Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 6 subscribers
  • Views 13471 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Many false positives on my own software

yaek

Hi:

I scanned my computer with Sophos Virus Removal Tool utility

But it returns many false positives in my own applications :smileyfrustrated: (i am software developer). Returns falses positives on all exe files and / or obfuscated (obfuscated to protect intellectual property). These files are safe and lawful !


this causes problems of mistrust in customers!

false positives are of type:

Mal/EncPk-SF

Mal/EncPk-UG

How I can contact the technical department to solve this? (to send a sample of some files).

:26037


This thread was automatically locked due to age.
  • 0

    Hi,

    You can submit them here:

    https://secure2.sophos.com/en-us/support/contact-support/sample-submission.aspx

    maybe include a brief description and what they are authored in and packaged by.

    Regards,

    Jak

    :26039
  • 0

    Good luck on submitting to support (as recommended by JAK). I've tried to submit a possible bug report for something of a similar situation (see < /search?q= 26893 >) only to get blown off by the support people because I'm using a free version and don't have a commerical license. While I understand not being able to provide active, direct, one-on-one support to users of free products, you'd think that a report of a possible bug would be of interest regardless of the source. After all, a bug of this nature would affect licensed users as much as the users of the free tools but the support people don't seem to have any interest in any reports from users of free products.

    :26895
  • 0

    Hi Yaek,

    These detections are based on the packer you're using, since we've observed the packer you're using is commonly used with malware. It's very hard to whitelist or exclude your binaries as they will undoubtedly keep changing. Do you have any options on using a different packer? That would hopefully avoid the situation.

    Thanks.

    :26899
  • 0

    In my case:

    To say that the same day I sent my issue through the form, explaining that happened and a sample of my files. They reply to me very quickly. And now everything is solved. No returns false positive :smileywink:

    :26951
  • 0

    Hi Metalman!

    Yes I can change it for the next versions. But old versions I can not change it

    These exes are developed using Microsoft Visual Studio IDE

    :26953