Assigned Zemana False Positive Report Thread

[TwinHeadedEagle]

Hi

And what is with me this my 3 Files

With best Regards
Mops21

I think that should be taken care of in next version.

 

[Mops21]

I think that should be taken care of in next version.

Also are my screenshots the right ones of it and thank you very much for your help. Can I submit via the report as safe via the program or not

With best Regards
Mops21

 

[TwinHeadedEagle]

Yes, you can Report it as Safe.

 

[Mops21]

Also are my screenshots the right ones of it and thank you very much for your help.

Okay I will make it very soon

With best Regards
Mops21

 

[Mops21]

Hi

Here are 6 Files for you

DriverEasy_5.0.4.12293.exe
Status : Gescannt
Pfad : %userprofile%\downloads\drivereasy_5.0.4.12293.exe
MD5-Hash : 1FF655478C47ECA221DE43473E40F563
Herausgeber : Easeware Technology Limited
Größe : 3612024
Version : 5.0.4.0
Bedrohung : Adware:Win32/AutoBulk.222e49!Ep
Gewählte Aktion : Quarantäne
Spuren :
Datei - %userprofile%\downloads\drivereasy_5.0.4.12293.exe

DriverEasy_5.0.2.42137.exe
Status : Gescannt
Pfad : %userprofile%\downloads\drivereasy_5.0.2.42137.exe
MD5-Hash : 5AB7B2260A25B7383D5396F4697996F1
Herausgeber : Easeware Technology Limited
Größe : 3726120
Version : 5.0.2.0
Bedrohung : Adware:Win32/AutoBulk.222e49!Ep
Gewählte Aktion : Quarantäne
Spuren :
Datei - %userprofile%\downloads\drivereasy_5.0.2.42137.exe

DriverEasy_5.0.3.14912.exe
Status : Gescannt
Pfad : %userprofile%\downloads\drivereasy_5.0.3.14912.exe
MD5-Hash : CF002157259E40AEA1DF6AE8A271C76B
Herausgeber : Easeware Technology Limited
Größe : 3739680
Version : 5.0.3.0
Bedrohung : Adware:Win32/AutoBulk.222e49!Ep
Gewählte Aktion : Quarantäne
Spuren :
Datei - %userprofile%\downloads\drivereasy_5.0.3.14912.exe

HardwareInfo.dll
Status : Gescannt
Pfad : %programw6432%\easeware\drivereasy\hardwareinfo\hardwareinfo.dll
MD5-Hash : 0CA3264BA0CFD27730B2F3DB2F423190
Herausgeber : Easeware Technology Limited
Größe : 1098096
Version : 1.1.3.1
Bedrohung : Adware:Win32/AutoBulk.222e49!Ep
Gewählte Aktion : Quarantäne
Spuren :
Datei - %programw6432%\easeware\drivereasy\hardwareinfo\hardwareinfo.dll

Easeware.ConfigLanguageFromSetup.exe
Status : Gescannt
Pfad : %programw6432%\easeware\drivereasy\easeware.configlanguagefromsetup.exe
MD5-Hash : ACC9EA65DA41C170E18F56D33EF648A1
Herausgeber : Easeware Technology Limited
Größe : 16752
Version : 1.0.4.0
Bedrohung : Adware:Win32/AutoBulk.222e49!Ep
Gewählte Aktion : Quarantäne
Spuren :
Datei - %programw6432%\easeware\drivereasy\easeware.configlanguagefromsetup.exe

HardwareInfo64.dll
Status : Gescannt
Pfad : %programw6432%\easeware\drivereasy\hardwareinfo\hardwareinfo64.dll
MD5-Hash : 0510AA9C3FAD3F5613B5BA0957F99078
Herausgeber : Easeware Technology Limited
Größe : 1291632
Version : 1.1.3.1
Bedrohung : Adware:Win32/AutoBulk.222e49!Ep
Gewählte Aktion : Quarantäne
Spuren :
Datei - %programw6432%\easeware\drivereasy\hardwareinfo\hardwareinfo64.dll

With best Regards
Mops21

 

[TwinHeadedEagle]

@Mops21

This will be handled tomorrow.

@Huracan

Can you give me the link of Google store for this extension? I can't find it anywhere. It must be something very new and that's probably the reason why it is detected. However, you should not receive detection for this anymore.

 

[Ink]

I will have a look, but I haven't added any new extensions in a few months.

 

[elmph123]

I assume a FP by Pandora? I haven't made any changes to Chrome, only updates. -- Will disable Pandora.

Doesn't Pandora only work in real-time?

 

[TwinHeadedEagle]

@Mops21

Please let me know if you still have detection.

Doesn't Pandora only work in real-time?

Yes, it only works on a realtime basis.

 

[Mops21]

Hi @TwinHeadedEagle

Yes it is fixed now. Thank you very much for your help

With best Regards
Mops21

 

[Der.Reisende]

Hi @TwinHeadedEagle,
I suppose this one to be an FP, according to VT. Found during a full scan running in memory.

Spoiler: FP

Antivirus scan for 79525a3c17dc6fe54efb73fc7116f4056b49cbf0b874ed1a819e451d2f00f4fd at 2016-05-14 10:18:08 UTC - VirusTotal

PM me if you need the file. Thank you in advance!

 

[TwinHeadedEagle]

Can you try now, do you still have this detection?

 

[Der.Reisende]

Can you try now, do you still have this detection?

Would love to attach an log stating the file scanned, not possible, but can confirm drag + dropping the MSBuild.exe to ZAM Premium now doesn't give any detection (Pandora on).
Thank you for the fast response

 

[TwinHeadedEagle]

Yes, this kind of FP is happening often, but we're aware of it and it will be fixed.

 

[Der.Reisende]

I assume a FP by Pandora? I haven't made any changes to Chrome, only updates. -- Will disable Pandora.

View attachment 99734

Hi @Huracan, in case you didn't know already, you can exclude those, too, if you trust the alteration If you did already, please don't mind me telling you that I did so with my extensions and the alteration to start chrome always incognito and to disallow referrers.
Just click on the drop-down thing which states "Report as safe" in your screenshot.
It's a good feature of ZAM warning you about any alterations to the browser.

 

[Ink]

I will have a look, but I haven't added any new extensions in a few months.

Update to detection of --app-id={random 32 letters} in ZAM with Pandora enabled. These are either flagged browser settings or bookmarked sites. You can verify if they are bookmarked sites, but creating the following shortcut.

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --profile-directory=Default --app-id={random 32 letters}

Check the Logs in Zemana to replace the {random 32 letters} with the suspected object.

 

[Noxx]

RE-HIPS is being detected and blocked as a suspicious file. I attached the installer exe and sent it to you guys via the 'send feedback" feature. Here's a photo of the specific files blocked:

 

[DJ Panda]

This is a FP for a Steam game called FaceRig
VT: Antivirus scan for c6ed987acd902a027d8d418bfe2a758c3187fae938f2e597c0189d24d5d076e6 at 2016-05-21 04:58:24 UTC - VirusTotal

 

[TwinHeadedEagle]

@Noxx

Can you please upload installer here?

@J Gamez065

Do you still have detection?

 

[Noxx]

@Noxx

Can you please upload installer here?

@J Gamez065

Do you still have detection?

Sent you the file via PM.

EDIT: RE-HIPS is now whitelisted in Zemana AntiMalware. Thanks TwinHeadedEagle!