False positive malware detections for syncthing-1.21.0-setup.exe

[Bill-Stewart]

VirusTotal link:

https://www.virustotal.com/gui/file/f3b7de57a9eb522c00e0e8e632a408b84209d20ea9f367e618442c05e55b6654

I have submitted to the following vendors as a false positive. "Fixed" means the vendor has acknowledged the false positive and marked it as not malware.

• BitDefender: Fixed
• Broadcom/Symantec: Fixed
• AVG: Fixed
• Avast: Fixed
• ALYac (estsecurity.com): Awaiting response
• Cylance: Awaiting response
• ESET-NOD32: Awaiting response
• Fortinet: Awaiting response
• McAfee: Awaiting response
• Microsoft: Awaiting response
• Sophos: Awaiting response
• VIPRE: Awaiting response

That's all I have time for right now.

[Bill-Stewart]

Updated list:

• BitDefender: Fixed
• Broadcom/Symantec: Fixed
• AVG: Fixed
• Avast: Fixed
• VIPRE: Fixed
• ALYac (estsecurity.com): Awaiting response
• Cylance: Awaiting response
• ESET-NOD32: Awaiting response
• Fortinet: Awaiting response
• McAfee: Awaiting response
• Microsoft: Awaiting response
• Sophos: Awaiting response

[Myhdd201]

Please add Kaspersky too, have same false positive detection.

[Bill-Stewart]

@Myhdd201 yes, please go ahead and submit it to them as a false-positive.

[Bill-Stewart]

I just requested a rescan, and it looks like McAfee might have fixed their false positive. We're now down to 12 vendors from 15 yesterday. The VirusTotal page for Kaspersky says the file is clean.

[Bill-Stewart]

Update:

• BitDefender: Fixed
• Broadcom/Symantec: Fixed
• AVG: Fixed
• Avast: Fixed
• McAfee: Fixed
• VIPRE: Fixed
• ALYac (estsecurity.com): Awaiting response
• Cylance: Awaiting response
• ESET-NOD32: Awaiting response
• Fortinet: Awaiting response
• K7AntiVirus: Awaiting response
• Microsoft: Awaiting response
• Panda: Awaiting response
• Sophos: Awaiting response

Down to 8 vendors.

[Bill-Stewart]

Here are the vendors that are still incorrectly flagging the installer as a false positive:

• Cylance - Unsafe
• DrWeb - Tool.InstSrv.3
• ESET-NOD32 - A Variant of Win32/NSSM.D Potentially Unsafe
• Fortinet - Riskware/NSSM
• Google - Detected
• Ikarus - Not-a-virus:RiskTool.NSSM
• Palo Alto Networks - Generic.ml
• Panda - Trj/Chgt.AD
• Sophos - Generic Reputation PUA (PUA)

Comments:

• Cylance - I have sent 6 separate emails to cylancefilesubmit@blackberry.com with the relevant details but these seem to be getting ignored. There does not seem to be a way to submit false positives to them.
• DrWeb - I have not had time to research how to send them the false positive.
• ESET-NOD32 - I sent a copy of the false positive to samples@eset.com with the relevant details. No response yet.
• Fortinet wants to argue about the fact that the installer doesn't display a license agreement and that a file gets left in the application directory after an uninstall. I have explained that the both Syncthing and the installer are open source and there's no need to display a license agreement and that a leftover file is normal if Syncthing automatically upgraded itself. But so far they just don't seem to "get" the fact that these behaviors are perfectly normal for this case.
• Ikarus - I have not had time to research how to send them the false positive.
• Palo Alto Networks - I have not had time to research how to send them the false positive.
• Panda - I have sent 2 separate emails to Panda: One to falsepositives@pandasecurity.com and one to support@pandasecurity.com to request they fix this. No response.
• Sophos - I have submitted the false positive to them via their online form. No response yet.

We'll see what happens.

[Bill-Stewart]

Closing this one since I just uploaded 1.22.1.