cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

exclusion for malware / trojan detection (false positive)

Jump to solution

Hi Guys,

hope you could help me out. We have a small tool called nettool.exe which is searching for some network printers. Our employees need this tool every day. since a few weeks or months the tool will be deleted by VSE.

 

nettoolexe.png

 

https://www.virustotal.com/#/file/7d932fc5f520b1d6152fd1e7aa74d989ce2c79d648ec5366d1a25a5063a0da67/d...

 

How is it possible to exclude this file from detection? If tried to add some exclusion for on-access scanner and so on without success.

 

Thanks in advance,

Tobi

Labels (6)
1 Solution

Accepted Solutions
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 5 of 6

Re: exclusion for malware / trojan detection (false positive)

Jump to solution

@toto1988 This file is not being detected as a PUP, and so excluding it in your PUP-policy isn't going to resolve the issue. This type of detection is a "generic" threat detection driver that encompasses a wide range of files underneath its scope, and as such, it would not be advised that you do an exclusion for this detection name as you could then be vulnerable to a "real" threat, even if you could exclude it in this way.

Instead, you need to engage Support by opening a ticket with the Malware team for potential false positive investigation. You can submit the file as a sample for this purpose by following the instructions in KB85567. They will be able to assist you in validating the reputation of this file, and resolving the detection in your environment.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

5 Replies
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: exclusion for malware / trojan detection (false positive)

Jump to solution

These type questions should be posted under the ENS/VSE team group.  However, my suggestion would be to submit it as a sample as a false positive.  Is it being detected as a virus or as an unwanted program?  Your exclusions would depend on how it is being detected. 

I will also be transferring this over to the appropriate team.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

McAfee Employee tzemva
McAfee Employee
Report Inappropriate Content
Message 3 of 6

Re: exclusion for malware / trojan detection (false positive)

Jump to solution

Hi @toto1988

Either one of this bellow KB Articles will help you:

Potentially Unwanted Programs continue to be detected when excluded by name only
Technical Articles ID: KB50383

How to submit samples when an application vendor disputes a PUP detection
Technical Articles ID: KB85569

Re: exclusion for malware / trojan detection (false positive)

Jump to solution

Hi,

I did like described in KB50383 (see screenshot below). I set the exclusion on our ePO.

mcafee_pup_nettool.png

Nettool.exe is detected as RDN/Generic.RP and I add a exclusion for RDN/Generic.RP without success.

is there any other way to fix?

 

 

McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 5 of 6

Re: exclusion for malware / trojan detection (false positive)

Jump to solution

@toto1988 This file is not being detected as a PUP, and so excluding it in your PUP-policy isn't going to resolve the issue. This type of detection is a "generic" threat detection driver that encompasses a wide range of files underneath its scope, and as such, it would not be advised that you do an exclusion for this detection name as you could then be vulnerable to a "real" threat, even if you could exclude it in this way.

Instead, you need to engage Support by opening a ticket with the Malware team for potential false positive investigation. You can submit the file as a sample for this purpose by following the instructions in KB85567. They will be able to assist you in validating the reputation of this file, and resolving the detection in your environment.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

Reliable Contributor vnaidu
Reliable Contributor
Report Inappropriate Content
Message 6 of 6

Re: exclusion for malware / trojan detection (false positive)

Jump to solution

We had the similar issue for some time. In our case, we contacted the malware team and submitted the file. McAfee helped us with a negative Extra DAT. That fixed our issue permanently.

So submit the file and get the solution....

 

Venu
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community