NSIS False Positives - Revision history

ChrFranke: + GitHub False-Positive-Center

2023-07-31T09:13:40Z

+ GitHub False-Positive-Center

â† Older revision		Revision as of 09:13, 31 July 2023
Line 90:		Line 90:

	== Where to report false positives ==		== Where to report false positives ==
	* '''Various: [https://www.techsupportalert.com~~/content~~/how-report-malware-or-false-positives-multiple-antivirus-vendors~~.htm~~ How to Report Malware or False Positives to Multiple Antivirus Vendors]~~'''~~		* '''Various: [https://github.com/yaronelh/False-Positive-Center False-Positive-Center (GitHub user yaronelh)]'''
			* Various: [https://www.techsupportalert.com/how-to-report-malware-or-false-positives-to-multiple-antivirus-vendors/ How to Report Malware or False Positives to Multiple Antivirus Vendors] (partly outdated)
	* ALYac: https://en.estsecurity.com/support/report		* ALYac: https://en.estsecurity.com/support/report
	* Antiy-AVL: https://www.antiy.net/contacts/		* Antiy-AVL: https://www.antiy.net/contacts/

Anders: /* Where to report false positives */ BKav, Jiangmin

2023-07-25T19:33:45Z

Where to report false positives: BKav, Jiangmin

â† Older revision		Revision as of 19:33, 25 July 2023
Line 97:		Line 97:
	* AVG: https://www.avg.com/en-us/false-positive-file-form		* AVG: https://www.avg.com/en-us/false-positive-file-form
	* Bitdefender: https://www.bitdefender.com/submit/		* Bitdefender: https://www.bitdefender.com/submit/
			* BKav: https://www.bkav.com/contact-us
	* CrowdStrike Falcon: https://www.crowdstrike.com/contact-us/#VTscanner_(at)_crowdstrike_(dot)_com		* CrowdStrike Falcon: https://www.crowdstrike.com/contact-us/#VTscanner_(at)_crowdstrike_(dot)_com
	* Cyren: https://www.cyren.com/support/reporting-av-misclassifications#FTP_TLS		* Cyren: https://www.cyren.com/support/reporting-av-misclassifications#FTP_TLS
Line 105:		Line 106:
	* GData: https://www.gdatasoftware.com/securitylabs		* GData: https://www.gdatasoftware.com/securitylabs
	* Gridinsoft: https://anti-malware.gridinsoft.com/file-check/# or whitelist at gridinsoft.com for ISVs.		* Gridinsoft: https://anti-malware.gridinsoft.com/file-check/# or whitelist at gridinsoft.com for ISVs.
			* Jiangmin: https://www.jiangmin.com/Abouts/address/ virus_(at)_jiangmin_(dot)_com
	* Lionic: https://www.lionic.com/reportfp/# support at lionic.com		* Lionic: https://www.lionic.com/reportfp/# support at lionic.com
	* Malwarebytes: https://support.malwarebytes.com/hc/en-us/articles/360038524154-Report-a-false-positive-to-Malwarebytes-Support		* Malwarebytes: https://support.malwarebytes.com/hc/en-us/articles/360038524154-Report-a-false-positive-to-Malwarebytes-Support

Anders: /* Where to report false positives */

2023-07-15T19:43:26Z

Where to report false positives

â† Older revision		Revision as of 19:43, 15 July 2023
Line 110:		Line 110:
	* McAfee: https://kc.mcafee.com/corporate/index?page=content&id=KB85568		* McAfee: https://kc.mcafee.com/corporate/index?page=content&id=KB85568
	* Microsoft: https://www.microsoft.com/en-us/wdsi/filesubmission		* Microsoft: https://www.microsoft.com/en-us/wdsi/filesubmission
			* Rising: http://mailcenter.rising.com.cn/filecheck_en/#rising-global.com
	* SangFor: https://community.sangfor.com/forum.php?mod=viewthread&tid=3104#https://sec.sangfor.com.cn/login.html?lang=EN-US		* SangFor: https://community.sangfor.com/forum.php?mod=viewthread&tid=3104#https://sec.sangfor.com.cn/login.html?lang=EN-US
	* SecureAge: https://www.secureage.com/article-report-false-positive		* SecureAge: https://www.secureage.com/article-report-false-positive

Kichik: More details

2022-05-11T19:19:53Z

More details

â† Older revision		Revision as of 19:19, 11 May 2022
Line 1:		Line 1:
	There are hundreds of false positive made with NSIS. This page contains a list of some of them.		There are hundreds of false positive made with NSIS. This page contains a list of some of them.

			== Does NSIS Contain a Virus? ==
			No. NSIS is open source and you can check for yourself. Some people sadly use NSIS to distribute their malware. Even though most modern anti-virus vendors know how to extract and scan files from NSIS installers, some of them still generate signatures on the installer stub itself instead of the files in it. This causes a false positive on multiple installers generated using the same version of NSIS. This is a bug with the anti-virus and they normally fix it pretty quickly once reported back to them. It's like finding a virus in a zip file and marking all zip files as viruses as a result.
			== What Can I Do About My Installer? ==
			# Report the false positive to the AV vendor.
			# Sign your installer. There have been reports it helps.
			# Compile your own version of NSIS with some modifications to avoid the signatures.
	== How Can I Help? ==		== How Can I Help? ==
	The following steps should be done for NSIS installer and the ZIP file. You can also perform them for your own installer.		The following steps should be done for NSIS installer and the ZIP file. You can also perform them for your own installer.

Anders: /* Where to report false positives */ AVG, Cyren, Elastic, Gridinsoft, Lionic

2022-03-23T16:07:45Z

Where to report false positives: AVG, Cyren, Elastic, Gridinsoft, Lionic

â† Older revision		Revision as of 16:07, 23 March 2022
Line 84:		Line 84:

	== Where to report false positives ==		== Where to report false positives ==
			* '''Various: [https://www.techsupportalert.com/content/how-report-malware-or-false-positives-multiple-antivirus-vendors.htm How to Report Malware or False Positives to Multiple Antivirus Vendors]'''
	* ALYac: https://en.estsecurity.com/support/report		* ALYac: https://en.estsecurity.com/support/report
	* Antiy-AVL: https://www.antiy.net/contacts/		* Antiy-AVL: https://www.antiy.net/contacts/
	* Avast: https://www.avast.com/en-us/false-positive-file-form.php#pc		* Avast: https://www.avast.com/en-us/false-positive-file-form.php#pc
	* Avira: https://analysis.avira.com/en/submit		* Avira: https://analysis.avira.com/en/submit
			* AVG: https://www.avg.com/en-us/false-positive-file-form
	* Bitdefender: https://www.bitdefender.com/submit/		* Bitdefender: https://www.bitdefender.com/submit/
			* CrowdStrike Falcon: https://www.crowdstrike.com/contact-us/#VTscanner_(at)_crowdstrike_(dot)_com
			* Cyren: https://www.cyren.com/support/reporting-av-misclassifications#FTP_TLS
	* eGambit (Tehtris): https://tehtris.com/en/false-positive-negative-requests/		* eGambit (Tehtris): https://tehtris.com/en/false-positive-negative-requests/
			* Elastic: https://discuss.elastic.co/t/submitting-false-positives/232322/1# https://app.slack.com/client/TNLBGCXTQ/CRGSUQC20 https://github.com/elastic/detection-rules
			* Emsisoft: fp at emsisoft.com and use "Submit as false alert" as the subject. Zip/Rar with password in the e-mail body.
	* Fortinet: https://fortiguard.com/virusscanner		* Fortinet: https://fortiguard.com/virusscanner
	* GData: https://www.gdatasoftware.com/securitylabs		* GData: https://www.gdatasoftware.com/securitylabs
			* Gridinsoft: https://anti-malware.gridinsoft.com/file-check/# or whitelist at gridinsoft.com for ISVs.
			* Lionic: https://www.lionic.com/reportfp/# support at lionic.com
	* Malwarebytes: https://support.malwarebytes.com/hc/en-us/articles/360038524154-Report-a-false-positive-to-Malwarebytes-Support		* Malwarebytes: https://support.malwarebytes.com/hc/en-us/articles/360038524154-Report-a-false-positive-to-Malwarebytes-Support
	* MaxSecure: infp at maxpcsecure dot com or https://www.maxsecureantivirus.com/submit_aFalse_Positive.htm		* MaxSecure: infp at maxpcsecure dot com or https://www.maxsecureantivirus.com/submit_aFalse_Positive.htm
Line 101:		Line 109:
	* Symantec (Norton): https://submit.symantec.com/false_positive/		* Symantec (Norton): https://submit.symantec.com/false_positive/
	* Trend Micro: https://www.trendmicro.com/en_us/about/legal/detection-reevaluation.html		* Trend Micro: https://www.trendmicro.com/en_us/about/legal/detection-reevaluation.html
	* CrowdStrike Falcon: https://www.crowdstrike.com/contact-us/#VTscanner_(at)_crowdstrike_(dot)_com
	* '''Various: [https://www.techsupportalert.com/content/how-report-malware-or-false-positives-multiple-antivirus-vendors.htm How to Report Malware or False Positives to Multiple Antivirus Vendors]'''

	== Online Virus Scanners ==		== Online Virus Scanners ==

Anders: /* Where to report false positives */ Url updates

2022-03-11T04:21:47Z

Where to report false positives: Url updates

â† Older revision		Revision as of 04:21, 11 March 2022
Line 86:		Line 86:
	* ALYac: https://en.estsecurity.com/support/report		* ALYac: https://en.estsecurity.com/support/report
	* Antiy-AVL: https://www.antiy.net/contacts/		* Antiy-AVL: https://www.antiy.net/contacts/
			* Avast: https://www.avast.com/en-us/false-positive-file-form.php#pc
	* Avira: https://analysis.avira.com/en/submit		* Avira: https://analysis.avira.com/en/submit
	* Bitdefender: https://www.bitdefender.com/submit/		* Bitdefender: https://www.bitdefender.com/submit/
Line 97:		Line 98:
	* SangFor: https://community.sangfor.com/forum.php?mod=viewthread&tid=3104#https://sec.sangfor.com.cn/login.html?lang=EN-US		* SangFor: https://community.sangfor.com/forum.php?mod=viewthread&tid=3104#https://sec.sangfor.com.cn/login.html?lang=EN-US
	* SecureAge: https://www.secureage.com/article-report-false-positive		* SecureAge: https://www.secureage.com/article-report-false-positive
	* Sophos: https://~~secure2~~.sophos.com/~~en-us~~/~~support~~/~~submit-a-sample.aspx~~		* Sophos: https://support.sophos.com/support/s/filesubmission?language=en_US
	* Symantec (Norton): https://submit.symantec.com/false_positive/		* Symantec (Norton): https://submit.symantec.com/false_positive/
	* Trend Micro: https://www.trendmicro.com/en_us/about/legal/detection-reevaluation.html		* Trend Micro: https://www.trendmicro.com/en_us/about/legal/detection-reevaluation.html

Anders: /* Where to report false positives */ Added ALYac

2022-03-08T22:01:26Z

Where to report false positives: Added ALYac

â† Older revision		Revision as of 22:01, 8 March 2022
Line 84:		Line 84:

	== Where to report false positives ==		== Where to report false positives ==
			* ALYac: https://en.estsecurity.com/support/report
	* Antiy-AVL: https://www.antiy.net/contacts/		* Antiy-AVL: https://www.antiy.net/contacts/
	* Avira: https://analysis.avira.com/en/submit		* Avira: https://analysis.avira.com/en/submit

Anders: /* Where to report false positives */ Max url

2022-03-08T21:29:12Z

Where to report false positives: Max url

â† Older revision		Revision as of 21:29, 8 March 2022
Line 91:		Line 91:
	* GData: https://www.gdatasoftware.com/securitylabs		* GData: https://www.gdatasoftware.com/securitylabs
	* Malwarebytes: https://support.malwarebytes.com/hc/en-us/articles/360038524154-Report-a-false-positive-to-Malwarebytes-Support		* Malwarebytes: https://support.malwarebytes.com/hc/en-us/articles/360038524154-Report-a-false-positive-to-Malwarebytes-Support
	* MaxSecure: infp at maxpcsecure dot com		* MaxSecure: infp at maxpcsecure dot com or https://www.maxsecureantivirus.com/submit_aFalse_Positive.htm
	* McAfee: https://kc.mcafee.com/corporate/index?page=content&id=KB85568		* McAfee: https://kc.mcafee.com/corporate/index?page=content&id=KB85568
	* Microsoft: https://www.microsoft.com/en-us/wdsi/filesubmission		* Microsoft: https://www.microsoft.com/en-us/wdsi/filesubmission

Anders: /* Where to report false positives */

2021-07-28T22:10:18Z

Where to report false positives

â† Older revision		Revision as of 22:10, 28 July 2021
Line 91:		Line 91:
	* GData: https://www.gdatasoftware.com/securitylabs		* GData: https://www.gdatasoftware.com/securitylabs
	* Malwarebytes: https://support.malwarebytes.com/hc/en-us/articles/360038524154-Report-a-false-positive-to-Malwarebytes-Support		* Malwarebytes: https://support.malwarebytes.com/hc/en-us/articles/360038524154-Report-a-false-positive-to-Malwarebytes-Support
			* MaxSecure: infp at maxpcsecure dot com
	* McAfee: https://kc.mcafee.com/corporate/index?page=content&id=KB85568		* McAfee: https://kc.mcafee.com/corporate/index?page=content&id=KB85568
	* Microsoft: https://www.microsoft.com/en-us/wdsi/filesubmission		* Microsoft: https://www.microsoft.com/en-us/wdsi/filesubmission

Anders: /* Where to report false positives */

2021-07-28T21:56:21Z

Where to report false positives

â† Older revision		Revision as of 21:56, 28 July 2021
Line 87:		Line 87:
	* Avira: https://analysis.avira.com/en/submit		* Avira: https://analysis.avira.com/en/submit
	* Bitdefender: https://www.bitdefender.com/submit/		* Bitdefender: https://www.bitdefender.com/submit/
			* eGambit (Tehtris): https://tehtris.com/en/false-positive-negative-requests/
	* Fortinet: https://fortiguard.com/virusscanner		* Fortinet: https://fortiguard.com/virusscanner
	* GData: https://www.gdatasoftware.com/securitylabs		* GData: https://www.gdatasoftware.com/securitylabs
	* Malwarebytes: https://support.malwarebytes.com/hc/en-us/articles/360038524154-Report-a-false-positive-to-Malwarebytes-Support		* Malwarebytes: https://support.malwarebytes.com/hc/en-us/articles/360038524154-Report-a-false-positive-to-Malwarebytes-Support
			* McAfee: https://kc.mcafee.com/corporate/index?page=content&id=KB85568
	* Microsoft: https://www.microsoft.com/en-us/wdsi/filesubmission		* Microsoft: https://www.microsoft.com/en-us/wdsi/filesubmission
	* SangFor: https://community.sangfor.com/forum.php?mod=viewthread&tid=3104#https://sec.sangfor.com.cn/login.html?lang=EN-US		* SangFor: https://community.sangfor.com/forum.php?mod=viewthread&tid=3104#https://sec.sangfor.com.cn/login.html?lang=EN-US