader:HTML/Adodb.gen!A. The second and third submissions were claimed to successfully remove the post execution AMSI-based detections Trojan:VBS/Mountsi.A!ml and Trojan:O97M/Mountsi.D!. Unfortunately the script is still blocked by&nbsp; Trojan:VBS/Mountsi.A!ml even after removing the dynamic signatures and updating the signatures. Is there any technical reason which prevents effectively remove this false positives? &quot;</blockquote>

[QUOTE="Andy Ful, post: 935454, member: 32260"] [USER=91050]@LaurentG[/USER], I retested the script today and it is again blocked by AMSI-based detection [B]Trojan:VBS/Mountsi.A!ml. [/B]This detection reappeared again when I resubmitted the script to remove another AMSI-based detection [B]Trojan:O97M/Mountsi.D![/B]. It seems that Microsoft has a technical problem with the effective whitelisting of AMSI-based detections, even when they accept that the file is not malicious. For curiosity, I will resubmit the script last time.:) Here is my question included in the submission: "[I]This file was already submitted 3 times Submission ID: 20b966a5-96e8-4b0e-8eed-81dff67d19ad, Submission ID: ac783499-ad48-42fe-8d8b-2a674ef0e13f and Submission ID: 9644028f-e75f-4f10-b26f-dabdcb60bb43. The first submission should remove the detection TrojanDownloader:HTML/Adodb.gen!A. The second and third submissions were claimed to successfully remove the post execution AMSI-based detections Trojan:VBS/Mountsi.A!ml and Trojan:O97M/Mountsi.D!. Unfortunately the script is still blocked by Trojan:VBS/Mountsi.A!ml even after removing the dynamic signatures and updating the signatures. Is there any technical reason which prevents effectively remove this false positives? [/I]" [/QUOTE]

Verification