Page 1 of 2

Antivirus false positive

Posted: Sun Feb 16, 2020 10:51 am
by FORScan
FORScan uses binary compression and encryption to reduce the binary size and protect the code. This technique is often used by virus/malware (and often using the same compression/protection system), so some antivirus may throw a false positive if signature matched. We have created this thread to provide information on this issue.

At this moment we have this problem with FORScan v2.3.29 - several anti-virus software throw alerts for it, including Microsoft WIndows Defender. We have submitted the false positive to Microsoft and Bitdefender. Microsoft have already updated their database, so false positive should gone in the next update. They recommend to clear Defnder cache this way:
We have removed the detection. Please follow the steps below to clear cached detection and obtain the latest malware definitions.

1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender
2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”
3. Run "MpCmdRun.exe -SignatureUpdate"

Alternatively, the latest definition is available for download here: https://www.microsoft.com/en-us/wdsi/definitions
Bitdefender promised to check the file and update DB in next 72 hours.

Re: Antivirus false positive

Posted: Mon Feb 17, 2020 5:36 pm
by JAS2006
Thanks for this update!

Re: Antivirus false positive

Posted: Fri Feb 21, 2020 8:35 pm
by FORScan
Update:

Microsoft removed trojan false positive for v2.3.29 from Windows Defender, but now it finds "PUA:Win32/Presenoker" in it :o Other antivirus s/w like Bitdefender seem to simply ignore our request for EXE analysis.

Re: Antivirus false positive

Posted: Tue Feb 25, 2020 8:16 pm
by Jbst
So what now? Did I just waste $40.00 on a obd connector? :roll:

Re: Antivirus false positive

Posted: Wed Feb 26, 2020 7:52 pm
by foden
Jbst wrote:
Tue Feb 25, 2020 8:16 pm
So what now? Did I just waste $40.00 on a obd connector? :roll:
No you should be able to add the forscan as an exception to the anti virus programs or at least allow it to run
as if the anti virus finds the false positives they should quarantine and from there you should be able to choose what you
want the anti virus to do about it i.e allow it to run
then try reinstalling forscan
hope this helps and may resolve your problem (not gauaranteed as there a lot of anti virus programs)
this worked though for me with the windows security program.
foden

Re: Antivirus false positive

Posted: Thu Feb 27, 2020 6:40 pm
by Jbst
Ok thanks. I will try that. Windows defender is my only anti virus.

Re: Antivirus false positive

Posted: Thu Mar 05, 2020 2:49 pm
by yyz2pvg
McAfee is also providing warnings/alerts for this download.

Re: Antivirus false positive

Posted: Sun Mar 08, 2020 12:59 am
by FORScan
We have released v2.3.30 yesterday and tested it on Virustotal to make sure there are no false alerts. Here is the report:

Re: Antivirus false positive

Posted: Mon Mar 09, 2020 3:55 am
by Deejin
FORScan wrote:
Sun Mar 08, 2020 12:59 am
We have released v2.3.30 yesterday and tested it on Virustotal to make sure there are no false alerts. Here is the report:
Thank you very much for your great support, I would like to confirmed, forscan V2.3.30 is no problem about that. I can install and it's working fine from now.
Best Regards,

Re: Antivirus false positive

Posted: Mon Mar 09, 2020 12:56 pm
by eaa53
Adaware still deletes the .exe and the shortcut on the desktop.

Added it to scan exceptions but still deletes them both automatically.

I updated Adaware software but that did not cure it either.