FALSE POSITIVE DiagPlugin

[Chaa]

Hello.

Your antivirus McAfee Endpoint Security 10.7 incorrectly detects our product as a malware or adware or PUP - see screenshot in attachment.

Product name: McAfee Endpoint Security 
Antivirus version: 10.7
Virus definitions is up to date (12.02.2020, 14:00, UTC+8)

Link to download our software:
https://help.kontur.ru/files/DiagPlugin_user.000629.exe

VirusTotal reports (file and URL are clean):

https://www.virustotal.com/gui/url/e50ec67a8154a288a4f602dfaea6300551d8a91f08633253a03a06b93bb8d8a0/...

https://www.virustotal.com/gui/file/fd8f9806ef3e71f489e3e66450c84c39334d1ac64d31c54d48f566652572db94...

Please fix false positive in your antivirus.

--
With respect, Andrew
Software developer

[londonsec]

You need to work with McAfee development and research in order to have your product status changed.  If your technology performs any malicious actions, or actions which could be interpreted as malicious...then you need to justify and validate these actions with McAfee's teams.

Submitting a request through the community portal is not the way to get this done. 

[Chaa]

Okay, how I can contact with McAfee development and research?

1) McAfee do not answer me via email;
2) I do not have a GrantNumber to access support.mcafee.com, because I am a software developer, but not an user of McAfee's products;
3) I do not know other ways to contact with McAfee.

Please tell me the proven way to contact with McAfee.

--
With respect, Andrew
Software developer

[Chaa]

Useless forum...

[AdithyanT]

Hi @Chaa,

Firstly, My very sincere apologies for the delay in response on this. It is very rare and unusual for us to miss posts from our Customers for such a long period of time but this has happened and I sincerely apologize for the same.

Having said that, I shall look into this issue for you. Kindly please bear with me while I investigate this.

Note: If you wish to contact Technical Support, and you are not a customer of McAfee, please feel free to contact out customer care and collect a  temporary Grant# using which you can create a support request for addressing these FP issues.

[AdithyanT]

Hi @Chaa,

Thank you for your time. Firstly, Looking into the screengrab attached, it looks like Russian and I am afraid I do not understand the same. Is there any way you can translate this for me please?

Also, I looked into this File Hash and I do not see a detection currently for the same. Also, it is important to note that I do not see a history for this detection as well!

So I expect the translation of the words in that image might just help us here.

Meanwhile, I am still looking into the URL classification for you. Please bear with me for few more minutes on the same.

[AdithyanT]

Hi @Chaa,

Thank you for your time. I have looked into the URL part as well and the URL seems to be classified as "Business" and is show to have "Minimal risk".

I suppose this issue you are facing could have come up due to a misconfiguration of the product. Please let me know if you can translate the detection information on screengrab based on which we can progress further on this for you!

Note: trustedsource.org is the link we use to verify how a URL is categorized for our product!

Looking forward to your kind response.

Once again, My very sincere apologies for the delay from our end.

[Chaa]

I translated my first screenshot - in attach you can find approximate translation.

Thank you for help with categorizing the URL of my file.

And I did not know that I could get a temporary Grant#, because this problem was on a computer of our customer, and we can not install all antiviruses only to have ability to send False Positive to all antivirus companies. But since you say so, I'll try to do it.

Thank you.

[AdithyanT]

Hi @Chaa,

Thank you for giving us another opportunity to assist you. I just tried downloading this file on a test machine with Endpoint Security installed and I am unable to replicate the issue. 

You do not have to really install the product and test it, however if you can replicate the issue or if the customer can, we will be glad to work with them form our end and assist them on the same.

I can confirm that the download goes through fine without nay issues via Google Chrome and Firefox and the File is not being marked malicious at all! Thank you for your patience and help in translation of the statement. I am suspecting they may have a configuration issue.

Once again apologies you had to wait for our response for 2 weeks. We will stay more alert to your posts in the future.